Hardware-verified devices
| Device | Capabilities | Notes |
|---|---|---|
| Token2 Molto2 / Molto2v2 | TOTP slot programming, bulk import | Programmed over the vendor-specific SM4-MAC protocol; bulk import from Aegis / 2FAS / otpauth lists, clock sync, customer-key rotation. See the Molto2 page. |
| Token2 single-profile tokens (OTPC-P1-i / P2-i, miniOTP-2-i / 3-i, C301-i, C302-i) | Single-account TOTP seed + config programming | Programmed over a contact or contactless PC/SC reader with a fixed device key; writes the seed, HMAC algorithm, time-step and display timeout. The model is recognized from the device serial. |
| Token2 PIN+ Series | FIDO2 (+ bio), OTP, OpenPGP, PIV | FIDO2 with fingerprint enrollment and MDS display, plus on-device OTP (TOTP/HOTP) over CCID / NFC / USB-HID — validated on PIN+ hardware, contributed by Token2. HID-HOTP applies to the models that carry it; recent releases (R3.2+/R3.3+) ship with the HID channel disabled by design and use CCID. Keys running the R3.4+ OTP applet can put codes behind an OTP PIN; keys without it answer the capability probe with "no such command" and are unaffected. See On-device OTP. The OATH / OpenPGP / PIV applets are handled by the standard byte layers but not yet exercised on PIN+ hardware by this project (experimental). |
| YubiKey (5 series) | FIDO2, OATH, OpenPGP, PIV | Built and verified against a YubiKey 5.7. |
| SoloKeys Solo 2 | FIDO2, OATH | Trussed firmware; no OpenPGP applet. HOTP caveat: the last-shipped Solo 2 firmware (2.3.x) computes HOTP over a 4-byte counter where RFC 4226 specifies 8, so its HOTP codes won't verify against standards-compliant servers. TOTP is unaffected. |
| Nitrokey 3 | FIDO2, OATH, PIV; OpenPGP detected | Built around the same Trussed firmware core as Solo 2, but the final firmware is different — e.g. Nitrokey 3 has PIV support, while Solo 2 does not. PIV verified on a Nitrokey 3A NFC (firmware 1.8.3), contributed by episource. The OpenPGP applet is detected but not yet exercised by this project. |
| Swissbit iShield Key 2 Pro | PIV (partial) | Key generation and certificate handling verified by episource on their own card. Slot status is not yet trustworthy: the card reports every slot's key type as ECC P-384 (#113). Answers the Yubico version extension with four bytes instead of three; keyroost keeps the reply as sent. Other applets not yet exercised by this project. |
When a capability shows a "?"
keyroost verifies a device's capabilities by asking the device itself,
over a smart-card reader. When it can't ask — no reader is connected, or
the smart-card service (pcscd on Linux) isn't running — a capability the
device may well have shows with a question mark: OTP? in the
app's badges and in keyroostctl list. The feature is still
offered and works normally if present; the mark only means "not confirmed
by the device yet". A plain badge means the device answered for itself.
Any standards-compliant FIDO2 key
keyroost implements the published specs, not vendor SDKs, so the FIDO2 surface — getInfo, passkey management, PIN, reset — works on any CTAP2 authenticator, including ones not listed above (Thales, Feitian, Titan, and others). Optional features such as fingerprints, large-blob storage and authenticator configuration appear only when the key advertises them. The OATH / OpenPGP / PIV panes apply to any card exposing those applets over PC/SC.
Older U2F-only (CTAP1) keys are detected by list but
don't support the CTAP2 management commands.
The canonical list
This page tracks releases; the README's Supported devices table is the always-current version, updated as hardware is verified.