Hardware-verified devices
| Device | Capabilities | Notes |
|---|---|---|
| Token2 Molto2 / Molto2v2 | TOTP slot programming, code import | Programmed over the vendor-specific SM4-MAC protocol; imports Aegis / 2FAS / otpauth-list exports and QR screenshots, clock sync, customer-key rotation. See the Molto2 page. |
| Token2 single-profile tokens (OTPC-P1-i / P2-i, miniOTP-2-i / 3-i, C301-i, C302-i) | Single-account TOTP seed + config programming | Programmed over a contact or contactless PC/SC reader with a fixed device key; writes the seed, HMAC algorithm, period and display timeout. The model is recognized from the device serial. |
| Token2 PIN+ Series | FIDO2 (+ bio), OTP (incl. import), OpenPGP, PIV | FIDO2 with fingerprint enrollment and MDS display, plus on-device OTP (TOTP/HOTP) over CCID / NFC / USB-HID — validated on PIN+ hardware, contributed by Token2. HID-HOTP applies to the models that carry it; recent releases (R3.2+/R3.3+) ship with that HID channel disabled by design, and keyroost reaches their OTP applet through the FIDO interface over USB, or over CCID. Keys running the R3.4+ OTP applet can put codes behind an OTP PIN; keys without it answer the capability probe with "no such command" and are unaffected. See On-device OTP. The OATH / OpenPGP / PIV applets are handled by the standard byte layers but not yet exercised on PIN+ hardware by this project (experimental). |
| YubiKey (5 series) | FIDO2, OATH (incl. import), OpenPGP, PIV | Built and verified against a YubiKey 5.7. |
| SoloKeys Solo 2 | FIDO2, OATH (incl. import) | Trussed firmware; no OpenPGP applet. HOTP caveat: the last-shipped Solo 2 firmware (2.964) computes HOTP over a 4-byte counter where RFC 4226 specifies 8, so its HOTP codes won't verify against standards-compliant servers. TOTP is unaffected. |
| Nitrokey 3 | FIDO2, OATH (incl. import), PIV; OpenPGP detected | Built around the same Trussed firmware core as Solo 2, but the final firmware is different — e.g. Nitrokey 3 has PIV support, while Solo 2 does not. PIV verified on a Nitrokey 3A NFC (firmware 1.8.3), contributed by episource. The OpenPGP applet is detected but not yet exercised by this project. |
| Swissbit iShield Key 2 Pro | PIV (partial) | Key generation and certificate handling verified by episource on their own card. keyroost doesn't take a slot's key type or PIN/touch policy from this card's GET METADATA reply (#113). Answers the Yubico version extension with four bytes instead of three; keyroost keeps the reply as sent. Other applets not yet exercised by this project. |
When a capability shows a "?"
keyroost verifies a device's capabilities by asking the device itself,
over a smart-card reader. When it can't ask — no reader is connected, or
the smart-card service (pcscd on Linux) isn't running — a capability the
device may well have shows with a question mark: OTP? in the
app's badges and in keyroostctl list. The feature is still
offered and works normally if present; the mark only means "not confirmed
by the device yet". FIDO2? means a FIDO key opened but didn't
properly answer keyroost's first question, or is reached only through a reader
whose FIDO applet doesn't report FIDO2; no name is read and no FIDO2 reset is
offered until it answers. A plain badge means the device answered for itself
(a FIDO key keyroost can't open at all also keeps a plain FIDO2).
Any standards-compliant FIDO2 key
keyroost implements the published specs, not vendor SDKs, so the FIDO2 surface — getInfo, passkey management, PIN, reset — works on any CTAP2 authenticator, including ones not listed above (Thales, Feitian, Titan, and others). Optional features such as fingerprints, large-blob storage and authenticator configuration appear only when the key advertises them. The OATH / OpenPGP / PIV panes apply to any card exposing those applets over PC/SC. For PIV, keyroost identifies the card's applet and dims vendor extensions listed as unsupported for it, with an override — see what each key supports.
Older U2F-only (CTAP1) keys, such as the YubiKey NEO, show as
U2F in keyroostctl list and the app; they don't support the CTAP2
management commands, so the app shows no FIDO2 tab for them.
The canonical list
This page tracks releases; the README's Supported devices table is the always-current version, updated as hardware is verified.