[mcamposv]

This adds the Shōsōin organisation (org/shosoin) and requests PID 1209:C4DE for Cardea Key.

Project

• Name: Cardea Key — open-source security key firmware for the Raspberry Pi Pico 2 (RP2350).
• Source: https://github.com/shosoin/cardea-key (public)
• License: AGPL-3.0 — LICENSE at the repository root (same license as the upstream projects it builds on, pico-fido and pico-openpgp).
• Website: https://cardeakey.org/
• First release: v0.1.0, built from the public source; it currently uses the shared test ID 1209:0001.

The device is one composite USB device with several interfaces: FIDO HID (FIDO2/WebAuthn, U2F), a keyboard HID (OTP slots), CCID (OpenPGP card, PIV, OATH) and WebUSB.

Prerequisites (howto §0)

• Publicly available source code repository.
• Source code for a device with a USB interface (complete firmware; no closed parts).
• Recognised open-source license, with a LICENSE file in the repository.
• python test/validate_pids.py passes locally ("No errors found!").

Why this firmware needs its own PID

This is a firmware-only project today, so here is the justification the howto asks for:

1. Host software identifies the device by VID:PID. Linux/macOS pcscd only loads its CCID driver (libccid) for VID:PIDs in its supported-reader list. With the shared test ID, OpenPGP, PIV and OATH only work after editing a system file by hand. With a dedicated PID we can ask libccid to list the device, so it works out of the box for every user of the firmware. End users each requesting their own PID would defeat that purpose.
2. 1209:0001 is a shared test ID and not meant for distributed devices, and we now publish release binaries.
3. It is a complete device, not a library or a generic development board: the firmware defines the whole USB device (descriptors, interfaces, behaviour) and users flash it as-is.
4. The ID belongs to the project and carries over to its own hardware. The roadmap adds an NXP SE051 secure element and then an open board design; the PID stays the same.

Similar firmware-only security keys on VID 1209 for comparison: 1209:F1D2 (RS-Key, RP2350 firmware with FIDO2/OpenPGP/PIV/OATH, AGPL-3.0), 1209:2900 (U2FDevice), 1209:5070 (SoloKeys hacker edition).

Chosen PID

C4DE ("Cardea"). It is unused, not in the reserved 0xxx/1xxx ranges, and not requested in any open pull request as of today.

Thank you for running pid.codes!