Docs for firmware 3.1.0: user input modes, web derive mode, CLI additions, retired quick setup / plausible deniability / Travel Edition

docmd.config.js

@@ -38,7 +38,6 @@ module.exports = defineConfig({
         { title: 'Works with OnlyKey', path: '/workswithonlykey' },
         { title: 'Upgrade Guide', path: '/upgradeguide' },
         { title: 'Legacy Firmware Upgrade Guide', path: '/legacyupgradeguide' },
-        { title: 'International Travel Edition Guide', path: '/ite' },
         { title: 'Plausible Deniability Setup Guide', path: '/pdguide' },
         { title: 'Windows Active Directory Guide', path: '/activedirectory' },
         { title: 'Linux - Using OnlyKey with Linux', path: '/linux' },

docs/command-line.md

@@ -131,6 +131,11 @@ Displays the version of the app
 #### fwversion
 Displays the version of the OnlyKey firmware
 
+#### capabilities
+Asks the firmware what it supports (firmware 3.1.0 or later): firmware version and commit
+hashes, protocol version, supported key types, device type (OnlyKey or DUO), post-quantum support and the
+user input modes each of derivedkeymode / storedkeymode / webderivemode accepts. Older firmware is reported as not supporting the report.
+
 #### wink
 OnlyKey flashes blue (winks), may be used for visual confirmation of connectivity
 
@@ -205,19 +210,24 @@ Change the OnlyKey's button touch sensitivity.
 WARNING: Setting button's touch sensitivity lower than 5 is not recommended as this could result in inadvertent button press.
 2 = highest sensitivity; 100 = lowest sensitivity [12 = default]
 
-#### 2ndprofilemode [num]
-Set during init (Initial Configuration) to set 2nd profile type 1 = standard (default); 2 = plausible deniability
-
 #### storedkeymode [num]
-Enable or disable challenge for stored keys (SSH/PGP)
-0 = Challenge Code Required (default); 1 = Button Press Required
+User input required to use a stored key (RSA1-4, ECC1-16) for SSH/PGP
+0 = Challenge Code Required; 1 = Button Press Required (default)
+Device must be in config mode to change this setting.
 [More info](/usersguide#stored-challenge-mode)
 
 #### derivedkeymode [num]
-Enable or disable challenge for stored keys (SSH/PGP)
-0 = Challenge Code Required (default); 1 = Button Press Required
+User input required to use a derived key (OnlyKey Agent SSH/PGP identities)
+0 = Challenge Code Required; 1 = Button Press Required (default)
+Device must be in config mode to change this setting.
 [More info](/usersguide#derived-challenge-mode)
 
+#### webderivemode [num]
+User input required to use a web derived key (keys derived per label for the browser apps at onlyagent.app and for `age-plugin-onlykey`, X25519 and X-Wing)
+0 = Challenge Code Required; 1 = Button Press Required (default); 2 = No Press
+Device must be in config mode to change this setting. The key itself never depends on this setting - a file encrypted to a label always decrypts regardless of how the user confirms.
+[More info](/usersguide#web-derive-mode)
+
 #### hmackeymode [num]
 Enable or disable button press for HMAC challenge-response
 0 = Button Press Required (default); 1 = Button Press Not Required.
@@ -228,15 +238,13 @@ Enable or disable button press for HMAC challenge-response
 WARNING - Once set to "Locked" this cannot be changed unless a factory reset occurs.
 [More info](/usersguide#backup-key-mode)
 
-#### sysadminmode
-Enable or disable challenge for stored keys (SSH/PGP)
-0 = Challenge Code Required (default); 1 = Button Press Required
-[More info](/usersguide#derived-challenge-mode)
+#### sysadminmode [num]
+Enable or disable sysadmin mode (modifier keys in slots). Device must be in config mode to change this setting.
+[More info](/usersguide#sysadmin-mode)
 
-#### lockbutton
-Enable or disable challenge for stored keys (SSH/PGP)
-0 = Challenge Code Required (default); 1 = Button Press Required
-[More info](/usersguide#derived-challenge-mode)
+#### lockbutton [num]
+Set which button locks the device (per profile).
+[More info](/usersguide#configurable-lock-button)
 
 ### Slot Config Options
 
@@ -271,9 +279,12 @@ Sets raw private keys and key labels, to set PEM format keys use the OnlyKey App
   - [key slot] must be key number RSA1 - RSA4, ECC1 - ECC16, HMAC1 - HMAC2
   - [type] must be one of the following:
     - label - set to have a descriptive key label i.e. My GPG signing key
-    - x - X25519 Key Type (32 bytes)
+    - x - Ed25519 Key Type (32 bytes, signing)
     - n - NIST256P1 Key Type (32 bytes)
     - s - SECP256K1 Key Type (32 bytes)
+    - c - X25519 (Curve25519) Key Type (32 bytes, decryption only)
+    - m - ML-KEM-768 seed (64 bytes, decryption only, firmware 3.1.0+)
+    - w - X-Wing seed (32 bytes, decryption only, firmware 3.1.0+)
     - 2 - RSA Key Type 2048bits (256 bytes)
     - 4 - RSA Key Type 4096bits (512 bytes)
     - h - HMAC Key Type (20 bytes)
@@ -287,9 +298,12 @@ Sets raw private keys and key labels, to set PEM format keys use the OnlyKey App
 Generates random private key on device
   - [key slot] must be key number ECC1 - ECC16 (only ECC keys supported)
   - [type] must be one of the following:
-    - x - X25519 Key Type (32 bytes)
-    - n - NIST256P1 Key Type (32 bytes)
-    - s - SECP256K1 Key Type (32 bytes)
+    - x - Ed25519 Key Type
+    - n - NIST256P1 Key Type
+    - s - SECP256K1 Key Type
+    - c - X25519 (Curve25519) Key Type
+    - m - ML-KEM-768 Key Type (firmware 3.1.0+)
+    - w - X-Wing Key Type (firmware 3.1.0+)
   - [features] must be one of the following:
     - s - Use for signing
     - d - Use for decryption

docs/duousersguide.md

@@ -576,13 +576,17 @@ Note: These additional keyboard layouts are available but cannot currently be se
 
 OnlyKey supports automatic generation of keys that may be used for SSH and PGP/GPG with the [OnlyKey Agent](/onlykey-agent).
 
-The default setting is "Challenge Code Required" which requires a 3 digit challenge code to be entered on OnlyKey to perform SSH or PGP/GPG operation. This is great for security but for some users a more convenient approach may be preferred. With "Button Press Required", a physical press on any key is all that is required to perform the operation.
+This setting chooses how you confirm each use of a derived key. Since firmware 3.1.0 the default is **Button Press Required**: a physical press on any of the three buttons completes the operation. **Challenge Code Required** asks for a 3 digit code instead (the agent prints the code; on a DUO each digit is 1-3); it is the stronger choice when the host might issue requests you did not initiate. The setting can only be changed with the device in config mode, and the key itself never depends on it.
 
 ### Stored Key User Input Mode {#stored-challenge-mode}
 
 OnlyKey supports [import of existing OpenPGP keys](/importpgp#loading-keys) using the [OnlyKey app](/app). These keys once imported are securely stored in OnlyKey hardware and may be used to perform SSH or PGP/GPG operations with the [OnlyKey Agent](/onlykey-agent) or in the browser with the [OnlyKey WebCrypt](/webcrypt).
 
-By default, you must enter a 3 digit challenge code on OnlyKey to perform SSH or PGP/GPG operation. If a more convenient approach is preferred "Button Press Required" may be set so that a physical press on any key is all that is required.
+The same two choices as the derived key setting apply, independently: Challenge Code Required and Button Press Required (default since firmware 3.1.0). Config mode is required to change it.
+
+### Web Derived Key User Input Mode {#web-derive-mode}
+
+Browser apps at [onlyagent.app](https://onlyagent.app) and the `age-plugin-onlykey` command line tool can derive an X25519 or X-Wing (post-quantum hybrid) key from a label you choose; the device never stores the key and the same label always yields the same key, in the browser and on the command line. This setting chooses how those derivations are confirmed: Challenge Code Required (the page or tool shows the 3 digit code), Button Press Required (default) or No Press. It is set from the OnlyKey App preferences or `onlykey-cli webderivemode`, in config mode. As with the other two settings, changing it never changes the derived key, so files encrypted to a label always decrypt.
 
 ### HMAC Mode {#hmac-mode}
 

docs/faq.md

@@ -79,10 +79,6 @@ In addition to on-device PIN security OnlyKey has functionality that smart cards
 
 There are a variety of hardware and software tokens out there. Some support FIDO U2F and others support Yubikey OTP and yet others support Google Authenticator (TOTP). Unfortunately for users not all websites support all of these. There is no standardization of two-factor support among websites so in order to log in using a token you often need multiple tokens and apps. OnlyKey set out to address this issue and make two-factor authentication usable by supporting the methods most commonly used by websites. Additionally, by combining this with password management we can provide users with a secure login with the touch of a button.
 
-## What specifically are the differences between the Standard Edition firmware and the International Travel Edition firmware?
-
-The International Travel Edition firmware is essentially a feature limited version of the OnlyKey. It is a fully functional password manager but does not utilize encryption and may be usable in countries where encryption is banned/restricted. More information [here](/ite).
-
 ## What does entering the self destruct PIN do?
 
 Depending on what your wipe mode is set to it either wipes all sensitive data (erases your usernames, passwords, keys etc.) or if you are using full wipe mode it does a complete erase of the OnlyKey including sensitive data and all firmware (this requires reloading firmware).

docs/features.md

@@ -71,10 +71,8 @@ In a pinch and want to wipe your OnlyKey? Enter your self-destruct PIN to wipe E
 
 *   [What does entering the self destruct PIN do?](/faq#what-does-entering-the-self-destruct-pin-do)
 
-### PLAUSIBLE DENIABILITY FEATURE
-The first and only hardware solution where only you hold the keys + no proof there even are keys! Travel abroad without having to give up your encryption keys/passwords.
-
-*   [International Travel Edition Guide](/ite)
+### PLAUSIBLE DENIABILITY FEATURE (RETIRED)
+The plausible deniability second profile is retired as of firmware 3.1.0; every profile is encrypted under its PIN. See the [Plausible Deniability Setup Guide](/pdguide) for what changes on devices that already use it.
 
 ### ENCRYPTED BACKUP ANYWHERE
 OnlyKey types out the encrypted backup so it works anywhere independent of apps. Save the encrypted backup to a file or email it to yourself.
@@ -155,9 +153,7 @@ OnlyKey is the world's first device to allow changing your keyboard layout on th
 
 #### Unconfigured OnlyKey {#uninitialized-onlykey}
 
-*   Hold button #3 down for 5+ seconds to start quick setup - See [OnlyKey Quick Setup](/usersguide#quick-setup) for more information.
-*   Hold button #1 down for 5+ seconds to start quick setup in manual mode.
-*   Hold button #2 down for 5+ seconds to start quick setup in auto mode.
+*   An unconfigured OnlyKey does nothing on button presses; set it up with the [OnlyKey App](/usersguide#onlykey-setup).
 
 #### Locked OnlyKey {#locked-onlykey}
 

docs/index.md

@@ -80,7 +80,3 @@ The Knowledge Base contains guides and information for using OnlyKey in specific
 
 **[Works with OnlyKey](/workswithonlykey)** - A list of applications and things that work with OnlyKey
 
-**[International Travel Edition Guide](/ite)** - Follow this guide to use the International Travel Edition OnlyKey.
-
-**[Plausible Deniability Setup Guide](/pdguide)** - Follow this guide to use the plausible deniability feature of OnlyKey
-

docs/ite.md

@@ -1,93 +1,27 @@
 ---
 title: International Travel Edition Guide
-description: Follow this guide to use the International Travel Edition OnlyKey
+description: The International Travel Edition firmware is retired; what to do with a device running it
 slug: ite
-last_updated: June, 6, 2024
+last_updated: September, 7, 2026
 keywords: OnlyKey, International Travel Edition, Plausible Deniability
 ---
 
-## What is the International Travel Edition?
+## The International Travel Edition is retired
 
-This version of OnlyKey firmware is designed to meet all international requirements in regards to encryption. It does this by not utilizing encryption at all. Because this version does not encrypt any data on device it can be used in areas where data encryption is forbidden and/or there are mandatory key disclosure requirements. This is particularly useful for international travel where the traveler would like to have secure portable access to accounts.
+The International Travel Edition was a separate OnlyKey firmware build that did not use encryption, intended for countries where encryption is banned or restricted. It was a fully functional password manager without PGP, SSH, backup encryption, or the second (encrypted) profile.
 
-## How are accounts secure without encryption?
+As of firmware 3.1.0 there is one OnlyKey firmware edition, and every profile is encrypted under its PIN. The Travel Edition build is no longer produced, and the standard firmware no longer contains the non-encrypted mode it relied on.
 
-Even though data is not encrypted, there is physical security of the accounts on the OnlyKey. This is accomplished through locking the flash memory and requiring a PIN code to access accounts. The accounts stored on the device can only be accessed with the correct PIN. Entering 10 incorrect PINs will completely wipe the device. Unlike a device like a flash/jump drive, the OnlyKey is locked so that there is no way of reading the data stored on the device.
+## If your OnlyKey is running the International Travel Edition
 
-## Limited features
+Your device keeps working as it is; nothing changes until you load new firmware. When you are ready to move to the standard firmware:
 
-The International Travel Edition has a limited feature set, including:
+1. Take a backup of your slots with the [OnlyKey App](/app) (backups made on the Travel Edition are not encrypted - treat the file accordingly).
+2. Load the standard firmware following the [firmware loading guide](/firmware).
+3. Set the device up again with the App (PINs, backup passphrase) and restore your backup.
 
-- Storage of 12 slots, each slot may contain:
-  - Label - A reminder of what account is stored
-  - URL - The site to log into may be automatically typed in the browser address bar
-  - Username
-  - Password
-  - 2FA - Google Authenticator OTP (TOTP) is supported
+There is no in-place upgrade path from the Travel Edition, because the device has no encryption keys to migrate.
 
-- Firmware loading through the app - You can switch back and forth from the International Travel Edition and Standard edition firmware through the OnlyKey app.
-
-- Preferences
-  - Type Speed
-  - Keyboard layout (International keyboard profiles are helpful for international travel)
-  - Wipe mode
-  - Inactivity lockout period
-
-Features not included in the International Travel Edition OnlyKey that are available in the Standard Edition OnlyKey:
-- Secure backup and restore
-- FIDO U2F / Yubikey OTP
-- SSH/OpenPGP
-- Second Profile
-
-## Switch to Standard Edition Firmware
-
-It is easy to switch between the International Travel Edition firmware and the Standard Edition firmware. Keep in mind that switching from the Standard Edition to the International Travel Edition will disable features not available such as the second profile. In order to switch to Standard Edition firmware ensure that your International Travel Edition OnlyKey is in a factory default state and select [Load Firmware] in the OnlyKey App.
-
-- Download <a href="https://github.com/trustcrypto/OnlyKey-Firmware/releases/download/v3.0.4-prod/Signed_OnlyKey_3_0_4_STD.txt" target="_blank" download>OnlyKey Standard Edition firmware</a>
-- Download <a href="https://github.com/trustcrypto/OnlyKey-Firmware/releases/download/v3.0.4-prod/Signed_OnlyKey_3_0_4_IN_TRVL.txt" target="_blank" download>OnlyKey International Travel Edition firmware</a>
-
-:::note
-You can ensure the integrity of your downloaded file by verifying the checksum. <br>Signed_OnlyKey_3_0_4_STD.txt f895100a2f828b66ec5335fd676ef659daf87d51bfeecca5fb8bf9b7c8e259bd<br>Signed_OnlyKey_3_0_4_IN_TRVL.txt 0c4d2f33c5b934c422b7bc9642d0f696c5674c2cf307756c5dee0933a70cd745
-:::
-
-- Select the [Load Firmware] button as shown below and follow the instructions in the app to load firmware
-
-![](/assets/ite6.png)
-
-:::tip "💡 Pro Tip"
-***Factory Default?***<br><br>
-To perform a factory default you have two options:
-<br>
-<br>
-**Method #1** - Enter your self-destruct PIN.
-<br>
-<br>
-**Method #2** - Enter 10 incorrect PINs. You will notice that after entering 3 incorrect PINs your OnlyKey is steadily blinking red. This is an intentional safeguard so that your OnlyKey will not be inadvertently wiped by repeatedly pressing buttons. You must remove and reinsert your OnlyKey and enter 3 more incorrect PINs. Repeat this until 10 incorrect PINs have been entered. The device will then have a solid green light on that indicates that it is in a factory default state.
-:::
-
-## Setup guide
-
-In order to setup an OnlyKey with the International Travel Edition first ensure you have loaded the International Travel Edition firmware and you have installed the OnlyKey app.
-
-Step 1 - Select [Next] to get started.
-![](/assets/ite1.png)
-
-Step 2 - Enter a PIN code, check the disclaimer box, and select [Next].
-![](/assets/ite2.png)
-
-Step 3 - Re-enter PIN code, and select [Next].
-
-Step 4 - Select [I don't want a second profile, skip this step]
-![](/assets/ite4.png)
-
-Step 5 - If you wish to set a self-destruct PIN enter a PIN code, check the disclaimer box, and select [Next].
-![](/assets/ite5.png)
-
-Step 6 - Re-enter PIN code, and select [Next].
-
-Your device is now set up, remove and reinsert OnlyKey to set up accounts.
-
-### Set Wipe Mode
-
-The wipe mode setting determines what is wiped when a factory default occurs. The default setting is to just wipe the sensitive data, there is also the option to do a "Full Wipe" which wipes sensitive data and firmware. If keeping the type and version of firmware that is loaded confidential is desired, go to preferences in the OnlyKey app and set the wipe mode of your OnlyKey to "Full Wipe". More information on this setting is available here - [Wipe Mode Feature](/usersguide#configurable-wipe-mode).
+## Related
 
+- [Plausible Deniability Setup Guide](/pdguide) - the plausible deniability second profile, which used the same non-encrypted mode, is retired at the same time and is migrated automatically.