🔧 Developer beta launches 30 September 2026 — free for developers. Flash your own ESP32-S3 and test it. Learn more →

Developers

Read the spec. Write your own client. No permission needed.

The protocol and the file format are published in full, the SDKs are Apache-2.0 and the client is GPL-3.0. You can build an interoperable implementation without any agreement with lake8.dev, and without access to our repository.

What is published

HID protocol

VID 0x303A, PID 0x8123, 64-byte reports, fourteen implemented opcodes, a PIN gate and encryption performed on the chip. Enough to write a client from scratch.

Read the spec →

.crin format

66-byte header, magic "CRIN", AES-256-GCM, per-file key derived with HKDF on the dongle. The format outlives the vendor: any conforming implementation decrypts it.

Read the spec →

Windows SDK (DLL)

C# integration for Windows applications. Apache-2.0, free during the beta. It is a .NET class library: there is no C ABI layer, so C++ cannot consume it directly.

Quick start →

Linux CLI

Encrypt and decrypt .crin from the shell on Linux and macOS. .NET 9 wrapper around CryptinSDK, Apache-2.0. Ships with the developer beta. The Python files in tools/ are an internal test harness, not a distributable SDK.

What to use →

App Personal

The Windows client is open source: build it, fork it, or port it to Linux and macOS. Pull requests are reviewed and merged.

Build and contribute →

Developer beta

Flash your own ESP32-S3 and test the whole stack. Free, 30 September 2026, no hardware supplied — that is the point.

Join the beta →

The firmware is the one closed part: it ships as a binary signed with the lake8.dev key, because with its source anyone could strip the PIN and the licence check. Nothing about it is needed to write a client — the protocol and the format are enough, which is the whole point.

Activation model

When activating a dongle you choose how much information lake8.dev receives. The cryptographic keys never leave the chip regardless of your choice — what changes is only the personal data.

What reaches lake8.dev and what does notK_root, K_attestation and the recovery seed never leave the dongle. Session keys, file keys and .crin files stay on the user device and are never transmitted. lake8.dev always receives payment data and the public half of K_identity. Personal data is a choice: in anonymous activation lake8.dev receives no email, no name and no tax ID; in registered activation it receives all three.DongleUser devicelake8.devK_rootK_attestationK_recovery seednever leave the chipNEVER TRANSMITTEDK_sessionK_file.crin filesALWAYS RECEIVEDpayment dataK_identity pubkeyYOUR CHOICEMODE A — ANONYMOUSemailnametax IDMODE B — REGISTEREDemailname + surnametax ID (CF/VAT)The keys never leave the chip either way. What changes is only how much you tell us about yourself.

Anonymous activation is not a lesser tier: it is the same product, activated without telling us who you are. The registered mode exists because invoicing and VAT sometimes require it. Details in thesecurity model.

Contributing

The community contributes to the client and the SDKs. lake8.dev reviews every change to cryptography, to the HID protocol and to licence activation, and signs the release binaries.

The SDK repository opens at the developer beta, 30 September 2026. It has no public address yet, which is why there is no link here: until then the code lives in a private repository, and the specifications on this site are what a third party implements against.

Questions: info@lake8.dev · Security issues: security@lake8.dev, under the disclosure policy.