{"id":13469010,"url":"https://github.com/sekey/sekey","last_synced_at":"2026-04-04T12:32:25.429Z","repository":{"id":46243560,"uuid":"112631209","full_name":"sekey/sekey","owner":"sekey","description":"Use Touch ID / Secure Enclave for SSH Authentication!","archived":false,"fork":false,"pushed_at":"2022-11-11T21:09:49.000Z","size":2331,"stargazers_count":2452,"open_issues_count":31,"forks_count":79,"subscribers_count":45,"default_branch":"master","last_synced_at":"2024-10-29T22:56:55.817Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sekey.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-11-30T16:02:21.000Z","updated_at":"2024-10-27T23:04:50.000Z","dependencies_parsed_at":"2023-01-21T12:30:36.260Z","dependency_job_id":null,"html_url":"https://github.com/sekey/sekey","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sekey%2Fsekey","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sekey%2Fsekey/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sekey%2Fsekey/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sekey%2Fsekey/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sekey","download_url":"https://codeload.github.com/sekey/sekey/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245597424,"owners_count":20641869,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T15:01:24.281Z","updated_at":"2026-04-04T12:32:25.359Z","avatar_url":"https://github.com/sekey.png","language":"Rust","funding_links":[],"categories":["Rust","Applications"],"sub_categories":["Frameworks"],"readme":"# SeKey\n\n[![Build Status][build-image]][build-link]\n[![MIT Licensed][license-image]][license-link]\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/ntrippar/sekey/master/assets/screenshot.png\" alt=\"SeKey\" width=\"80%\" height=\"80%\" /\u003e\n\u003c/p\u003e\n\n## About\nSeKey is a SSH Agent that allow users to authenticate to UNIX/Linux SSH servers using the Secure Enclave\n\n## How it Works?\nThe Secure Enclave is a hardware-based key manager that’s isolated from the main processor to provide an extra layer of security. When you store a private key in the Secure Enclave, you never actually handle the key, making it difficult for the key to become compromised. Instead, you instruct the Secure Enclave to create the key, securely store it, and perform operations with it. You receive only the output of these operations, such as encrypted data or a cryptographic signature verification outcome.\n\n\n### Limitations\n* Only support MacBook Pro with the Touch Bar and Touch ID\n* Can’t import preexisting key\n* Stores only 256-bit elliptic curve private key\n\n## Install\n\n**Homebrew**\n\nUnfortunately, I can't make a Homebrew formula because KeyChain API requires entitlements, so the binary has to be signed to work, still you can use [Homebrew Cask](https://caskroom.github.io/)\n\n**Homebrew Cask**\n1. Install Sekey\n```sh\nbrew cask install sekey\n```\n2. Append the following line to your `~/.bash_profile` or `~/.zshrc`\n```sh\nexport SSH_AUTH_SOCK=$HOME/.sekey/ssh-agent.ssh\n```\n_or_\n\n2. Add the following line you your `~/.ssh/config` or `/etc/ssh/ssh_config`\n```\nIdentityAgent ~/.sekey/ssh-agent.ssh\n```\n\n\n**Pkg Installer**\n1. Go to [Releases](https://github.com/ntrippar/sekey/releases/) and download the pkg release\n2. Install the application using the pkg.\n3. Set enviroment variables and fix the path of sekey folder.\n```\nexport PATH=$PATH:/Applications/SeKey.app/Contents/MacOS\nexport SSH_AUTH_SOCK=$HOME/.sekey/ssh-agent.ssh\n```\n\n**Manual Installation**\n1. Go to [Releases](https://github.com/ntrippar/sekey/releases/) and download the zip release\n2. Place the App in the Applications folder.\n3. Go to ~/Library/LaunchAgents\n4. Create the file com.ntrippar.sekey.plist\n5. Paste the following into the file and fix the path of the sekey binary:\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e\n\u003cplist version=\"1.0\"\u003e\n\u003cdict\u003e\n    \u003ckey\u003eLabel\u003c/key\u003e\n    \u003cstring\u003ecom.ntrippar.sekey\u003c/string\u003e\n    \u003ckey\u003eProgramArguments\u003c/key\u003e\n    \u003carray\u003e\n        \u003cstring\u003e/absolute/path/to/SeKey.app/Contents/MacOS/sekey\u003c/string\u003e\n        \u003cstring\u003e--daemon\u003c/string\u003e\n    \u003c/array\u003e\n    \u003ckey\u003eStandardErrorPath\u003c/key\u003e\n    \u003cstring\u003e/dev/null\u003c/string\u003e\n    \u003ckey\u003eStandardOutPath\u003c/key\u003e\n    \u003cstring\u003e/dev/null\u003c/string\u003e\n    \u003ckey\u003eKeepAlive\u003c/key\u003e\n    \u003ctrue/\u003e\n\u003c/dict\u003e\n\u003c/plist\u003e\n\n```\n4. Fix permissions\n```sh\nchown youruser:staff /absolute/path/to/SeKey.app/Contents/MacOS/sekey\n```\n5. Load the agent to the user account:\n```sh\nlaunchctl load -F ~/Library/LaunchAgents/com.ntrippar.sekey.plist\n```\n6. Set enviroment variables and fix the path of sekey folder.\n```\nexport PATH=$PATH:/path/to/SeKey.app/Contents/MacOS\nexport SSH_AUTH_SOCK=$HOME/.sekey/ssh-agent.ssh\n```\n\n## Usage\n\nFor the help menu:\n\n```sh\nntrippar@macbookpro:~% sekey -h\nSeKey 1.0\nNicolas Trippar \u003cntrippar@gmail.com\u003e\nUse Secure Enclave for SSH Authentication\n\nUSAGE:\n    sekey [FLAGS] [OPTIONS]\n\nFLAGS:\n        --daemon       Run the daemon\n    -h, --help         Prints help information\n        --list-keys    List all keys\n    -V, --version      Prints version information\n\nOPTIONS:\n        --delete-keypair \u003cID\u003e         Deltes the keypair\n        --export-key \u003cID\u003e             export key to OpenSSH Format\n        --generate-keypair \u003cLABEL\u003e    Generate a key inside the Secure Enclave\n```\n\n\n**Examples**\n\nCreate KeyPair inside the Secure Enclave:\n\n```sh\nntrippar@macbookpro:~% sekey --generate-keypair \"Github Key\"\nKeypair Github Key sucessfully generated\n\n```\n\nList keys in the secure enclave:\n\n```sh\nntrippar@macbookpro:~% sekey --list-keys\n\n┌────────────────────┬──────────────────────────────────────────────────┐\n│       Label        │                        ID                        │\n├────────────────────┼──────────────────────────────────────────────────┤\n│     Github Key     │     d179eb4c2d6a242de64e82240b8b6e611cf0d729     │\n└────────────────────┴──────────────────────────────────────────────────┘\n```\n\nExport public key to OpenSSH format:\n\n```sh\nntrippar@macbookpro:~% sekey --export-key d179eb4c2d6a242de64e82240b8b6e611cf0d729\necdsa-sha2-nistp25 AAAAEmVjZHNhLXNoYTItbmlzdHAyNQAAAAhuaXN0cDI1NgAAAEEE8HM7SBdu3yOYkmF0Wnj/q8t2NJC6JYJWZ4IyvkOVIeUs6mi4B424bAjhZ4Awgk5ax9r25RB3Q8tL2/7J/3xchQ==\n```\n\nDelete Keypair:\n\n```sh\nntrippar@macbookpro:~% sekey --delete-keypair d179eb4c2d6a242de64e82240b8b6e611cf0d729\nKey d179eb4c2d6a242de64e82240b8b6e611cf0d729 sucessfully deleted\n```\n\nUse key for a specific host:\n\n1. export the public key from sekey and save it to a file\n```sh\nntrippar@macbookpro:~% sekey --export-key d179eb4c2d6a242de64e82240b8b6e611cf0d729 \u003e ~/.ssh/example.com.pub\n```\n2. on the ssh config file located in `~/.ssh/config` we should add a entry so the ssh only query that key for the given host\n\n```\nHost example.com\n    IdentityFile ~/.ssh/example.com.pub\n    IdentitiesOnly yes\n```\n\n## How to Build\n\n**Build**\n\nSekey is built with [Cargo](https://crates.io/), the Rust package manager.\n\n```sh\ngit clone https://github.com/ntrippar/sekey\ncd sekey\ncargo build --release\n```\n\n\n**Sign**\n\nSeKey utilizes the KeyChain API on MacOS, for using it the app needs to be signed and have the correct entitlements.\n\nYou need to change the sign parameter to match your own signing key\n\nListing keys\n\n```sh\nsecurity find-identity -v -p codesigning\n```\n\nSign\n\n```sh\ncodesign --force --identifier \"com.ntrippar.sekey\" --sign \"Developer ID Application: Nicolas Trippar (5E8NNEEMLP)\" --entitlements ./assets/sekey.entitlements --timestamp=none ./bundle/SeKey.app\n```\n\n**Package**\n\n```sh\ncp ./target/release/sekey ./bundle/Applications/SeKey.app/Contents/MacOS/sekey\n```\n\nif needed to create a pkg installer\n```sh\npkgbuild --analyze --root ./bundle/ SeKey.plist\n\npkgbuild --sign \"Developer ID Installer: Nicolas Trippar (5E8NNEEMLP)\" --identifier com.ntrippar.sekey --root ./bundle/ --scripts ./install-scripts --component-plist ./Sekey.plist ./sekey.pkg\n```\n\n## Contribute\nMembers of the open-source community are encouraged to submit pull requests directly through GitHub.\n\n[build-image]: https://travis-ci.org/sekey/sekey.svg?branch=master\n[build-link]: https://travis-ci.org/sekey/sekey\n[license-image]: https://img.shields.io/github/license/sekey/sekey.svg\n[license-link]: https://github.com/sekey/sekey/blob/master/LICENSE\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsekey%2Fsekey","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsekey%2Fsekey","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsekey%2Fsekey/lists"}