Sekey is a hardware-backed SSH key manager and authentication agent designed to isolate private keys from system memory. It utilizes a secure enclave to generate, store, and manage cryptographic key pairs, ensuring that sensitive material remains within a protected hardware environment and cannot be extracted by the host system.
The project implements biometric-gated request signing, requiring a biometric authentication event before the hardware security module signs a cryptographic challenge. It functions as a middleware bridge that connects standard SSH protocols to these hardware-based signing mechanisms for session verification.
The system covers the full lifecycle of hardware-resident keys, including generation, deletion, and the export of internal hardware keys into standard public key formats for remote server authorization. It performs all signing and decryption operations inside the secure enclave to maintain hardware-backed access control.