# sekey/sekey

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/sekey-sekey).**

2,514 stars · 80 forks · Rust · MIT

## Links

- GitHub: https://github.com/sekey/sekey
- awesome-repositories: https://awesome-repositories.com/repository/sekey-sekey.md

## Description

Sekey is a hardware-backed SSH key manager and authentication agent designed to isolate private keys from system memory. It utilizes a secure enclave to generate, store, and manage cryptographic key pairs, ensuring that sensitive material remains within a protected hardware environment and cannot be extracted by the host system.

The project implements biometric-gated request signing, requiring a biometric authentication event before the hardware security module signs a cryptographic challenge. It functions as a middleware bridge that connects standard SSH protocols to these hardware-based signing mechanisms for session verification.

The system covers the full lifecycle of hardware-resident keys, including generation, deletion, and the export of internal hardware keys into standard public key formats for remote server authorization. It performs all signing and decryption operations inside the secure enclave to maintain hardware-backed access control.

## Tags

### Security & Cryptography

- [Hardware Security Key Authentications](https://awesome-repositories.com/f/security-cryptography/cryptographic-key-management/external-key-integration/hardware-key-importations/webauthn-hardware-key-authentications/hardware-security-key-authentications.md) — Provides hardware-backed SSH authentication using secure enclaves and biometric verification to isolate private keys. ([source](https://github.com/sekey/sekey#readme))
- [Biometric-Gated Signing](https://awesome-repositories.com/f/security-cryptography/biometric-authentication/biometric-gated-signing.md) — Implements biometric-gated request signing, requiring hardware verification before signing cryptographic challenges.
- [Hardware-Internal Key Generation](https://awesome-repositories.com/f/security-cryptography/cryptographic-key-management/cryptographic-key-generation/hardware-internal-key-generation.md) — Generates and stores cryptographic key pairs directly within a hardware enclave to prevent exposure.
- [Hardware Key Lifecycle Management](https://awesome-repositories.com/f/security-cryptography/cryptographic-key-management/external-key-integration/hardware-key-importations/webauthn-hardware-key-authentications/hardware-security-key-authentications/hardware-key-storage/hardware-key-lifecycle-management.md) — Allows the creation, listing, and deletion of cryptographic keys directly within secure hardware. ([source](https://github.com/sekey/sekey#readme))
- [Hardware-Backed Security](https://awesome-repositories.com/f/security-cryptography/hardware-backed-security.md) — Implements hardware-backed access control by requiring biometric or hardware verification for remote server sessions.
- [Hardware-Backed SSH Key Managers](https://awesome-repositories.com/f/security-cryptography/hardware-backed-ssh-key-managers.md) — Provides a manager for storing and managing SSH private keys within a hardware security module.
- [Secure Enclaves](https://awesome-repositories.com/f/security-cryptography/hardware-security-module-integrations/secure-enclaves.md) — Performs all signing and decryption operations inside a protected secure enclave to isolate sensitive material.
- [Hardware-Backed Key Storage](https://awesome-repositories.com/f/security-cryptography/key-management/hardware-backed-key-storage.md) — Stores private keys inside a secure enclave to ensure they cannot be extracted or accessed by system memory.
- [Hardware Key Isolation](https://awesome-repositories.com/f/security-cryptography/private-key-import-formats/ssh-private-key-authentications/hardware-key-isolation.md) — Isolates SSH private keys from system memory by performing signing operations inside a hardware module.
- [SSH Protocol Bridges](https://awesome-repositories.com/f/security-cryptography/ssh-protocol-bridges.md) — Acts as a middleware bridge connecting standard SSH protocols to hardware-based signing mechanisms.
- [Hardware Key Serialization](https://awesome-repositories.com/f/security-cryptography/cryptographic-key-management/key-encoding-standards/hardware-key-serialization.md) — Transforms internal hardware key formats into standard public key strings compatible with remote server authorization.
- [SSH Agent Integrations](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/machine-and-protocol-identity/specialized-authentication-protocols/agent-authentication-strategies/ssh-agent-integrations.md) — Functions as an SSH authentication agent that signs requests using hardware security and biometric verification.
- [Hardware Public Key Exporters](https://awesome-repositories.com/f/security-cryptography/public-key-authentication/public-key-retrieval/kms-public-key-exporters/hardware-public-key-exporters.md) — Converts hardware-resident keys into standard public key formats for remote server authorization.
- [Public Key Serializations](https://awesome-repositories.com/f/security-cryptography/public-key-authentication/public-key-retrieval/public-key-serializations.md) — Converts hardware keys into standard SSH public key serializations for distribution to authorized_keys files. ([source](https://github.com/sekey/sekey#readme))