external
/
secretive
mirror of https://github.com/maxgoedjen/secretive.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Store SSH keys in the Secure Enclave
51 Commits 17 Branches 24 Tags 26 MiB
Swift 98.5%
Rich Text Format 1.2%
Objective-C 0.3%
Go to file
Max Goedjen 39e4059d51
Guard preview providers 		2020-03-11 23:07:22 -07:00
.github/readme Better readme (#33) 2020-03-11 22:47:50 -07:00
SecretAgent Restrict to EC only 2020-03-09 22:06:51 -07:00
SecretAgentKit Split out into separate files 2020-03-08 20:08:27 -07:00
SecretAgentKitTests Secure enclave implementation 2020-03-03 23:14:38 -08:00
SecretKit Remove return 2020-03-11 01:53:20 -07:00
SecretKitTests Setup 2020-02-18 19:36:41 -08:00
Secretive Guard preview providers 2020-03-11 23:07:22 -07:00
Secretive.xcodeproj Prompts for empty stores (#31) 2020-03-11 00:02:17 -07:00
SecretiveTests Setup 2020-02-18 19:36:41 -08:00
.gitignore Initial commit 2020-02-18 19:34:46 -08:00
LICENSE Initial commit 2020-02-18 19:34:46 -08:00
README.md Better readme (#33) 2020-03-11 22:47:50 -07:00

README.md

Secretive

Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the sekey project, but rewritten in Swift with no external dependencies and with a handy native management app.

Screenshot of Secretive

Why?

Safer Storage

The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you store your keys in the Secure Enclave, it's impossible to export them, by design.

Access Control

If your Mac has a Secure Enclave, it also has support for strong biometric access controls like Touch ID. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.

Screenshot of Secretive authenticating with Touch ID

Notifications

Secretive also notifies you whenever your keys are acceessed, so you're never caught off guard.

Screenshot of Secretive notifying the user

Support for Smart Cards Too!

For Macs without Secure Enclaves, you can configure a Smart Card (such as a YubiKey) and use it for signing as well.

Getting Started

Security Considerations

For the moment, you must build Secretive from source. For an app like this, it's critical that you trust that the app you're running is the app whose source you've checked out. To this end, Secretive has no third party dependecies, and is designed to be easy for you to audit for exploits.