krypton-ios

Trusting your HSM vendor is a requirement if you don't want your keys to be exportable, and there's much less risk in doing so compared to trusting Apple for other things like secure communications (iMessage is e2ee but doesn't tell you when your peer changes/adds keys, plus unencrypted backups are on by default). Also, a lot of people who use Krypton don't know that SSH keys actually don't use the secure enclave because it doesn't support rsa or ed25519: https://github.com/kryptco/krypton-ios/issues/73#issuecommen...

iPhone 5Ss are great to keep around, you can generate an ECC private key inside the secure enclave (albeit only using the NIST P256 curve). Using Krypton[0] or your own software you can use the phone as a hardware private key. Krypton includes support for SSH, gpg signed git commits, and soon generic gpg signing[1], all backed by TouchID or your passphrase[2]. Make sure to setup Krypton with the "Nist P256 (Secure Enclave)" curve. Private keys generated in the Secure Enclave are only possible to extract using a zero-day in the Secure Enclave coprocessor. [0] https://krypt.co [1] https://github.com/kryptco/krypton-ios/pull/95 [2] Protip: iOS passphrases consisting of only digits will use a keypad on the unlock screen.

I really liked this but the notification requirement on iOS killed it for me. I can’t remember the exact details but it is (roughly) not possible to suppress authorization request notifications because on iOS notifications are the only way to wake-up a backgrounded application. Net result is a notifications every single time krypt authorizes via your phone. This may not be a problem for many people but it drove me nuts. It is unbearable if you use auto-complete on the command line in eg SCP. Edit: typos Edit 2: related issue https://github.com/kryptco/krypton-ios/issues/75

>Not everyone likes to have their (door) keys hanging off their notebooks all day. As if a whole phone is better... That's not a requirement with a yubikey anyway. Mine hangs on a lanyard on a dust plug. Many people have yubikey nanos and basically leave them plugged in their laptop all the time. >I was talking about the free beer kind of free, but it's not accurate to say YubiKey is all free (libre) Kryptonite is not libre. It's not even free. It's all rights reserved. https://github.com/kryptco/kryptonite-ios/blob/master/LICENS... Yubico piv tool is 2 clause BSD, which is GPL compatible. >Personally, I'm fine with closed-source security products. So is RMS, assuming device software is fixed. See his comments on microwave ovens. Yubikey fits this description. Firmware is not updatable, for better security. Anyone who is trying to make a

The app uses kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly[1]. Quoting the relevant iOS documentation[2]: > After the first unlock, the data remains accessible until the next restart. This is recommended for items that need to be accessed by background applications. Items with this attribute do not migrate to a new device. Thus, after restoring from a backup of a different device, these items will not be present. [1]: https://github.com/kryptco/kryptonite-ios/blob/42c71d6381def... [2]: https://developer.apple.com/reference/security/ksecattracces...