keylessh

I work at a small security startup on a project im pretty passionate about. We are building open source tools to reduce how much sensitive stuff and power apps keep in one place. One project is TideCloak, a Keycloak fork that keeps the familiar dx but changes the security model underneath: https://tide.org/tidecloak Another is KeyleSSH, a keyless SSH/PAM prototype where there is no private key file sitting around as one thing to steal: https://github.com/sashyo/keylessh Most of what I'm thinking about now is dx. Security tools dont matter much if normal devs cant understand, debug, or actually want to use them.

Tide team here. Our dev Sasha built this PoC in a few weekends, using our SDK. Her core idea: Remove the risk of compromised keys, and the overhead of managing them at scale, by never having a key to steal. Instead the SSH signing operation is distributed across nodes using novel MPC-based threshold EdDSA – the key literally never exists in whole, not even momentarily in a TEE. KeyleSSH is: - Browser-based SSH console - Auth via OIDC, signing via distributed novel MPC-based threshold EdDSA - appx 30 lines of core signing logic (the SDK does the heavy lifting) It isn't (yet): - Production-ready. It's a PoC. - Fully decentralized. The nodes currently run on our testnet – we're working toward a proper decentralized mainnet. If you run infrastructure and are curious about operating nodes, happy to chat. - A silver bullet. Browser-based means