corekeys-daemon

The desktop half of core-keys, a split-key hardware authenticator for SSH and FIDO2: the desktop daemon and a dedicated hardware device must both participate in every authentication, and the device explicitly approves each use on its own button and display.

This daemon is the ssh-agent front end, the Noise session owner, the FIDO2 co-authorization policy engine, and the pairing ceremony's host side.

Run

cargo run -p corekeys-daemon          # run the agent (needs the board)
cargo run -p corekeys-daemon pair     # pairing ceremony (needs the board)

Environment: CK_AGENT_SOCK (default /tmp/corekeys-agent.sock), COREKEYS_NO_ICONS (disables favicon fetch/push). Pairing state lands in $XDG_CONFIG_HOME/core-keys/pairing.conf, else ~/.config/core-keys/pairing.conf.

Test

cargo test                                  # all tests, no hardware needed
cargo test --test ssh_agent_e2e             # one integration test file

Everything under tests/ runs against MemLink plus an in-process fake device, so tests never need hardware. The binaries in examples/ are the hardware harness: hw_handshake, hw_sign, status and reboot_download need a flashed board; gen_keys and noise_kk_interop do not.

Developing against a local protocol checkout

The shared wire crate is consumed as a git dependency on core-keys/protocol. To build against a side-by-side checkout instead:

git clone https://github.com/core-keys/protocol ../protocol
cp .cargo/config.toml.example .cargo/config.toml

.cargo/config.toml is gitignored, so only your working copy is affected.

The core-keys repositories

repo	what
spec	frozen design decisions and the section-numbered co-authorization wire protocol
protocol	corekeys-protocol, the shared no_std wire crate
daemon	corekeys-daemon, the desktop ssh-agent front end and Noise session owner
mule-esp32s3	ESP-IDF firmware for the protocol mule (LilyGO T-Display-S3)
mechanical	3D-printed enclosures for the boards

License

Dual-licensed under either the Apache License, Version 2.0 or the MIT license, at your option. Unless you state otherwise, any contribution you intentionally submit for inclusion in this work shall be dual-licensed as above, without additional terms or conditions.

Status

Design frozen; M1 (mule bring-up) in progress. Nothing here is fit for real credentials yet.