cirven systems / modules / key

cirven key

Login needs three things at once: the key, the secret inside it, and your password. Sessions and vaults exist only while the key is plugged in. Pull it, and the screen locks, vaults close and key material is wiped from memory.

usage

$ cirven key enroll
touch your key... ok. password: ********
$ cirven key vault open work
~/vault/work mounted (bound to key 4a:1f:..)
-- key removed --
screen locked, 1 vault closed, keys wiped

how

• any FIDO2 key (YubiKey, Nitrokey, SoloKey): no custom hardware needed
• the secret never leaves the key: FIDO2 hmac-secret derives a per-vault value inside it
• vault key = HKDF(hmac-secret || Argon2id(password)); neither half alone opens anything
• PAM module for local login, sudo and screen lock
• udev removal event: lock, close vaults, zero key buffers (mlock'd, never swapped)
• no key files on flash storage: a plain USB stick can be copied in a second; a secure element cannot

threat model

Stops: stolen laptops, stolen passwords, copied disks, shoulder surfing, walk-away sessions. Does not stop: malware on a machine while the key is plugged in and a vault is open. Losing the key means losing access, so enroll a second key as backup.