RobOS Hardware Keys

RobOS Hardware Keys (packages/hardware-keys) is the physical security key studio for YubiKey, Security Key C NFC, SoloKey, Nitrokey, and FIDO2/U2F hardware authenticators.

Key Capabilities

Live Hardware Inspector: Automatically detects connected USB & NFC security keys via /sys/class/hidraw, ykman, and python3-fido2 CTAP2 (Ctap2.get_info()). Displays firmware version, form factor, FIDO2 AAGUID, COSE cryptographic algorithms (EdDSA / Ed25519, ES256 / P-256, ES384), CTAP2 extensions (credProtect, hmac-secret, largeBlobKey), remaining Resident Key slots, and Linux /dev/hidraw udev ACL status.
Physical Touch / Push-to-Approve Tester: Trigger a live cryptographic FIDO2/U2F challenge-response that blinks the LED on your YubiKey and measures touch latency, authenticator flags (UP=1, UV), credential handle, and hardware signature proof.
Hardware-Backed OpenSSH Keys (ed25519-sk & ecdsa-sk): Generate non-exportable FIDO2 SSH keys where the private key never leaves the YubiKey, test hardware SSH signing (ssh-keygen -Y sign), and upload public keys directly to GitHub.
FIDO2 PIN & Resident Passkeys: Set or change your FIDO2 PIN (ykman fido access change-pin) and inspect or delete discoverable resident credentials (ykman fido credentials list).
Linux PAM U2F & RobOS Push Guards: Enroll your YubiKey into ~/.config/Yubico/u2f_keys via pamu2fcfg for touch-to-approve sudo and desktop login, configure Git global SSH commit signing (gpg.format=ssh), and enforce hardware touch gates for RobOS Pass Store unlock and high-risk agent actions.

More in Security & Credentials

DocuVault Desktop Offline-first secure markdown notes, personal snippet vault, and local workstation storage starter app. Git Login Manager Checks that GitHub access works (gh login, SSH key, SSH connection, git identity) and walks you through fixing what fails. Pass Manager Vault Desktop front end for the standard Unix password store (pass), with entries encrypted by GPG. Pass Unlock Daemon Small dialog that asks for your GPG passphrase once a day and caches it in gpg-agent. RobOS App Mesh Zero-Trust App & IPC Port Mesh for connecting RobOS applications across machines (mTLS 1.3, OpenZiti, Tailscale, NetBird, WireGuard) RobOS Cloud Accounts One list of your cloud accounts, shared with Data Sources and Google Calendar; Google accounts can sign in through the browser and be written into Thunderbird. RobOS Private Networks Cross-Network Zero-Trust P2P & Relay Mesh for linking RobOS machines across separate networks/NAT/CGNAT via Mutual TLS 1.3 (robos-net://), AES-256-GCM encrypted rendezvous, bidirectional Reverse-Mux tunneling, and cross-machine RobOS Movie Player (:19215) streaming RobOS Setup Wizard Eleven-step first-run wizard for GPG, pass, pinentry, git identity, SSH, Chrome, GitHub login, AI agent keys and optional tools. RobOS VPN Sandbox Launch any desktop or CLI app inside an isolated Linux network namespace (ip netns) routed exclusively through OpenVPN with a 3-barrier kernel kill-switch. RobOS VPN Servers Manage OpenVPN providers (IPVanish built-in with 3,598 server profiles), encrypted VPN accounts, live TLS 1.3 credential tests, and server locations. Security Setup Wizard Five-step wizard that configures GPG pinentry, a GPG key, the pass store and an SSH key.