AliceKeys is a mobile-first, hardware-backed SSH key system. It replaces traditional SSH keys with a secure key stored in your phone’s secure enclave, ensuring that the key never leaves your device and can’t be copied.
Kind of, but with a much better experience. A YubiKey is a physical hardware token—you have to carry it around and plug it in whenever you need to authenticate.
With AliceKeys, your phone is the key, so:
Example:
Instead of reaching for a YubiKey, plugging it in, and tapping it every time you SSH into a server, AliceKeys lets you authenticate instantly using just your phone.
It uses FIDO2/WebAuthn standards and short-lived SSH keys.
If you lose your phone, your key is still safe because:
Yes, AliceKeys has an offline mode, meaning you can authenticate without an internet connection. However, if needed for security audits, logs can sync later when back online.
Not yet, but we’re planning to open-source core components soon. Stay tuned!
Yes! We’re working on an enterprise version with:
AliceKeys ensures that all SSH keys are generated and stored in a secure enclave, backed by the mobile manufacturer’s attestation. This means:
Example:
Instead of manually tracking SSH key usage, you have guaranteed proof that only one key exists per device, reducing security risks.
For global teams, managing hardware security tokens (like YubiKeys) is a logistical nightmare. You need to physically ship them, track them, and replace lost ones.
With AliceKeys:
Example:
A remote contractor in another country needs SSH access. Instead of mailing them a YubiKey, you remotely enroll their phone, ensuring secure access without delays.
Yes! Since keys are bound to the user’s hardware, it eliminates common compliance headaches like:
Example:
During an audit, instead of searching through logs for old keys, you can simply prove that only verified devices hold valid keys—streamlining the compliance process.
Yes, we’re planning to introduce temporary access approvals for high-security environments.
How it would work:
Example:
A developer needs to fix a production issue. Instead of giving them permanent SSH access, an admin grants a one-time authentication session—keeping security tight.
Yes! We understand that some organizations need full control over their authentication systems, so we’re working on a self-hosted version that allows you to deploy AliceKeys on your own infrastructure.
Example:
If your company has strict data residency requirements, you can host AliceKeys internally and manage all SSH keys securely within your private network.
Yes! AliceKeys is designed to integrate seamlessly with enterprise identity providers like:
Example:
If your company already uses Azure AD for authentication, AliceKeys can extend it to SSH, VPN, and Git signing, ensuring consistent security policies across all systems.
Yes! AliceKeys is built with OAuth2 and SAML compatibility in mind, meaning it can:
Example:
A new employee joins your company, and instead of manually managing SSH keys, AliceKeys can automatically enroll them based on their SSO credentials (via Keycloak, Azure AD, or Okta).
Absolutely. AliceKeys fits perfectly into Zero Trust frameworks by ensuring:
Example:
Instead of trusting that a device is secure just because it’s inside a corporate network, AliceKeys enforces device-bound authentication, preventing lateral movement in case of a breach.
Yes! AliceKeys can be used to secure CI/CD pipelines by enforcing cryptographic signing of:
Example:
If you want to guarantee that every Git commit in your repository is signed by an authorized developer using AliceKeys, you can enforce mandatory Git signing with SSH authentication.
Yes! The system is modular and extensible, meaning we can add more authentication use cases based on demand, such as:
We’re exploring: