kryptco / krypton-ios

DEPRECATED Krypton turns your iOS device into a WebAuthn/U2F Authenticator: strong, unphishable 2FA.

DEPRECATED

This project is not maintained. Please migrate to Akamai MFA.

Krypton turns your iOS device into a WebAuthn/U2F Authenticator: strong, unphishable 2FA.

Krypton implements the standardized FIDO Universal 2nd Factor (U2F) protocol to provide secure, unphishable two-factor authentication on the web, now in the convenient form factor that is your phone.

• No more mistyping, missing 30 second windows, or waiting endlessly for that SMS.
• Instant Sign-in: Krypton securely pairs with your computer so that you don't have to touch your phone for each sign-in. Optionally, enable One tap sign-ins for enhanced security.
• Stops Phishing: SMS and authenticator app codes can easily be phished. Don't let that happen to you. Krypton protects you from phishing.
• Works with the sites you love: Google, Facebook, Twitter, Dropbox, GitHub and many more.
• Quickly protect your accounts: Setting up two-factor can be time consuming and repetitive. Just scan once with Krypton.

Install our companion browser extension at: https://krypt.co/start.

Krypton for Developers

Krypton supports developer mode so you can use Krypton as a security key for SSH and PGP private keys in addition to U2F.

Download our command line utility curl https://krypt.co/kr | sh and type kr pair to securely pair Krypton with your computer. Krypton integrates with the ssh command to send signature requests right to your phone. Krypton also makes signing Git commits and tags with PGP easy: run kr codesign to get started.

Zero trust infrastructure

Krypton is built on top of an end-to-end verified and encrypted architecture. This means zero trust. We, Krypt.co, have zero information about keys or where you're authenticating. The keys only live in the Krypton app on your phone.

Learn more about Krypton's security architecture. For more information, check out krypt.co.

Build Krypton

Instructions below only work for macOS

1. rust

curl https://sh.rustup.rs -sSf | sh
rustup target add aarch64-apple-ios
rustup target add armv7-apple-ios
rustup target add armv7s-apple-ios
rustup target add x86_64-apple-ios
rustup target add i386-apple-ios
rustup update
cargo install cargo-lipo

2. libtool, autoconf, automake:

brew install libtool
brew install autoconf
brew install automake

Have an Android phone?

The Android implementation is located here.

Security Disclosure Policy

krypt.co follows a 7-day disclosure policy. If you find a security flaw, please send it to [email protected] encrypted to the PGP key with fingerprint B873685251A928262210E094A70D71BE0646732C (grab the full key here). We ask that you delay publication of the flaw until we have published a fix, or seven days have passed.

LICENSE

We are currently working on a new license for Krypton. For now, the code is released under All Rights Reserved.

krypton-ios's Issues

Push notification disappears sometimes

Notification replaced then disappears

• Probably due to remote notifications arriving at the same time as silent notifications/bluetooth messages

Show warning if push notifications disabled

• with link to notification settings

Update privacy policy

Device Policies

Policies for Paired Devices

Limit the circumstances under which a paired device can request signatures from Kryptonite and under which circumstances Kryptonite will auto-approve.

Policy Options

1. Time based auto-approvals

• Custom time intervals (i.e. "don't ask for x hours" )
• Custom approval windows (i.e. "don't ask Mon-Fri 9am-5pm)

2. Bluetooth based approvals

• Auto-approve if sent over bluetooth
• Signature requests over bluetooth only

3. Geolocation

• Auto-approve if in custom-defined geofences
• Signature requests only in custom-defined regions (i.e. "ignore signature requests if Kryptonite phone is outside of work or home offices.")

4. Hosts

• Auto-approve for custom-defined hosts
• Policies 1-3 based for specified hosts

navigate to known hosts edit page on host public key mismatch notification

LogManager, save host_auth in specific fields

Known-host Check Exemption for localhost

In my setup, I use a "bastion" (aka SSH jumpbox or proxy) which randomly assigns localhost TCP ports whenever I create a new SSH connection tunneled via an HTTPS WebSocket. For instance, it allows me to connect to a server in a private network when I connect to localhost:12345 where 12345 is a randomly assigned port number.

For the local SSH agent, I can add StrictHostKeyChecking=no and UserKnownHostsFiles=/dev/null to .ssh/config's Host localhost section, to prevent clutters caused by randomized host:port pairs (even when connecting to the same destination server).

I'd like to have a simple option to achieve the same effect for localhost in Kryptonite. Also, if this is enabled, all pairs of localhost and random port numbers should be treated as the same target host so that "allow for 3 hours" work with all localhost connections (maybe releated to #63).

expire pending authorizations if they wont work anymore

if app opened with pending auths user will be asked all of them, even if expired.

save hostauth in signature log

Set custom "allow for" time

Require explicit permission for requests with "Unknown Host"

Create shared lock for Silo.handle between main app and notification service extension

dont delete unpaired device audit logs

Minor: typo in Push notification pre-prompt

The pre-Push notification request prompt mis-spells significantly as signficiantly

Loving the app btw - so seamless!

investigate ssh-wire rust bitcode support

related links:
https://github.com/Geal/rust_on_mobile#how-can-we-generate-a-static-library-with-apples-bitcode-format

Don't delete pending notifications in main app

investigate blank SNS ARN

cause of kryptco/kr#126

Add setting to reauthenticate user for every login request that requires approval

This prevents a physical adversary from accepting login requests on an unlocked phone.

export logs as db file

bluetooth only setting

Unknown host does not parse?

export logs method doesn't have most recent log statements

exporting core data .sqlite file doesn't seem to be grabbing very recent log statements

More frequencies

Would be cool to have allow access for a custom timeframe, specifically day and week :)

Pause SQS on app background

cache responses by sessionid|requestid

Unlock LogManager mutex before posting NotificationCenter notification

removes possible deadlock on UI thread

3D-touch App Icon Menu

The current release shows the widget preview and the default "Share Kryptonite..." menu only.
It would be nice to have a 3D-touch app icon menu that includes quick access to:

• Allow for X-hours
• Ask Always
• Show History

Maybe the widget should have those actions as well.

Pairing is slow when there are many paired devices

show timeout progress on foreground approval dialog

Rename a paired device

Option to disable notifications for approved requests

or optionally change frequency with which they appear

Bump iOS v to 2.0.x

ssh-wire tests

When using OpenSSH ProxyJump, "Allow for 3 hours" only working for jump host

I'm using the iOS app version 2.1.1, and these for the other apps:

$ kr --version
kr version 2.1.2

$ ssh -V
OpenSSH_7.3p1, LibreSSL 2.4.1

The issue I'm seeing is when I try to connect to an SSH destination through an intermediate "jump host," using a configuration similar to this (edited for confidentiality and to remove (hopefully) irrelevant details):

Host jump-host
    HostName jumphost.companyname.local

Host destination-host
    Hostname 10.42.0.30
    ProxyJump jump-host

Host *
    PKCS11Provider /usr/local/lib/kr-pkcs11.so
    ProxyCommand /usr/local/bin/krssh %h %p
    IdentityFile ~/.ssh/id_kryptonite

My Kryptonite public key is installed in the authorized_hosts file of both the jump host and the destination host, and I can successfully connect to destination-host with the command ssh destination-host. The problem is that after a recent version upgrade, the "Allow for 3 hours" option in the iOS app only works for the jump host. Here's the sequence of events for a "cold" connection:

1. I use the command ssh destination-host from a computer paired with the Kryptonite iOS app
2. The connection to jump-host is initiated, and I'm alerted on my phone to approve of an authentication request from jump-host.companyname.local.
3. I choose "Allow for 3 hours."
4. The connection to the jump host is established.
5. A connection to the destination host is initiated through a jump host tunnel, and and I'm alerted on my phone to approve of an authentication request from unknown host.
6. I choose "Allow for 3 hours."
7. The connection to the destination host is established.

But when I reattempt the connection immediately thereafter:

1. ssh destination-host
2. The connection to jump-host is initiated, I'm alerted on my phone that an authentication request from jump-host.companyname.local was automatically approved, and the connection to the jump host is established.
3. A connection to the destination host is initiated through a jump host tunnel, and and I'm alerted on my phone to approve of an authentication request from unknown host.
4. I'm once more presented with the phone prompt to allow or reject the authentication request.

Additional observations:

• My iOS app's known hosts shows the jump host (jump-host.companyname.local), but not the destination host.
• When I run a verbose SSH command, I can see the jump host identifying itself by FQDN (jump-host.companyname.local), but the destination host by IP address.
• The destination host's IP address is in an IPv4 private address range.

Some possibly relevant debug messages from the ssh client (from a "warm" connection attempt, and edited for confidentiality):

debug1: Executing proxy command: exec /usr/local/bin/krssh jump-host.companyname.local 22

debug1: Authenticating to jump-host.companyname.local:22 as 'username'

debug1: Host 'jump-host.companyname.local' is known and matches the RSA host key.
debug1: Found key in /Users/username/.ssh/known_hosts:236

debug1: Offering RSA public key: /Users/username/.ssh/id_kryptonite
debug1: Server accepts key: pkalg ssh-rsa blen 535
Kryptonite ▶ Requesting SSH authentication from phone
Kryptonite ▶ Success. Request Allowed ✔
debug1: Authentication succeeded (publickey).
Authenticated to jump-host.companyname.local (via proxy).
debug1: channel_connect_stdio_fwd 10.20.0.75:22
debug1: channel 0: new [stdio-forward]

debug1: Authenticating to 10.42.0.30:22 as 'username'

debug1: Offering RSA public key: /Users/username/.ssh/id_kryptonite
debug1: Server accepts key: pkalg ssh-rsa blen 535
Kryptonite ▶ Requesting SSH authentication from phone
Kryptonite ▶ Phone approval required. Respond using the Kryptonite app
Kryptonite ▶ Success. Request Allowed ✔
debug1: Authentication succeeded (publickey).
Authenticated to 10.42.0.30 (via proxy).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.

perform date sorting of signature logs in database query

switch order: curl, npm, brew

verify that disable analytics setting carries over from previous versions and into Notify extension

create SNS endpoint per session so it can be deleted on unpair

otherwise remote notifications can still be sent by unpaired computers

change when ed25519 option appears?

Allow for one hour for specific by session and by hosts

Leave for post 2.0 release

Multiple key pairs

check that incorrect host sig does not cause fatal error

Remove iOS 9.x support?

deal with unknown hosts

"Allow for 3 hours" no longer working after update

I updated to 2.1.0 on my macbook last week, and now the Allow for 3 hours option is no longer working, and I'm being asked for every request. I was not notified of any update to the app.

LogManager dont load all into memory

Device unpairs strangely

Integration API for phone-based SSH Clients

reject all button

fix in-app approved dialog style

remove "$"