Show HN: SeKey: An SSH Agent for OS X, Using Secure Enclave and TouchID, in Rust
I'm amazed there's a market for this kind of thing. Since the 1990s its been known how to implement an undetectable backdoor in hardware based crypto which leaks your keys to an attacker.<p>E.g. <a href="http://paper.ijcsns.org/07_book/201006/20100623.pdf" rel="nofollow">http://paper.ijcsns.org/07_book/201006/20100623.pdf</a> details how to do it for Elliptic Curves. But its been studied since <a href="https://link.springer.com/content/pdf/10.1007%2F3-540-69053-0_6.pdf" rel="nofollow">https://link.springer.com/content/pdf/10.1007%2F3-540-69053-...</a><p>The tl;dr is that any device in which you can't check the implementation or get the private key out (i.e. Secure Enclave, TPM etc), can leak your key to a passive attacker in a way that you <i>provably</i> can't detect.