JAuth: SSH Keys on Your Phone

Hass Consulting, LLC

About this app

Your SSH keys, on the phone you never leave home without.

JAuth turns your Android phone into a hardware-style SSH key. Your private keys stay on the phone. When you run ssh on your computer, the phone asks you to approve the login, you confirm with your fingerprint, face or PIN, and the phone signs it. The private key never leaves the phone.

WHY JAUTH
Security keys are great, until yours is sitting at home and you are miles down the road. You almost never forget your phone. JAuth gives you the "something you have" of a hardware key, using the device already in your pocket.

HOW IT WORKS
• Keys live on the phone in an encrypted vault protected by Android's hardware-backed Keystore.
• Your computer talks to the phone over an encrypted Bluetooth LE channel. Each computer is paired once by scanning a QR code and comparing codes on both screens.
• Every login shows an approval screen with the key and the server it is for. Nothing is signed until you approve with your device's fingerprint, face or PIN.
• Optional approval windows let you allow a server for a few minutes, and you can cancel them from the notification.
• Revoke a computer at any time. Its connection ends immediately and it cannot reconnect until paired again.

WORKS WITH STANDARD SSH
The free JAuth companion (jauthd) runs on your computer and serves your keys to ordinary SSH. No changes are needed on your servers; add the public key to authorized_keys as usual.
• Linux and macOS: OpenSSH, through SSH_AUTH_SOCK.
• Windows: the built-in OpenSSH, and PuTTY through a Pageant-compatible agent.
Several computers can be connected at once.

KEYS
• Generate Ed25519 or RSA-4096 keys on the phone, from the app or from your computer.
• Get a key's public half on the computer, ready to add to your servers.

BACKUP AND NEW PHONES
Export your keys to an encrypted backup file (Argon2id and ChaCha20-Poly1305), saved wherever you choose. Restore it on a new phone, or keep it offline.

PRIVACY
JAuth has no internet permission. There is no account, no cloud, no analytics and no ads. It talks only to the computers you pair, over Bluetooth.

PERMISSIONS
• Bluetooth: to talk to your paired computers.
• Camera: only to scan the pairing QR code.
• Notifications: to show approval requests and the running service.
• Run at startup: so your computers can reach the phone after a reboot.

GOOD TO KNOW
• You need the JAuth companion on each computer. Downloads and setup guides: https://johnhass.com
• If you decline a request, ssh may still try other keys stored on the computer. Remove those from your servers if the phone should be the only way in.
• If you need keys that can never be copied off the device, a dedicated hardware security key is still the stronger choice.

What’s new

Initial Release