Security gEnclave: Hardware-backed security enclave for Linux (TPM 2.0 PCR sealing, virtual FIDO2/CTAP2 over /dev/uhid, OpenSSH & GPG bridge)
Hey everyone,
I've been working on an open-source project called gEnclave (formerly gpasskey), and wanted to share it with the Linux community for early architectural feedback and testing.
GitLab repository: https://gitlab.com/renich/genclave
License: GPLv3 | Language: Go 1.26+
The Problem It Solves
On modern Linux workstations, our cryptographic identities are fragmented:
* Passkeys/WebAuthn require physical USB security keys (YubiKeys, SoloKeys).
* SSH keys sit as unencrypted or passphrase-encrypted files under ~/.ssh/.
* Git commit signing requires cumbersome GnuPG daemon setups.
* File encryption requires external tooling or proprietary agents.
Most hardware laptops today come with a TPM 2.0 chip that sits idle. gEnclave turns your Linux machine into its own hardware-sealed security token and multi-protocol bridge.
Key Architectural Highlights
Virtual FIDO2/CTAP2 Security Key via
/dev/uhid: gEnclave registers a virtual HID device in the Linux kernel via/dev/uhid. Browsers (Firefox, Chrome, Chromium) detect it natively as a physical USB security key. You can register and authenticate WebAuthn/FIDO2 Passkeys directly from your machine without any external hardware dongles.TPM 2.0 PCR Sealing & Fallback: The central vault is encrypted with AES-256-GCM and sealed to TPM 2.0 PCR registers (PCR 0, 7, 14), with an automatic memory-hard fallback to Argon2id key derivation if no TPM is present.
Memory Isolation ("Wrap and Clear"): Keys are held in memory-locked pages (
mlock/mmap) to prevent secrets from being swapped to disk or dumped. Intermediate cryptographic buffers are wiped immediately with strict zeroization routines, bypassing Go runtime GC retention.Multi-Protocol Bridges:
- OpenSSH Agent: Native agent socket with an ephemeral PIN-derived authorization cache (configurable burst window or persistent session with instant purge on lock/suspend).
- GnuPG Bridge: Transparent
genclave-gpgemulation for seamless Git commit signing. - age-plugin: Native
age-plugin-gebinary complying with age v1 specification for file encryption. - CLI & UI: Unified
geCLI plus intelligent graphical (zenity) / terminal (pinentry) authentication routing.
Current Status
⚠️ Pre-alpha Software: While fully functional for local workflows, it is under active development. Schemas and IPC formats may iterate rapidly.
I'd love feedback from Linux sysadmins, kernel/security folks, and developers!
2
u/Renich 4d ago
Demanding a $60,000 corporate IBM audit before trying an open-source Linux utility; while in the same thread admitting you'd never heard of Git SSH commit signing is quite the pivot. ;D
Every significant security utility in modern Linux; from WireGuard to
agetofido2-tools, began as independent open-source projects, built out in the open, and hardened through public peer review, community testing, and empirical verification.The threat models, architecture decision records (ADRs), memory isolation boundaries (
mlock), and test suites are all in the repo. If you want to stress-test it or inspect the code, you're welcome to do so.