KeyTap
Free iPhone app
Approve a decryption with the YubiKey® in your pocket.
KeyTap turns your iPhone into a remote approver for age and sops. You decrypt on your computer as usual; the request appears on your phone; you enter the PIN and tap your YubiKey against it. No server, no account.
The gap it closes
Tools like age and sops can keep the decryption key on a YubiKey (age-plugin-yubikey): nothing on the computer can decrypt without the key, its PIN and a touch.
That breaks the moment the YubiKey and the computer are apart – you are travelling with your phone and the key, and work on the computer remotely. The usual workarounds all put a usable key back on a machine: a copied key file, a server that approves for you, a push button.
KeyTap turns the iPhone into a remote card reader for exactly one operation. The key agreement still happens on the YubiKey, which still asks for its PIN and a tap.
How it works
- Decrypt as usualRun
sops -dorage -d. The KeyTap bridge on your computer receives the encrypted file key. - See the requestYour phone shows the command, file, folder and computer in plain words, plus a short code the terminal shows too.
- PIN and tapEnter the YubiKey PIN on the phone and hold the key to the iPhone. The YubiKey does the key agreement.
- DoneThe phone sends back only the 16-byte file key. The computer finishes decrypting.
Security highlights
Key, PIN and presence
All three are still required. The private key never leaves the YubiKey; the PIN goes only to the YubiKey and is never stored.
No server, no account
The phone talks only to your own computer, over your network or your own VPN. There is no KeyTap service.
No push notifications
A push would travel through Apple’s servers and reveal when and where you decrypt. So the app must be open while you decrypt.
Pinned and paired
The phone trusts only the certificate it paired with. The computer trusts only your phone’s Secure Enclave key, which signs every answer for the exact request you saw.
The full security model → · Privacy: nothing is collected →
What you need
- A YubiKey 5 with NFC (the tested path) holding an age key made by
age-plugin-yubikey. - An iPhone with NFC.
- A computer running macOS, Linux or Windows with
ageorsopsand the KeyTap bridge. - Phone and computer on the same network, or the phone on a VPN into it.