Tessera

Keys

The keys page (sidebar) manages your SSH keys. Private key bytes live only in the iOS Keychain — Tessera stores just public metadata (names, fingerprints, usage) in its own database.

Generating a key

Tap + generate and pick an algorithm:

• Ed25519 — “fast, modern default”. A software key stored in the Keychain; it can be exported to a recovery file and moved between devices.
• P-256 Enclave — “device-bound”. Generated inside the Secure Enclave and never leaves it: the key cannot be exported or moved to another device. Lose the iPad and the key is gone — keep a second authorized key somewhere.

RSA generation is not supported; see troubleshooting.

Importing a key

Tap import and pick an OpenSSH private-key file (up to 1 MB). If the file is passphrase-protected, the passphrase is used once to decrypt it and is not retained.

• Only Ed25519 imports are accepted. RSA import is disabled because the current SSH stack can only offer the deprecated RSA/SHA-1 signature — use Ed25519 instead.
• The import sheet hides itself (“private-key import hidden”) whenever the screen is captured or the app is backgrounded.

Biometric protection

Each key has a require biometrics or passcode toggle: Face ID / Touch ID or the device passcode is then required whenever Tessera accesses that key, enforced by iOS at the Keychain/Secure Enclave boundary.

Authorization bursts

Under settings → security → authorize key connection bursts, a single biometric grant may cover repeated connections using the same key to the same endpoint for 30 seconds — so tmux tabs and file transfers don’t each prompt. Backgrounding the app always invalidates these grants, even when app lock is off.

P-256 Enclave keys have their protection fixed at creation; to change it, generate a new key and rotate.

The key detail panel

Tap a key to see its type, fingerprint (sha256) (OpenSSH-compatible), and public key. From here you can:

• copy public key — the authorized_keys line.
• copy to host… — install it on a server (below).
• export private key… — Ed25519 only; writes a passphrase-encrypted openssh-key-v1 recovery file.
• delete local private key… — see deletion.

A used by section lists the hosts that reference the key.

Installing a key on a host

copy to host… picks a host, shows the exact authorized_keys line, and appends it to ~/.ssh/authorized_keys over SSH, with verification markers.

• You must have trusted the host key first: connect once to review it, then retry.
• Tessera refuses to install a key onto a host that already uses that key for authentication.
• Completed installations are tracked, and the deletion flow reports them (“Known remote installations: N”).

Export and recovery

The recovery section of a key tracks its backup state — whether a verified recovery export exists (with date and fingerprint), and for Enclave keys a standing reminder that Secure Enclave private material cannot leave the device.

• protect recovery key… — export with a passphrase.
• verify recovery file… — check that a recovery file still matches the key.
• restore from recovery file… — fingerprint-verified repair of missing or mismatched Keychain material (e.g. after a restore from backup).

Back up software keys before installing them widely — an unrecoverable key means locking yourself out as passwords get disabled.

Deleting a key

delete local private key… removes the key from the Keychain after confirmation. Deleting locally does not revoke any authorized_keys entry on your servers — where a tracked host has an alternate credential available, the deletion flow offers “revoke on N tracked hosts & delete” to remove them for you; otherwise remove the corresponding lines on each server yourself if the key should stop working.

Legacy RSA keys left over from older versions are shown disabled.

Where the bytes are

• Software Ed25519 keys: iOS Keychain (non-synchronizing).
• P-256 keys: Secure Enclave, non-exportable by design.
• Tessera’s own database: public keys, fingerprints, labels, usage — never private material.

For the full hardening story, see the public private-key security audit.

This site is open source. Improve this page.