Keys

Your Device Key

On first launch, pocketty makes a P-256 key in the Secure Enclave. The private half never leaves the chip: it is not in backups, and pocketty cannot export it. The public half is an OpenSSH line that ends with pocketty:

ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBB… pocketty

Settings → Device Key shows it, with Copy Key and Copy Setup Command. Where no Secure Enclave is available, such as in the iOS simulator, the key is kept in the Keychain, and Settings says so.

Imported Keys

You can paste an OpenSSH private key, with its passphrase, for a host that needs a key you already have. pocketty checks it, then keeps it in the Keychain. Prefer the device key where you can.

Tailscale SSH

With Tailscale SSH, pocketty uses no key at all. Tailscale checks your tailnet identity, and may ask you to approve the login in a browser.

Host Keys

• On the first connection, pocketty saves the host’s key.
• With code setup, the daemon sends the host’s keys over Tailscale, so pocketty pins them before the first connection.
• After that, a different key stops the connection, with no retry, until you choose Trust new key.

Code Setup

The daemon adds a phone’s key to ~/.ssh/authorized_keys only when all of these hold:

1. The request reaches the daemon’s port, 7450, on one of the host’s Tailscale addresses. The daemon listens nowhere else.
2. tailscale whois says the caller is a device of the same Tailscale user as the host.
3. The phone has no other request open.
4. Someone at the host types the six-digit code that the phone shows, in the Mac alert or in pocketty approve. This proves they can see the phone.
5. The request is less than 2 minutes old. At most four requests wait at once, and five wrong codes deny it, in the Mac alert or in pocketty approve.

The daemon adds the key only if it is not there already. It writes through symlinks, so a dotfiles setup keeps working.