Open source · WireGuard® compatible
Make your VPN key impossible to copy.
Latchwire keeps your WireGuard private key inside a YubiKey. The key is generated on the card and never leaves it. The protocol and your server stay the same. No card, no tunnel.
Pre-release: command line for macOS and Linux
How it works
Generate the key on your YubiKey
Run keygen with a YubiKey on firmware 5.7 or later. The key is created on the card, in a retired PIV slot (82–95), and other slots stay as they are. A card with factory settings gets a new PIN and PUK first.
Add the public key to your server
Your server sees an ordinary WireGuard peer, so it needs no plugin or update. Latchwire is built for standard servers such as OPNsense, pfSense, Linux and MikroTik. So far it has been tested end to end only against a test server in a Linux container.
Enter your PIN and connect
The PIN goes to the card and is not stored. You normally enter it once; it is asked again after sleep or when another program resets the card. Remove the card and the tunnel comes down. The target is two seconds; a test with a simulated card took about one.
Classic WireGuard vs Latchwire
| Question | Classic WireGuard | Latchwire |
|---|---|---|
| Where is the private key? | In a file on your computer | Inside the YubiKey |
| Can it be copied? | Yes, without leaving a trace | No. The key cannot be taken off the card |
| Laptop stolen without the card? | Replace the key on every server | Nothing on the disk can complete a handshake |
| Malware on your computer? | It can steal the key and use it later | It can use the tunnel while the card is plugged in, but it cannot take the key away |
| Backup | A copy of the file | A second YubiKey, added to the server as a second peer |
| Server side | Standard WireGuard | The same: standard WireGuard |
| Maturity | Established, with official clients | Pre-release |
Hardware
Only the first card below exists in code today. The labels say what each one is.
YubiKey 5
v1PIV with X25519, firmware 5.7 or later. The key is generated on the card and never leaves it. Tests so far use simulated cards; checks on real cards are still open.
OpenPGP cards
SoonPlanned right after v1. Not implemented.
PKCS#11 and HSMs
SoonPlanned right after v1, for devices with X25519. Not implemented.
TPM, Secure Enclave, FIDO2
RoadmapWeaker class, not in v1. The key would be encrypted by hardware but exposed in memory while in use, so these will never carry the claim that the key cannot be copied.
Security
The claim is about taking the key, not about using it. Here is what that covers and what it does not.
Protects against
- Copying the key from your disk or backups: no private key is ever written there
- A stolen or imaged laptop without the card
- Configuration files that carry a private key: Latchwire rejects them
- Keys that were not generated on the card: Latchwire refuses them
- Traffic leaving outside the tunnel while the kill switch is on, within the limits in the threat model
Does not protect against
- Malware running as you while the card is plugged in and the PIN is entered: it can use the card and the tunnel. No touch is required
- Other programs that can reach the card after the PIN is entered; on some systems this includes other local users
- A compromised root account or kernel
- A stolen laptop together with the card and the PIN
- Reading process memory: session keys and a cached secret live there and can reach swap. They are not the private key, and they cannot complete a handshake without the card
- Counterfeit tokens: Latchwire trusts what the card reports and does not check attestation yet
Good to know
- The PIN is never stored, but it passes through memory while you type it.
- The default PIN is never tried.
- A preshared key, if you use one, is stored on disk and is not protected by hardware.
- The threat model names the code behind each protection. If the two disagree, the code is right and the document has a bug.
Project status
Latchwire is pre-release software. This is what exists today and what has been checked.
- Tested
Linux command line and networking
Tested end to end in a privileged container, with a software key and a test server.
- Unverified
macOS command line and networking
Implemented. The manual checks are still open.
- Unverified
Real YubiKey behaviour
Automated tests use simulated cards. The checks on real cards are still open.
- Not ready
Windows
Not implemented. The Windows build does not compile yet.
- Not ready
Desktop app
In development. Today there is only the command line.
- None yet
Signed releases and packages
There are no releases. You build from source.
- None yet
Independent security review
There has been no independent review.
Install
Build from source. There are no packages or signed binaries yet, and this setup is for testing.
You need Go 1.25 or later and a YubiKey 5 with firmware 5.7 or later. On Linux you also need a C compiler and libpcsclite-dev to build, and a running pcscd.
Build
git clone https://github.com/Kodviva/latchwire
cd latchwire
go build -o latchwire ./cmd/latchwire
sudo install -o root -m 0755 latchwire /usr/local/bin/latchwireStart the daemon and the agent, each in its own terminal
sudo latchwire daemon
latchwire agentCreate a key and connect
latchwire devices
latchwire keygen --serial <serial> --address <tunnel-ip>
sudo latchwire add office office.conf
latchwire up officekeygen prints a [Peer] block for your server. Your tunnel file is a normal WireGuard file with KeyRef and PublicKey in place of PrivateKey.
Homebrew, .deb, .rpm and Microsoft Store packages are planned. None of them exists yet.
Roadmap
CoreImplemented
Command-line client for macOS and Linux
Full network featuresImplemented
Full tunnel, DNS, kill switch, on-demand and allowed users. Tested on Linux; macOS still to be checked
Checks on real hardwareOpen
Real YubiKeys and macOS networking, using the public checklist
WindowsIn progress
Service, network layer and kill switch
Desktop app and translationsIn progress
Desktop app for macOS, Windows and Linux
Signed releasesPlanned
Homebrew, direct download, .deb, .rpm, Microsoft Store