Why SSH Keys are the Ghost Credentials of your Fleet.
Exploring the massive gap between probabilistic identity and deterministic hardware evidence.
Prmana replaces static SSH credentials with hardware-backed, ephemeral identity — covering the dev boxes, CI runners, edge nodes, and AI agents that your gateway doesn't reach.
SSH keys get copied, shared, and never rotated. That key from 2019 on a developer's laptop? Still works.
You need MFA for email but not for root access to production. Enterprise identity stops at the browser.
When someone leaves, finding all their access is archaeology. authorized_keys scattered across servers.
Prmana brings your existing IdP (Okta, Azure AD, Keycloak, Auth0) to Linux PAM. Users authenticate once through SSO, and every token is cryptographically bound to the client via DPoP (RFC 9449) — stolen tokens are useless without the private key.
✓ Direct-to-host — no proxy or gateway
✓ DPoP proof-of-possession, not bearer tokens
✓ Works with your existing IdP and SSSD
✓ Hardware key binding (YubiKey, TPM 2.0)
✓ Break-glass access built in
✓ Apache-2.0 — no vendor lock-in
Prmana generates the cryptographic evidence required for modern compliance frameworks. From SOC 2 to NIST 800-63B, we provide the tamper-evident audit trail your CISO demands.
Hardware-bound DPoP keys align with NIST SP 800-63B AAL3 when IdP enforces hardware-backed MFA.
Structured audit logs follow the Open Cybersecurity Schema Framework for portable security telemetry.
Built on aws-lc-rs cryptographic primitives with available FIPS 140-2 validated modules.
Full supply chain attestation for our build process, ensuring binary integrity.
Prmana doesn't trust bearer tokens. Every authentication token is cryptographically bound to the client's hardware via DPoP (RFC 9449) — with TPM 2.0 keys that are physically non-exportable.
Ephemeral P-256 keys are generated in heap space protected by mlock(2), ensuring private keys never touch the swap disk or core dumps.
Cryptographic proof of identity is bound to physical silicon via TPM 2.0, creating an immutable link between the user and their hardware.
Exploring the massive gap between probabilistic identity and deterministic hardware evidence.
A deep dive into RFC 9449 and the end of bearer token theft in the terminal.