Open Arsenal

See the stars

Keyra Specification

Home / Keyra / Keyra Specification

Keyra

Secure by Key, Secure by Design.

Keyra is an open-source, quantum-safe authentication platform that replaces passwords with cryptographic identity, post-quantum security, and privacy-preserving authentication. Designed as a modular platform, Keyra allows organizations to deploy only the functionality they need while extending the platform through optional plugins.

Overview

Keyra provides a modern authentication framework that combines post-quantum cryptography, passwordless authentication, hardware-backed security, and decentralized identity into a single extensible platform. Every major capability is implemented as a self-contained module, making Keyra suitable for lightweight applications, enterprise deployments, cloud-native environments, and distributed systems.

The platform is designed around long-term security, developer flexibility, and future cryptographic standards while remaining fully open source.

Core Modules

Authentication Core

The foundation of the platform responsible for identity verification and secure authentication.

Features

  • Passwordless authentication
  • Device-bound cryptographic identities
  • Authentication session management
  • Login policy enforcement
  • Multi-factor authentication framework
  • Session lifecycle management
  • Session revocation
  • Secure logout
  • Account enrollment
  • Device registration

Post-Quantum Cryptography

Implements quantum-resistant cryptographic operations.

Features

  • CRYSTALS-Kyber key exchange
  • CRYSTALS-Dilithium digital signatures
  • SPHINCS+ signature support
  • Hybrid classical + post-quantum encryption
  • Cryptographic key management
  • Cryptographic policy enforcement
  • Future algorithm upgrades
  • Cryptographic agility

Zero-Knowledge Authentication

Provides authentication without exposing secrets.

Features

  • Zero-knowledge authentication
  • Secret-free identity verification
  • Challenge-response authentication
  • Cryptographic proof validation
  • Privacy-preserving authentication
  • Replay attack prevention

Identity Management

Manages users, identities, devices, and credentials.

Features

  • Identity lifecycle management
  • Device management
  • Identity registration
  • Credential management
  • Multiple identities per user
  • Identity verification workflows
  • Identity metadata management

Session Security

Protects authenticated sessions.

Features

  • Forward secrecy
  • Ephemeral session keys
  • Automatic key rotation
  • Secure session renewal
  • Session expiration
  • Session revocation
  • Replay protection
  • Secure token management

Hardware Security

Integrates secure hardware for key protection.

Features

  • TPM support
  • Secure Enclave integration
  • Hardware security key support
  • Device attestation
  • Secure key storage
  • Hardware-backed authentication

Secure Recovery

Provides passwordless account recovery without weakening security.

Features

  • Multi-device recovery
  • Trusted guardian recovery
  • Threshold approval workflows
  • Encrypted recovery shards
  • Time-locked recovery
  • Hardware-assisted recovery
  • Recovery auditing
  • Automatic key revocation
  • Recovery policy engine

Authorization Engine

Controls access after authentication.

Features

  • Role-based access control (RBAC)
  • Attribute-based access control (ABAC)
  • Fine-grained permissions
  • Policy evaluation
  • Authorization rules
  • Dynamic authorization
  • Permission inheritance

API Gateway

Provides authentication services to applications.

Features

  • REST API
  • Authentication middleware
  • Token validation
  • Session validation
  • Service authentication
  • API key management
  • Rate limiting
  • Secure API endpoints

Audit & Logging

Records authentication activity.

Features

  • Authentication logs
  • Security events
  • Tamper-resistant audit trails
  • Login history
  • Recovery history
  • Administrative audit logs
  • Exportable logs

Administration

Administrative platform management.

Features

  • User administration
  • Device administration
  • Identity administration
  • Policy management
  • System configuration
  • Security settings
  • Administrative reporting

Optional Plugin Modules

Decentralized Identity Plugin

Optional support for decentralized identity ecosystems.

Features

  • DID support
  • Verifiable credentials
  • Distributed identity verification
  • Cross-platform identity
  • Identity federation

Distributed Authentication Plugin

Provides highly available authentication using distributed verification nodes.

Features

  • Distributed authentication
  • Verification nodes
  • Consensus verification
  • High availability
  • Geographic redundancy

Risk Intelligence Plugin

Adaptive authentication based on user behavior.

Features

  • Behavioral analysis
  • Device fingerprinting
  • Login anomaly detection
  • Risk scoring
  • Adaptive authentication
  • Threat detection

Enterprise SSO Plugin

Enterprise authentication integration.

Features

  • Single Sign-On
  • Enterprise identity providers
  • Organization policies
  • Enterprise provisioning
  • Directory synchronization

Hardware Wallet Plugin

Authentication using external hardware wallets.

Features

  • Hardware wallet authentication
  • External signing
  • Secure transaction approval
  • Multi-device authorization

Offline Authentication Plugin

Authentication without continuous network connectivity.

Features

  • Offline login
  • Cached credentials
  • Local signature verification
  • Deferred synchronization

Homomorphic Encryption Plugin

Privacy-preserving encrypted computation.

Features

  • Encrypted authentication processing
  • Secure computation
  • Privacy-preserving verification

Quantum Networking Plugin

Support for future quantum communication technologies.

Features

  • Quantum Key Distribution (QKD)
  • Quantum networking integration
  • Future quantum transport compatibility

Notification Plugin

Authentication notifications and alerts.

Features

  • Login notifications
  • Recovery notifications
  • Device alerts
  • Administrative alerts
  • Security event notifications

Developer SDK Plugin

Developer integration tools.

Features

  • JavaScript SDK
  • TypeScript SDK
  • Go SDK
  • Rust SDK
  • Python SDK
  • Mobile SDKs
  • CLI tools
  • Middleware libraries

Monitoring Plugin

Operational monitoring.

Features

  • Health monitoring
  • Metrics
  • Performance monitoring
  • Authentication statistics
  • Service diagnostics

Dashboard Plugin

Administrative dashboard.

Features

  • Authentication analytics
  • User analytics
  • Device analytics
  • Security dashboard
  • Session visualization
  • Audit visualization

Backup & Disaster Recovery Plugin

Protects deployment infrastructure.

Features

  • Configuration backup
  • Recovery automation
  • Disaster recovery
  • Restore management

Plugin Framework

Keyra includes a modular plugin framework allowing organizations to develop and deploy custom extensions.

Plugin capabilities include:

  • Authentication providers
  • Authorization providers
  • Cryptographic providers
  • Identity providers
  • Recovery providers
  • Logging providers
  • Notification providers
  • Monitoring providers
  • Administrative extensions
  • API extensions

Security Principles

  • Passwordless by default
  • Post-quantum ready
  • Zero-trust architecture
  • Privacy-first authentication
  • Least privilege access
  • Cryptographic identity
  • Forward secrecy
  • Secure key lifecycle management
  • Hardware-backed security
  • Defense in depth

Project Goals

  • Replace password-based authentication
  • Prepare organizations for the post-quantum era
  • Provide a modular authentication platform
  • Enable decentralized identity
  • Support enterprise and open-source deployments
  • Simplify secure authentication
  • Protect user privacy
  • Build a future-proof identity infrastructure

Documentation

Additional documentation is available in the /docs directory.

Documentation includes:

  • Architecture
  • Module specifications
  • API documentation
  • Plugin development
  • Security architecture
  • Deployment guides
  • Integration guides
  • Best practices

Specification Branding License (SBL)

Standard

Optional

  • Specification Branding License (SBL)

License & Notice Requirements

Keyra is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).
By contributing to this project, you agree that your contributions will also be released under this license.

Please note the following:

  • All contributions must comply with the AGPL-3.0+ terms.
  • Under Section 7 of the license, all redistributions, forks, and derivative works must preserve attribution to: Roxanne Ardary and https://www.roxanneardary.com/.
  • Keyra specifications are free to use with attribution. A Specification Branding License can be negotiated upon request.
  • The project’s notice.md file tracks attribution requirements and contributor acknowledgments. Any update that adds new contributors or modifies attribution should also update notice.md.
  • When submitting a pull request, ensure that any new files maintain the attribution headers where applicable.
  • Network-deployed versions of this software must also remain fully AGPL-3.0+ compliant, including exposure of source code modifications when applicable under the license.

For full legal details, please refer to the AGPL-3.0+ license and the project’s notice.md file.

Notice – Keyra

Attribution Requirement: Under Section 7 of the AGPL 3.0+ license, all redistributions, forks, and derivative works, including network-deployed versions of this project, must provide attribution to Roxanne Ardary and roxanneardary.com.

Contributors

This file tracks contributors and their specific contributions to the project.

  • Roxanne Ardary, roxanneardary.com – March 9, 2026
    Created the repository for Keyra. Developed the initial open-source quantum-safe authentication stack that replaces passwords with cryptographic keys and integrates post-quantum cryptography, zero-knowledge authentication, decentralized identity, and hardware-backed security.
  • [Add other contributors here] – [Date]
    [Describe contribution in one sentence]

License – Keyra

This repository is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).

Key Points

  • You are free to use, modify, and distribute the code.
  • All redistributions, forks, and derivative works or network-deployed versions must also be licensed under AGPL-3.0+ and provide attribution to Roxanne Ardary and roxanneardary.com as required under Section 7 of the license.
  • The software is provided “as is,” without warranty of any kind.

For the full license text, see GNU AGPL-3.0 License.

Related posts:

ScriptFlow

AgoraTV Specification

KindredCode