Virkeys

Virkeys are portable cryptographic tokens that store and manage digital keys used for authentication, digital signing, and encryption. They are designed to keep private keys isolated from host devices to reduce exposure to malware. Virkeys may be hardware devices connected by USB, NFC, or Bluetooth, or software-based tokens embedded in mobile apps or cloud services.

The name virkey is a contraction of virtual key, commonly used in the context of authentication tokens. In practice, virkeys emphasize hardware-backed security, though some implementations blur the line with software-only variants bound to a device.

Most virkeys implement standard interfaces for authentication, such as FIDO2/WebAuthn and U2F, or traditional PKI mechanisms, and they often include a secure element or trusted execution environment to protect private material. They typically support multiple credentials, attestation, and user-initiated actions (pressing a button, entering a PIN) to authorize operations.

Common uses include enterprise single sign-on, cloud service access, code signing, and document signing. They offer phishing-resistant login and can simplify key management because keys can be generated and never leave the device.

Security considerations include the risk of loss or theft, recovery procedures, and the need for backup and life-cycle management. Compatibility with service providers and device ecosystems is also a factor in adoption.