A transparent and secure way to look up public keys.
Switch branches/tags
Nothing to show
Clone or download
Failed to load latest commit information.
cmd Use CONIKS_SHA256 hash strategy by default (#1030) Sep 4, 2018
core Use MapClient's convenience methods. (#1043) Sep 20, 2018
deploy Export Prometheus metrics to StackDriver (#996) Jun 26, 2018
docs Fix title format on #5 (#1008) Jun 27, 2018
impl Fix format string (#1039) Sep 17, 2018
scripts Export Prometheus metrics to StackDriver (#996) Jun 26, 2018
vendor Remove Trillian Fakes (#928) Feb 19, 2018
.dockerignore Add .dockerignore file, move gcloud auth command to travis (#622) Jun 20, 2017
.gitignore Add integration test to code coverage metrics (#1010) Jul 6, 2018
.golangci.yml Add golangci config (#1013) Jul 12, 2018
.gometalinter.json Remove Makefile and use standard gometalinter config (#1042) Sep 19, 2018
.keytransparency.yaml Simplify command line client flags (#738) Aug 12, 2017
.travis.yml Remove Makefile and use standard gometalinter config (#1042) Sep 19, 2018
AUTHORS Prevent protobuf nil pointer dereference (#600) Aug 8, 2017
CODEOWNERS Add CODEOWNERS file (#1032) Sep 6, 2018
CONTRIBUTING.md Main Title format fixed (#1007) Jun 27, 2018
CONTRIBUTORS Monitor verification logic (#768) Sep 1, 2017
LICENSE Add Licensing Jun 2, 2015
README.md Add code coverage badge (#1000) Jun 22, 2018
codecov.yml Ignore generated files in code coverage (#1017) Jul 10, 2018
docker-compose.yml Export Prometheus metrics to StackDriver (#996) Jun 26, 2018
travis_secrets.tar.gz.enc Update/re-encrypt and add credentials-file (#647) (#648) Jun 22, 2017


Key Transparency

GoDoc Build Status Go Report Card codecov

Key Transparency Logo

Key Transparency provides a lookup service for generic records and a public, tamper-proof audit log of all record changes. While being publicly auditable, individual records are only revealed in response to queries for specific IDs.

Key Transparency can be used as a public key discovery service to authenticate users and provides a mechanism to keep the service accountable. It can be used by account owners to reliably see what keys have been associated with their account, and it can be used by senders to see how long an account has been active and stable before trusting it.

Key Transparency is inspired by CONIKS and Certificate Transparency. It is a work-in-progress with the following milestones under development.

Key Transparency Client


  1. Install Go 1.10.
  2. go get -u github.com/google/keytransparency/cmd/keytransparency-client

Client operations

Generate a private key

keytransparency-client authorized-keys create-keyset -p password
keytransparency-client authorized-keys list-keyset -p password

Publish the public key

  1. Get an OAuth client ID and download the generated JSON file to client_secret.json.
keytransparency-client post user@domain.com app1 --client-secret=client_secret.json --insecure -d 'dGVzdA==' #Base64

Get and verify a public key

keytransparency-client get <email> <app> --insecure --verbose
✓ Commitment verified.
✓ VRF verified.
✓ Sparse tree proof verified.
✓ Signed Map Head signature verified.
CT ✓ STH signature verified.
CT ✓ Consistency proof verified.
CT   New trusted STH: 2016-09-12 15:31:19.547 -0700 PDT
CT ✓ SCT signature verified. Saving SCT for future inclusion proof verification.
✓ Signed Map Head CT inclusion proof verified.
keys:<key:"app1" value:"test" >

Verify key history

keytransparency-client history <email> --insecure
Epoch |Timestamp                    |Profile
4     |Mon Sep 12 22:23:54 UTC 2016 |keys:<key:"app1" value:"test" >

Running the server


  1. OpenSSL
  2. Docker
    • Docker Engine 1.13.0+ docker version -f '{{.Server.APIVersion}}'
    • Docker Compose 1.11.0+ docker-compose --version
  3. go get -u github.com/google/keytransparency/...
  4. go get -u github.com/google/trillian/...
  5. ./scripts/prepare_server.sh -f


  1. Run Key Transparency
$ docker-compose up -d
Creating keytransparency_db_1 ...         done
Creating keytransparency_map_server_1 ... done
Creating keytransparency_log_server_1 ... done
Creating keytransparency_log_server_1 ... done
Creating keytransparency_server_1 ...     done
Creating keytransparency_sequencer_1 ...  done
Creating keytransparency_monitor_1 ...    done
Creating keytransparency_init_1 ...       done
Creating keytransparency_prometheus_1 ... done
Creating keytransparency_monitor_1 ...    done
  1. Watch it Run

Development and Testing

Key Transparency and its Trillian backend use a MySQL database, which must be setup in order for the Key Transparency tests to work.

Directory structure

The directory structure of Key Transparency is as follows: