Skip to content
A transparent and secure way to look up public keys.
Go Shell Dockerfile
Branch: master
Clone or download
pavelkalinnikov integration: Factor out helper to run batch and publish (#1341)
* integration: Factor out helper to run batch and publish
* Satisfy gocritic, and reduce indentation
* Remove redundant dirID parameter
* Put Env right after Context
* Preserve status.Code
Latest commit ffedd21 Aug 20, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
cmd Revert "Turn on GOPROXY (#1330)" (#1338) Aug 19, 2019
core integration: Factor out helper to run batch and publish (#1341) Aug 20, 2019
deploy Fix CI (#1164) Jan 22, 2019
docs Include LogRootRequest in Request Protos (#1329) Aug 2, 2019
impl Tracker Factory for dependency injection (#1327) Jul 19, 2019
scripts Improve integration script reliability (#1339) Aug 19, 2019
.dockerignore Add .dockerignore file, move gcloud auth command to travis (#622) Jun 20, 2017
.env Update docker-compose paths (#1169) Feb 4, 2019
.gitignore Add integration test to code coverage metrics (#1010) Jul 6, 2018
.gometalinter.json Remove Makefile and use standard gometalinter config (#1042) Sep 19, 2018
.keytransparency.yaml Simplify command line client flags (#738) Aug 12, 2017
.travis.yml Check for data races in travis (#1334) Aug 19, 2019
AUTHORS Prevent protobuf nil pointer dereference (#600) Aug 8, 2017
CODEOWNERS Increase bus factor (#1257) Apr 13, 2019 Main Title format fixed (#1007) Jun 27, 2018
CONTRIBUTORS Monitor verification logic (#768) Sep 1, 2017
LICENSE Add Licensing Jun 2, 2015 Remove secrets from Docker Images (#1191) Jul 19, 2019
client_secrets.json.enc Fix gcloud install and deploy script (#1060) Oct 9, 2018
codecov.yml Ignore generated files in code coverage (#1017) Jul 10, 2018
docker-compose.override.yml Remove secrets from Docker Images (#1191) Jul 19, 2019 Remove secrets from Docker Images (#1191) Jul 19, 2019
docker-compose.yml Remove secrets from Docker Images (#1191) Jul 19, 2019
go.mod Check for data races in travis (#1334) Aug 19, 2019
go.sum Check for data races in travis (#1334) Aug 19, 2019
prototool.yaml prototool linting and formatting (#1105) Nov 8, 2018

Key Transparency

GoDoc Build Status Go Report Card codecov

Key Transparency Logo

Key Transparency provides a lookup service for generic records and a public, tamper-proof audit log of all record changes. While being publicly auditable, individual records are only revealed in response to queries for specific IDs.

Key Transparency can be used as a public key discovery service to authenticate users and provides a mechanism to keep the service accountable. It can be used by account owners to reliably see what keys have been associated with their account, and it can be used by senders to see how long an account has been active and stable before trusting it.

Key Transparency is inspired by CONIKS and Certificate Transparency. It is a work-in-progress with the following milestones under development.

Key Transparency Client


  1. Install Go 1.10.
  2. go get -u

Client operations

Generate a private key

keytransparency-client authorized-keys create-keyset --password=${PASSWORD}
keytransparency-client authorized-keys list-keyset --password=${PASSWORD}

The create-keyset command will create a .keyset file in the user's working directory. To specify custom directory use --keyset-file or -k shortcut.

NB A default for the Key Transparency server URL is being used here. The default value is "". The flag --kt-url may be used to specify the URL of Key Transparency server explicitly.

Publish the public key

  1. Get an OAuth client ID and download the generated JSON file to client_secret.json.
keytransparency-client post \
--client-secret=client_secret.json \
--insecure \
--password=${PASSWORD} \
--data='dGVzdA==' #Base64

Get and verify a public key

keytransparency-client get <email> --insecure --verbose
✓ Commitment verified.
✓ VRF verified.
✓ Sparse tree proof verified.
✓ Signed Map Head signature verified.
CT ✓ STH signature verified.
CT ✓ Consistency proof verified.
CT   New trusted STH: 2016-09-12 15:31:19.547 -0700 PDT
CT ✓ SCT signature verified. Saving SCT for future inclusion proof verification.
✓ Signed Map Head CT inclusion proof verified.
keys:<key:"app1" value:"test" >

Verify key history

keytransparency-client history <email> --insecure
Revision |Timestamp                    |Profile
4        |Mon Sep 12 22:23:54 UTC 2016 |keys:<key:"app1" value:"test" >


Running the server

  1. OpenSSL
  2. Docker
    • Docker Engine 1.17.6+ docker version -f '{{.Server.APIVersion}}'
    • Docker Compose 1.11.0+ docker-compose --version
go get -u
go get -u
cd $(go env GOPATH)/src/
./scripts/ -f
docker-compose -f docker-compose.yml up
  1. Watch it Run

Development and Testing

Key Transparency and its Trillian backend use a MySQL database, which must be setup in order for the Key Transparency tests to work.

docker-compose up -d db will launch the database in the background.

Directory structure

The directory structure of Key Transparency is as follows:


You can’t perform that action at this time.