GNOME Keyring
Generated by GPT-5-miniExpansion Funnel Raw 2 → Dedup 0 → NER 0 → Enqueued 0
| GNOME Keyring | |
|---|---|
| Name | GNOME Keyring |
| Developer | GNOME Project |
| Released | 2004 |
| Operating system | Linux, Unix-like |
| License | GNU Lesser General Public License |
GNOME Keyring is a software component providing secure storage of secrets for user sessions on Unix-like systems. It is developed by the GNOME Project and is commonly used together with desktop environments and applications originating from the Free Software movement. The component interacts with session managers, authentication subsystems, and networked services to unlock, store, and supply credentials for applications.
Overview
GNOME Keyring was created to centralize secret management in desktop environments such as those maintained by the GNOME Project, and to provide a daemonized service that native and third-party applications can query. It sits alongside other user-session infrastructure like the X.Org Server, Wayland, and systemd, and is typically packaged by Linux distributions such as Debian, Fedora, and Ubuntu. The project has overlaps with cryptographic libraries and authentication frameworks used in projects from the Free Software Foundation and the Open Source Initiative.
Architecture and Components
The architecture comprises a background daemon process, a storage backend, and client bindings for applications in languages like C and Python. The daemon runs in user sessions coordinated by components such as ConsoleKit, systemd-logind, or GNOME Session Manager. Storage backends historically relied on files protected by a master password or integration with hardware tokens adhering to standards from the FIDO Alliance and PKCS#11. Client libraries expose APIs and D-Bus interfaces used by widely known applications like Evolution, NetworkManager, Firefox (on some distributions), and media players from projects affiliated with freedesktop.org.
Features and Functionality
Key functionalities include encrypted item storage, collection (or "keyring") management, secret retrieval over inter-process communication, and automatic unlocking on login via PAM modules. The service enables password caching for services such as IMAP, SMTP, LDAP, and SSH, and is often used by desktop components like GNOME Online Accounts, Empathy, and software from the Mozilla Foundation. It supports storing SSH keys and can cooperate with secure input methods present in toolkits provided by projects such as GTK and Qt.
Security and Cryptography
Security is implemented using symmetric cryptography provided by libraries like OpenSSL, LibreSSL, or libgcrypt, and may leverage kernel-level protections such as those in Linux Security Modules like SELinux and AppArmor. Key derivation is typically performed with PBKDF2 or similar algorithms standardized by organizations such as NIST. Hardware-backed keys can be stored on smart cards and tokens from vendors conforming to PKCS#11, and interaction with such devices may involve middleware produced by organizations like Yubico and the FIDO Alliance. Threat models considered include local privilege escalation, daemon impersonation, and side-channel attacks described in publications from academic institutions and security conferences.
Integration and Desktop Components
Integration points include desktop environments and session components maintained by the GNOME Project and freedesktop.org standards. Network and connectivity tools such as NetworkManager, browser components from the Mozilla Foundation, mail clients like Evolution from the GNOME community, and chat clients from projects influenced by XMPP standards interact with the service. Authentication stacks including PAM, systemd-logind, and display managers like GDM coordinate unlocking, while key storage may be accessed via D-Bus APIs defined in specifications from freedesktop.org.
Configuration and Usage
Administrators and users configure the service via distribution packaging conventions from Debian and Fedora, or via desktop settings exposed by GNOME Control Center. Command-line utilities and GUI tools provided by projects such as Seahorse (a GNOME application) allow management of collections and secrets. System integrators often adjust PAM configurations, display manager settings (for example GDM or SDDM), and packaging scripts used by distributions including Red Hat Enterprise Linux, SUSE, and Arch Linux to ensure seamless unlocking and secure defaults.
Development and History
Development traces back to early GNOME releases and contributions by developers associated with projects like Red Hat, Novell, and the GNOME Foundation. The project evolved alongside major platform shifts such as migrations from X.Org Server to Wayland, the adoption of systemd by many distributions, and the maturation of cryptographic libraries. It has been discussed in the context of security analyses and feature roadmaps alongside related efforts from the Free Software community and interoperable standards championed by organizations like the IETF and the FIDO Alliance.