Architecture
KeyForge Team Pro extends KeyForge with WiFi connectivity and team synchronization:
Customer firmware contains:
├── team_code (secret, for seed derivation)
├── team_id (public, for server identification)
├── allowed_serials[] (list of authorized device serials)
└── sync_server_url
All team devices derive the same master seed from the shared team code:
team_code ─► HKDF ─► team_seed (32 bytes)
│
credential_id + team_seed ─► HKDF ─► private_key
Security Model
| Threat | Mitigation |
|---|---|
| Stolen device | User PIN required, device can be revoked, auto-wipe on blacklist |
| Server compromise | E2E encryption - server has only ciphertext |
| Firmware extraction | Team code in firmware, but useless without matching serial |
| Rogue device | Serial allowlist in firmware + server-side verification |
| Device offline too long | RTC-based check-in enforcement with tamper protection |
Sync Protocol
Credentials sync over HTTPS with end-to-end encryption:
sync_encryption_key = HKDF(team_code, "keyforge-teampro-sync-v1")
encrypted_cred = AES-GCM(sync_encryption_key, credential_data)
Only metadata syncs - private keys are derived locally from the team seed. The server stores only ciphertext with zero knowledge of credential contents.
Use Cases
- MSPs: Shared access to client infrastructure without password sharing
- IT Teams: Any team member can authenticate to shared service accounts
- On-call Rotation: Seamless handoff without credential transfer
- Compliance: Audit trail of which device authenticated when
Deployment
- Provision devices with team-specific firmware via
keyforge-provision - Deploy self-hosted sync server or use AuthGrid managed service
- Distribute devices to team members
- Credentials automatically sync across all team devices