Documentation / Start here

Getting started.

Start with a connected, provisioned stick and a host tool that can reach it.

Before you begin

The custom PCB is pending hardware validation. Firmware and host library sources are available in the project directory; companion application repositories are coming soon. The steps here describe the current development workflow for someone with access to the source and suitable hardware.

You will need a provisioned device, its PIN, a USB connection, and access to the USB device from your user account. Rust applications require a Rust toolchain with edition 2024 support. The host library uses rusb, so its build and runtime need a working libusb setup for your system.

The Go CLI currently declares Go 1.26.0. Platform compatibility is still being established; a USB library dependency alone is not a claim that every operating system has been validated.

Arrange the source checkouts

Seal and Keyring depend on a sibling host-library directory:

enigma/
├── enigma-host/
├── enigma-cli/
├── enigma-seal/
└── enigma-keyring/

Firmware and board files have their own source repositories. This website documents them and links to those repositories; it does not distribute application or firmware binaries.

Build a host tool

For a quick device status check, build the CLI:

cd enigma-cli
go build -o enigma-cli .
./enigma-cli status

Alternatively, build the host library for your own Rust or C application:

cd enigma-host
cargo build --release

The crate produces a Rust library and a platform-specific shared library for its C interface. Continue with the Rust or C guide.

Read the device state

The status response has two independent fields:

A ready token with a closed session is provisioned and locked. Unlock it before a protected operation.

Unlock, inspect, lock

./enigma-cli authenticate
./enigma-cli list-keys
./enigma-cli lock

The PIN prompt hides typed input. Authentication opens a reusable device session; the firmware closes it after inactivity or an explicit lock.

A note on provisioning

The firmware implements token initialization, but the current Rust library, C API, and CLI do not expose an initialization operation. This guide assumes a token provisioned through the firmware development workflow.

If status reports an uninitialized token, authentication will not initialize it. A public first-time provisioning workflow is still needed before a general hardware release.

Choose a next step

• Generate and inspect a key with the CLI.
• Encrypt a file with Seal.
• Create a local Keyring vault.
• Open a device from your own Rust application.

If the device cannot be opened, start with troubleshooting.