CUBE-Key
Your sealed store, on a key that fits in your pocket.
CUBE-Key is a small hardware key that carries a sealed CUBE store. Records are sealed to the key itself and open only when you plug it in, touch it, and enter your code. There is no account, no cloud, no company in the middle holding what you wrote down.
In developmentHardware manufacturer evaluation underway
What it is
Sealed at rest
Everything on the key is sealed with your identity key and a device key that never leaves the key. The files on the flash are ciphertext; pulling the chip off and reading it gives you nothing.
Bound to the key
Records unlock only against this key's identity. A copy of the flash, a stolen backup, a readout of the memory — none of them open elsewhere.
Two factors, no servers
Possession of the key and your unlock code. Verification happens on the key and in the companion app; no login service, no vendor, no subscription.
A store you can carry
Your sealed archive, drafts, notes and working records travel with you. Plug the key into any machine with the companion app and the store opens there; pull it out and the machine has nothing.
What's inside (target design)
| Interface | USB-C plug, USB 2.0 full speed. No radio, no battery. |
|---|---|
| Secure hardware | Secure microcontroller with TrustZone isolation and hardware crypto, secure boot, per-unit unique device key pair provisioned at manufacture. |
| Storage | Capacity options (target design): 16 MB and 64 MB SPI NOR for a travel store; 128–256 MB high-density SPI NOR; 512 MB SLC SPI NAND, or an eMMC part (8 GB and up) if large archives are wanted. The encrypted CUBE store format is identical at every capacity. |
| Unlock | Touch button on the key, plus the unlock code entered in the companion app. |
| Status | One RGB status LED. |
| Size | Key-fob enclosure, roughly 35 × 12 × 4 mm, with a ring hole. |
| Compliance target | CE, FCC, RoHS. |
How you use it
- Set up the key once with the companion app (CUBE Contact desktop): the key generates its device identity and stores it.
- Write records through the app; they are sealed and written to the key's store.
- Pull the key out — the computer keeps nothing.
- Plug it into any other machine with the app, unlock with your code, and the store opens there.
What it deliberately does not do
No wireless
No Bluetooth, no NFC, no Wi-Fi. The only way in is the connector. Deliberate: every radio is a door.
Not a website login key (yet)
A FIDO2-certified mode is being evaluated with manufacturers, not shipped. Today CUBE-Key is for your sealed CUBE store, not for signing into other sites.
No cloud, no recovery service
Lose the key and your sealed store is gone unless you exported a backup. That is the price of nobody else being able to open it — and it is stated plainly.
Status
CUBE-Key is in development. Hardware manufacturing is being sourced from established security-token makers (evaluation of designs and quotes underway, October 2026). The plan: evaluation units first, then a small pilot batch, then a production run. No price or ship date is set yet, and nothing here is a commitment to sell one. If you would like to be considered for an evaluation unit, write to info@cubelinux.com.