Contact us for more information.
Download the datasheet (PDF, one page) — specifications, security architecture and language bindings.
What it is
KeyNub is a USB-C dongle that your application talks to in order to prove that a license is genuinely present. It is a USB HID device, so there is no driver to install on Windows, Linux or macOS — it works on a locked-down machine and on a customer’s laptop with equal fuss, which is none.
How the protection works
Each dongle holds an ECC P-256 key pair in a hardware secure element. The private key is generated on the chip and cannot be read out of it — not by us, not by anyone holding the dongle. Your application verifies the dongle against the KeyNub root CA, whose public certificate is compiled into the released SDK, so a substituted device fails the check and there is no trust root for you to supply, manage or ship.
After authentication, your application and the dongle establish an encrypted session (ECDH key agreement, HKDF derivation, AES-256-GCM). Everything after that point is authenticated and encrypted, so a USB capture shows nothing reusable and a replayed recording is rejected.
The dongle’s own firmware is compartmentalised as well. Its USB and protocol-parsing code — the only part of it an attacker can reach — runs isolated in a hardware-enforced Arm TrustZone world, unprivileged, and cannot address the device key, the secure element or your license records. A defect in the code that handles your traffic therefore cannot become a disclosed key. The dongle confirms this against the hardware at boot and reports it to the SDK, so your software can check it rather than take our word for it — see the security architecture for what this does and does not protect against.
What you can store on it
- License records — named blobs you write at provisioning time: entitlements, expiry dates, customer identifiers, feature flags.
- Monotonic counters — for activation counts or usage quotas that must not be rolled back.
- Application data encryption — encrypt values your program genuinely needs and cannot compute, then decrypt them through the dongle at runtime. Scope them to one physical dongle, or to any dongle from your batch.
That last one is the difference between a licensing scheme that holds and one that does not. A dongle cannot stop somebody patching your executable, so do not hand them a single boolean to patch. Put the dongle on the critical path instead: encrypt the coefficients, tables, thresholds or keys your software depends on, and without the dongle there is nothing to run rather than a check to bypass. Our SDK documentation shows this pattern in every language.
Integration
The bindings, samples and C ABI header are Apache-2.0 and published at github.com/AB-KeyNub/KeyNub-SDK, so you can read exactly what your integration will look like before you buy anything. One core C library with a stable ABI carries the cryptography, the USB transport and the protocol; the language bindings are thin translation layers on top. Every release ships prebuilt native libraries for Windows (x64, 32-bit and ARM64), Linux (x86_64 and ARM64) and macOS (one universal binary for Apple Silicon and Intel). Everything is built and tested on Windows, Linux and macOS.
C and C++, C#, VB.NET and F#, Python, Java, Delphi, Visual Basic 6, twinBASIC, VBA, MATLAB and Simulink, LabVIEW, Node.js, Go, Rust, Ruby, PHP, Fortran, COBOL, plus Lua, Zig, Julia and Nim. See all supported languages.
No subscription, no cloud
There is no activation server to call, no license server to run, and no recurring fee to us. The dongle is the license. If a customer’s machine has no internet connection — a test cell, a hospital, a factory floor, a secure facility — nothing changes.
Need your own branded version?
KeyNub is available as an OEM platform: your own enclosure, logo, USB VID/PID, custom firmware and dedicated security features, with volume manufacturing. You get hardware licensing under your own brand without building the hardware.
