Protecting SSH Keys with macOS Secure Enclave

cavoirom

If someone like the native approach or is familiar with SeKey, I created sekey-sh to simplify the process: https://github.com/cavoirom/sekey-sh Work on macOS 26 and later.

Gigachad

I was looking in to this just earlier today. The native macos version worries me a little because it seems someone just happened to discover it in MacOS, rather than it being a documented feature. The worry being Apple could change or remove it later locking you out of your keys since they never advertised this as a thing you could do.

bdamm

We should have had this 20 years ago. It is almost pathological how difficult it is to reliably use hardware keys as ssh credentials.

petesergeant

I've been using Secretive (a nice software wrapper for these) for a few days for my Github keys (where 1Password holds the rest of my SSH keys). It works nicely, but obviously you can't back up a key that started life in a secure enclave, so you'll need alternative access arrangements for anything you setup that way.

larusso

I used yubikeys for ssh for years. First via the older clunky gpg as ssh key feature. Then via the FIDO api. My biggest issue was the chicken and egg issue when using this setup on a new machine or god forbid in a container etc. windows and WLS wasn’t super thrilled either. I switched to 1Password ssh because I actually like the fact that I can simply share my keys. It’s still not perfect. Agent forwarding needs an extra configuration and depending how many keys you have and how verbose your ssh config gets it becomes also very finicky. This solution feels for me like a slight setback because it’s a macOS only solution. If you have a Linux or windows machine next to a Mac you have to deal with the insecure key file on your hard drive again either via yubi keys or software solutions. But I think I would take this over a yubikey. I really disliked the fact that one usb port was constantly in use.

dsenkus

These days I'm mainly doing development inside VM's. Previously I was embedding Github key to each VM, but since I setup Secure Enclave (with Secretive), I'm only forwarding it's agent to VM and each git action on origin now requires approval using fingerprint reader. I think this a good way to prevent malware from gaining access to github

database64128

Security features like this works, until it doesn't. When I installed WireGuard on macOS, I was happy to discover that it stores private keys in the system keychain. Accessing the private key requires Touch ID. Then one day after a system upgrade, the WireGuard app crashed on startup with: [APP] Unable to open config from keychain: -25300 Then the app deleted all profiles because they are all "orphaned", apparently for "keychain consistency" [0]. From then on, I just use a text editor to edit my WireGuard configuration files, and import them to the app. The bug still exists to this day [1]. [0] https://github.com/WireGuard/wireguard-apple/commit/dfb685f2... [1] https://www.reddit.com/r/WireGuard/comments/wyt828/osx_wireg...