Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secretive – macOS native app to store SSH keys in the Secure Enclave

github.com

Post reply on HN
Print view View original

21–30 of 109 posts

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#21

Post by acdha »

GekkePrutser wrote: post #16
lunixbochs wrote: post #3

Earlier quoted context omitted.

You don’t actually need to store Secure Enclave protected data in the enclave. Can “wrap” it with the enclave’s key and store it on your own disk.

This is not what it does though. It says the private key can't be exported, and this wouldn't be the case if it was just a regular SSH keyfile encrypted using the Enclave's key.

You can ask the Secure Enclave or a smart card to perform operations using a key pair which is generated on and never leaves the device. In the case of SSH, you can use that directly as long as your SSH client and server support that algorithm: the client advertises the key fingerprint and just passes the server’s challenge through without modification. Apple has had native support built-in for using PIV/CAC tokens for years.

For storing arbitrary sized things, you’d typically use that key pair to sign an AES key used to encrypt the actual file so your device only needs to store the comparatively small keys.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#22

Post by pqdbr »

_abox wrote: post #14
pqdbr wrote: post #9

From the FAQ: > Q: How do I import my current SSH keys, or export my Secretive Keys? > A: The secure enclave doesn't allow import or export of private keys. For any new computer, you should just create a new set of keys. If you're using a smart card, you might be able to export your private key from the vendor's software. I don't get it. If so, how am I supposed to back up my keys in case of a hardware failure or har…

Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file. This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can onl…

By "you just use multiple", you mean I would have to generate extra private keys, add them to authorized_keys, and store them somewhere other than my mac, right?

Because just by using multiple keys I would still be locked out if all of them were stored in this 'Secretive' app.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#24

Post by acdha »

jooize wrote: post #18
_abox wrote: post #14

Earlier quoted context omitted.

Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file. This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can onl…

Is there a convenient way to manage and maintain those keys? Keeping the public key of each device and easily select which ones to place on servers.

In the case of SSH keys, when you export the key fingerprint you can edit the comment. I like the convention of email address & hostname to disambiguate the entries in a centrally-managed authorized keys list – when you get a new device, update the list and push the new version out.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#25

Post by dchest »

lunixbochs wrote: post #3
philistine wrote: post #2

Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for example.

You don’t actually need to store Secure Enclave protected data in the enclave. Can “wrap” it with the enclave’s key and store it on your own disk.

Unwrapping it puts the private key into memory, from which it can be extracted (it’s hard, of course, but looking at the state of Intel security, everything is possible). Secure Enclave is supposed to sign with non-extractable private key without putting it into RAM.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#27

Post by zymhan »

pqdbr wrote: post #22
_abox wrote: post #14

Earlier quoted context omitted.

Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file. This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can onl…

By "you just use multiple", you mean I would have to generate extra private keys, add them to authorized_keys, and store them somewhere other than my mac, right? Because just by using multiple keys I would still be locked out if all of them were stored in this 'Secretive' app.

If you only have a single SSH key as the only method of authenticating somewhere, you already have a dangerous single point of failure.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#28

Post by jbverschoor »

epistasis wrote: post #20
jbverschoor wrote: post #15

Earlier quoted context omitted.

Non Volatile Memory Volatile Memory gets “erased” when powered off

Accurate, and in usage in technical circles already. But I've always found it awkward, and names based on what something is not are always unsettling to me.

Then just Memory. That’s what elderly and nontechies usually call it. And it’s correct. Even more correct with always-on-computing and automatic state saving

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#29

Post by dtorres »

smnrchrds wrote: post #12
bdcravens wrote: post #4

Earlier quoted context omitted.

Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage

That's how language works. We call people "engineers" who have never and will never work on any engines.

"engineer" comes from ingenium (mind, talent) in Latin.

Engineer in most latin languages would be a completely different word to Engine (usually Motor)

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#30

Post by saagarjha »

jbverschoor wrote: post #15
epistasis wrote: post #6

Earlier quoted context omitted.

I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?

Non Volatile Memory Volatile Memory gets “erased” when powered off

Wait until people confuse that with NVRAM.
Post reply on HN