Secretive – macOS native app to store SSH keys in the Secure Enclave • Hacker News Board

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#31

Post by AlexCoventry » Sat, Jun 27, 2020, 9:31 PM UTC

vladvasiliu wrote: post #13

AlexCoventry wrote: post #7

Is a similar service available for yubikeys connected to linux machines?

There is: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike... https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... The yubikey (at least some models) can work as a smartcard.

Thanks.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#32

Post by g_p » Sat, Jun 27, 2020, 9:32 PM UTC

For anyone interested in a standardised/Linux-compatible version of this, check out PKCS11 tokens. Smartcards can and do implement this spec, and if you use PKCS11, the secret is used from the token to sign an SSH login (for example), without being revealed.

This means the secret itself stays on the card. You can combine this with certificates if needed; the smartcard handles the authentication. Using PKCS11 tokens is supported in recent openssh versions. You can also use them for client certificate authentication in web browsers. For anyone familiar with DoD CACs, this is similar - I believe they use a particular card with a proprietary PKCS11 driver, but you can use opensc with any card running a PKCS11 applet.

Some refs:

https://zerowidthjoiner.net/2019/01/12/using-ssh-public-key-...

https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#33

Post by g_p » Sat, Jun 27, 2020, 9:33 PM UTC

AlexCoventry wrote: post #7

Is a similar service available for yubikeys connected to linux machines?

Yes - as the other commenter mentioned there are some docs from Yubico. Also worth looking at PKCS11, as this lets you do HTTPS clent certificate authentication, as well as SSH. And it's all standardised too under the PKCS11 standard, which is nice for portability or diversity of token providers.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#34

Post by ithkuil » Sat, Jun 27, 2020, 9:34 PM UTC

smnrchrds wrote: post #12

bdcravens wrote: post #4

Earlier quoted context omitted.

Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage

That's how language works. We call people "engineers" who have never and will never work on any engines.

engineer

/ɛndʒɪˈnɪə/

Origin:

"Middle English (denoting a designer and constructor of fortifications and weapons; formerly also as ingineer ): in early use from Old French engigneor, from medieval Latin ingeniator, from ingeniare ‘contrive, devise’, from Latin ingenium (see engine); in later use from French ingénieur or Italian ingegnere, also based on Latin ingenium, with the ending influenced by -eer."

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#35

Post by gumby » Sat, Jun 27, 2020, 9:37 PM UTC

epistasis wrote: post #6

bdcravens wrote: post #4

Earlier quoted context omitted.

Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage

I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?

In the old Multics papers it was just long term storage as there was no difference between segments in memory and on disk. Which we are finally starting to catch up with 50 years later.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#36

Post by fehyjn » Sat, Jun 27, 2020, 9:38 PM UTC

Is is possible to recreate this using Windows Hello and TPM?

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#37

Post by vdfs » Sat, Jun 27, 2020, 9:38 PM UTC

> Auditable Build Process

> Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release

What will stop an attacker from hard coding code source file hashes? I'm not saying they will, just that it's a bad method of making binaries auditable

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#38

Post by walterbell » Sat, Jun 27, 2020, 9:38 PM UTC

alibert wrote: post #23

walterbell wrote: post #17

Could this be possible on iOS devices, which also have a secure enclave?

You could check https://krypt.co (not affiliated)

Thanks, that reminded me of upcoming iOS 14 support for WebAuth/FIDO. Perhaps that can be extended to SSH auth.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#39

Post by gruez » Sat, Jun 27, 2020, 9:42 PM UTC

vdfs wrote: post #37

> Auditable Build Process > Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release What will stop an attacker from hard coding code source file hashes? I'm not saying they wil…

Nothing. The point is that you can replicate the same steps on your local machine and the hashes should be the same. If they're not it means either github actions and/or the repo owner has been compromised.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#40

Post by m0dest » Sat, Jun 27, 2020, 9:47 PM UTC

alibert wrote: post #23

walterbell wrote: post #17

Could this be possible on iOS devices, which also have a secure enclave?

You could check https://krypt.co (not affiliated)

Note that they were bought by Akamai last year. I wouldn't count on the Krypton apps staying around, at least not in their current incarnation. A fork could survive, though.