Secretive – macOS native app to store SSH keys in the Secure Enclave

Post by noja » Sun, Jun 28, 2020, 6:44 AM UTC

mfontani wrote: post #41

Metus wrote: post #8

For anyone not aware, you can use macOS's keychain to store ssh key passwords and have them unlock at login. This way you can have the benefits and convenience of password managers in the command line for SSH certificates. https://apple.stackexchange.com/questions/48502/how-can-i-pe...

Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)? > You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is th…

    Host *
      IdentitiesOnly yes

Post by Hnrobert42 » Sun, Jun 28, 2020, 7:00 AM UTC

Metus wrote: post #48

mfontani wrote: post #41

Earlier quoted context omitted.

Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)? > You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is th…

After researching this for a while, it seems there is no documented, native option to do this. The only option is to unlock all SSH keys all the time, which makes them less secure than the passwords for websites managed by the exact same keychain. Which, in my opinion, is weird . Do they employees at Apple use a different system altogether? Because the built-in one doesn't seem very secure. Or maybe I am using it wro…

Post by mfontani » Sun, Jun 28, 2020, 7:43 AM UTC

Hnrobert42 wrote: post #83

Metus wrote: post #48

Earlier quoted context omitted.

After researching this for a while, it seems there is no documented, native option to do this. The only option is to unlock all SSH keys all the time, which makes them less secure than the passwords for websites managed by the exact same keychain. Which, in my opinion, is weird . Do they employees at Apple use a different system altogether? Because the built-in one doesn't seem very secure. Or maybe I am using it wro…

There is a native way in .ssh/config. I just added a reply to a different post.

Post by threentaway » Sun, Jun 28, 2020, 8:17 AM UTC

metafunctor wrote: post #72

justincormack wrote: post #26

I have been using sekey for this for a while. Its pretty nice, I mean you do need to auth quite a bit if you use git clone over ssh a lot, but it does mean you know when keys are used.

Yep, it’s so much better than just key files: keeps key material in a secure system (Secure Enclave), you know when a key is used (standard macOS security prompt), and requires a physical interaction (Touch ID) to use a key.

Post by foolmeonce » Sun, Jun 28, 2020, 9:14 AM UTC

tialaramex wrote: post #54

foolmeonce wrote: post #50

Earlier quoted context omitted.

This works ok and is the best option at the moment, but as more systems upgrade to newer versions I think the Fido/U2F support is probably going to take over. It's nice to not have anything key specific, any initialization steps, and so on.

Edit: Maybe OpenSSH does offer resident keys. On the one hand their release notes say they do but on the other hand I was 100% sure somebody who should know insisted they didn't. A trawl of my records cannot find such a communication so perhaps I dreamt it. If resident keys are an option then you need to make sure to buy FIDO 2 authenticators and to explicitly tell OpenSSH you want resident keys. The current SSH FIDO…