Native Secure Enclave backed SSH keys on macOS

#1

Post by arianvanp » Sun, Nov 23, 2025, 5:55 PM UTC

Native Secure Enclave backed SSH keys on macOS
gist.github.com

Re: Native Secure Enclave backed SSH keys on macOS

#2

Post by greatgib » Sun, Nov 23, 2025, 6:19 PM UTC

It's a total pain in the ass to try to have password encrypted gpg or ssh keys in mac. Nothing better that another way to make it even more painful and complicated, so that people will just store plain text keys to not be annoyed.

Re: Native Secure Enclave backed SSH keys on macOS

#3

Post by epistasis » Sun, Nov 23, 2025, 6:20 PM UTC

Whoa, that is pretty cool.

I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting complete access to key ops without me knowing what's going on.

However the Tahoe version of secretive is buggy and frequently locks up on initial key op requests. I don't have the bandwidth to debug it and file a bug report, and honesty I'm not sure I want to relearn all that knowledge of SSH to figure it out.

I think the smart card SSH UX is worse than secretive's, IIRC my past pain, but if it is reliable, worth a shot.

Re: Native Secure Enclave backed SSH keys on macOS

#4

Post by redrove » Sun, Nov 23, 2025, 6:20 PM UTC

nvm

Re: Native Secure Enclave backed SSH keys on macOS

#5

Post by traceroute66 » Sun, Nov 23, 2025, 6:26 PM UTC

Awesome.

Won't be ditching Yubikeys just yet but I can see a number of use-cases for this already.

Re: Native Secure Enclave backed SSH keys on macOS

#6

Post by simonw » Sun, Nov 23, 2025, 6:27 PM UTC

redrove wrote: post #4

nvm

This Gist is about not needing to use Secretive any more.

Re: Native Secure Enclave backed SSH keys on macOS

#7

Post by traceroute66 » Sun, Nov 23, 2025, 6:29 PM UTC

redrove wrote: post #4

nvm

> Secretive has been around for a while, I don't see why it's coming up now through this gist.

Because this is different !

Secretive required installation, which is both friction and security-sensitive tool written by a third party.

This is native, written by Apple, available out-of-the-box in Tahoe.

Re: Native Secure Enclave backed SSH keys on macOS

#8

Post by cedws » Sun, Nov 23, 2025, 6:31 PM UTC

Secretive is a bit friendlier to set up but I'll probably switch to this anyway so I have one less app on my computer.

Plugging my blog post for how to achieve this on Windows 11:

https://cedwards.xyz/tpm-backed-ssh-keys-on-windows-11/

Re: Native Secure Enclave backed SSH keys on macOS

#9

Post by traceroute66 » Sun, Nov 23, 2025, 6:32 PM UTC

greatgib wrote: post #2

It's a total pain in the ass to try to have password encrypted gpg or ssh keys in mac. Nothing better that another way to make it even more painful and complicated, so that people will just store plain text keys to not be annoyed.

> It's a total pain in the ass to try to have password encrypted gpg or ssh keys in mac.

Who uses password encrypted keys anyway ? No exfiltration protection, and a sitting duck for unlimited automated password guessing attempts.

Pre-Tahoe people used Yubikeys or Secretive. But now this native tool is a better option than Secretive, even if Yubikeys still have their uses for the power-users.

Re: Native Secure Enclave backed SSH keys on macOS

#10

Post by manuelabeledo » Sun, Nov 23, 2025, 6:35 PM UTC

greatgib wrote: post #2

It's a total pain in the ass to try to have password encrypted gpg or ssh keys in mac. Nothing better that another way to make it even more painful and complicated, so that people will just store plain text keys to not be annoyed.

This looks like the complete opposite, though? It’s easy and provides a convenient way to integrate SSH and TouchID.