Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Native Secure Enclave backed SSH keys on macOS

gist.github.com

Post reply on HN
Print view View original

131–140 of 204 posts

Re: Native Secure Enclave backed SSH keys on macOS

#131

Post by Nextgrid »

palata wrote: post #109
gruez wrote: post #75

Earlier quoted context omitted.

> So the malware needs to trick you into performing the TouchID gesture. That's not meaningfully more difficult than tricking you into revealing your key file password. >Instead of on each sign operation. But from your video each sign operation also requires a touchid prompt?

> That's not meaningfully more difficult than tricking you into revealing your key file password. No, but that's meaningfully more difficult to do without an intervention from the user. Say your computer is infected, the malware won't silently do it: it will have to interact with you . And an important part is that you apparently don't have to make the key exportable: > So if that's in your threat model don't make th…

> Say your computer is infected, the malware won't silently do it: it will have to interact with you.

MacOS is so needy about all kinds of fingerprint/password-related things (and has no context of secure desktop) that it is trivial for malware to simulate and no way for the user to tell whether it's genuine, so it's not a real barrier at all.

Re: Native Secure Enclave backed SSH keys on macOS

#132

Post by cortesoft »

jedberg wrote: post #93
adastra22 wrote: post #89

Earlier quoted context omitted.

I think you are mixing up concerns. You need a backup key. That doesn't mean you need to backup your key. Anything (everything?) using SSH authentication supports multiple authentication keys. Have a yubikey in a locked deposit box or something.

Today I make a private/public keypair, and the private key is on my laptop in my encrypted home folder. It also gets backed up to my encrypted offsite backup. That way if my laptop breaks or is stolen, I can restore from backup and be up and running as before. I was simply asking if that is still possible with this method, nothing more. And not every service that uses ssh auth allows multiple keys.

If you are keeping it on disk (encrypted or not), you don’t really gain anything from using the Secure Enclave.

Re: Native Secure Enclave backed SSH keys on macOS

#133

Post by morshu9001 »

Nextgrid wrote: post #97
morshu9001 wrote: post #64

Earlier quoted context omitted.

Yeah but if you get a new device, you have to go add its pubkey to every server you ever use. I wish there were an easier way, otherwise it's understandable that people copy privkeys.

If you’re operating at the scale this is too cumbersome to do manually surely you already have a configuration management system in place to automate this no?

I have keys tied to several random things, including home servers, GitHub, and AWS. Wouldn't call this scale exactly, but when I got a new laptop, it was way easier to just copy .ssh onto it rather than hunting everything down.

Re: Native Secure Enclave backed SSH keys on macOS

#134

Post by adastra22 »

jedberg wrote: post #93
adastra22 wrote: post #89

Earlier quoted context omitted.

I think you are mixing up concerns. You need a backup key. That doesn't mean you need to backup your key. Anything (everything?) using SSH authentication supports multiple authentication keys. Have a yubikey in a locked deposit box or something.

Today I make a private/public keypair, and the private key is on my laptop in my encrypted home folder. It also gets backed up to my encrypted offsite backup. That way if my laptop breaks or is stolen, I can restore from backup and be up and running as before. I was simply asking if that is still possible with this method, nothing more. And not every service that uses ssh auth allows multiple keys.

As others mention, there is no point to using the Secure Enclave if you have your key stored on disk or in your backup. It’s like putting impressive locks on the front door, while leaving the window open.

Beyond that, you can do that just fine right now by making TWO keys. If you lose the laptop, oh well. Recover with your backup key (which is hopefully kept more securely than you describe - it can be inconvenient to access since it is only needed for recovery).

This also lets you go further in locking things down or providing you notifications, as you can distinguish server side between your usual key and the backup key.

The point of the enclave is to be noncloneable and access limited. Extracting the key for the backup would negate the benefits derived from that.

Re: Native Secure Enclave backed SSH keys on macOS

#135

Post by cindyllm »

adastra22 wrote: post #134
jedberg wrote: post #93

Earlier quoted context omitted.

Today I make a private/public keypair, and the private key is on my laptop in my encrypted home folder. It also gets backed up to my encrypted offsite backup. That way if my laptop breaks or is stolen, I can restore from backup and be up and running as before. I was simply asking if that is still possible with this method, nothing more. And not every service that uses ssh auth allows multiple keys.

As others mention, there is no point to using the Secure Enclave if you have your key stored on disk or in your backup. It’s like putting impressive locks on the front door, while leaving the window open. Beyond that, you can do that just fine right now by making TWO keys. If you lose the laptop, oh well. Recover with your backup key (which is hopefully kept more securely than you describe - it can be inconvenient to…

[dead]

Re: Native Secure Enclave backed SSH keys on macOS

#138

Post by TacticalCoder »

jedberg wrote: post #13

If I understand correctly, this means you can't back up the private key, correct? It's in the Secure Enclave, so if you lose your laptop, you also lose the key? Since it looks like export only really exports the public key not the private one? Probably not the worst thing, you most likely have another way to get into the remote machine, or an admin who can reset you, but still feels like a hole. Or am I missing somet…

[dead]

Re: Native Secure Enclave backed SSH keys on macOS

#139

Post by daft_pink »

lxgr wrote: post #121
daft_pink wrote: post #114

Why would you want the private key file if you store it within the secure enclave?

Probably for the same reason that OpenSSH's `sk` implementation also still needs a private key file (even for the "resident key" option): You need to be able to point OpenSSH's various tools to something in an identity context, and that something traditionally is a private key file. The article even mentions that it doesn't contain any sensitive data: > Note that the "private" key here is just a reference to the FIDO…

Thanks I missed this in the description.

Re: Native Secure Enclave backed SSH keys on macOS

#140

Post by grosswait »

Nextgrid wrote: post #96
monocularvision wrote: post #70

Earlier quoted context omitted.

The malware would have to prompt for biometric authentication before exporting.

So it just has to wait until you’re about to do a legitimate operation requiring authentication, intercept that to export the key, and cancel the real one with a bogus error (and you’ll just try again without any second thoughts). MacOS has also no concept of secure desktop/etc where the OS can use some privileged UI to explicitly tell you what you are signing and prompt for PIN/biometrics. It’s in fact a well-known…

Couldn’t any type of dialogue be faked? What are you suggesting is possible but not implemented?
Post reply on HN