Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Native Secure Enclave backed SSH keys on macOS

gist.github.com

Post reply on HN
Print view View original

171–180 of 204 posts

Re: Native Secure Enclave backed SSH keys on macOS

#171

Post by mritzmann »

jedberg wrote: post #13

If I understand correctly, this means you can't back up the private key, correct? It's in the Secure Enclave, so if you lose your laptop, you also lose the key? Since it looks like export only really exports the public key not the private one? Probably not the worst thing, you most likely have another way to get into the remote machine, or an admin who can reset you, but still feels like a hole. Or am I missing somet…

> If I understand correctly, this means you can't back up the private key, correct? It's in the Secure Enclave, so if you lose your laptop, you also lose the key?

In a business environment, that's what you want. The key is then burned, and you ask your coworkers (who still have access) to remove the old key and store your new one on the servers.

Re: Native Secure Enclave backed SSH keys on macOS

#172

Post by leshenka »

cedws wrote: post #8

Secretive is a bit friendlier to set up but I'll probably switch to this anyway so I have one less app on my computer. Plugging my blog post for how to achieve this on Windows 11: https://cedwards.xyz/tpm-backed-ssh-keys-on-windows-11/

Wonder if it's possible to use keys created by Secretive in native authentication?

Re: Native Secure Enclave backed SSH keys on macOS

#173

Post by traceroute66 »

morshu9001 wrote: post #64
pi-rat wrote: post #46

Earlier quoted context omitted.

You can use more than one key you know. Keep the private key you actively use in the secure enclave. The system you actively use is most at risk. Keep a secondary offline private key as backup. You can generate and store it in a secure location, and never move it around. Airgapped even if you want. You could even use a yubikey or other hardware for the secondary key giving you two hard to export keys. Distribute pub…

Yeah but if you get a new device, you have to go add its pubkey to every server you ever use. I wish there were an easier way, otherwise it's understandable that people copy privkeys.

> I wish there were an easier way,

For SSH there is.

Its called SSH certificates. ;)

Re: Native Secure Enclave backed SSH keys on macOS

#174

Post by johnisgood »

atrettel wrote: post #145
doublepg23 wrote: post #88

Earlier quoted context omitted.

Do you have a good guide/video/write up on this? I’ve been putting off remaking my GPG and SSH keys using a Yubikey.

This guide [1] mostly follows the practices the previous poster outlined. [1] https://github.com/drduh/YubiKey-Guide

At https://github.com/drduh/YubiKey-Guide?tab=readme-ov-file#co..., these options are not the most secure one.

  personal-cipher-preferences CHACHA20 AES256 AES192
  personal-digest-preferences BLAKE2B SHA512 SHA384 SHA256
  personal-compress-preferences Uncompressed
  personal-aead-preferences OCB EAX
  default-preference-list BLAKE2B SHA512 SHA384 SHA256 CHACHA20 AES256 AES192 Uncompressed OCB EAX
  cert-digest-algo BLAKE2B
  s2k-digest-algo BLAKE2B
  s2k-cipher-algo CHACHA20
  s2k-count 65011712
  charset utf-8
  no-comments
  no-emit-version
  no-greeting
  keyid-format 0xlong
  list-options show-uid-validity
  verify-options show-uid-validity
  with-fingerprint
  require-cross-certification
  require-secmem
  no-symkey-cache
  armor
  use-agent
  throw-keyids
  weak-digest SHA1 RIPEMD160 MD5
  disable-cipher-algo 3DES CAST5 IDEA BLOWFISH TWOFISH CAMELLIA128 CAMELLIA192 CAMELLIA256
  disable-pubkey-algo RSA1024
  trust-model tofu+pgp
  keyserver hkps://keys.openpgp.org
  keyserver-options no-honor-keyserver-url
  keyserver-options include-revoked
  keyserver-options auto-key-retrieve
  force-mdc
  require-compliance
  compliance de-vs
These are the most secure options (correct me if I am wrong). The only drawback you may encounter is that you need GnuPG 2.3+, and some compatibility tradeoffs.

Re: Native Secure Enclave backed SSH keys on macOS

#175

Post by burnt-resistor »

This isn't such a great idea for personal SSH or GPG keys that should be locked away in physical hardware thing that need to be moved to other devices/machines. What security processors are great for is corporate machine, system/service, and user key management IdM/MDM processes that need secret storage.

Furthermore, with portable devices like Yubikey it's possible to create a master Certify-only GPG key where the sub Signature/Encryption/Authentication-subkeys live on the Yubikey. The encrypted C private key part with the S/E/A stubs still needs to be backed-up to some durable, versioned storage that isn't tied to one device.

Finally, use GPG for SSH. And definely avoid file-based SSH local private key management for wherever possible for anything substantial because it doesn't scale well.

Re: Native Secure Enclave backed SSH keys on macOS

#176

Post by atmosx »

larusso wrote: post #159

Ok I wished for this kind of feature for years. I started using a yubikey with an ssh key via gpg ssh-agent in 2018 or 2019. When resident ssh keys came around I switched over to FIDO2 based keys on my yubikey. The main issue with both was the fact that the default ssh setup wasn’t working anymore. One needs extra configs and more commands to get to the public key etc. Yubikey’s are great but block an USB port. And t…

I believe that in 1Passwd you can define / preselect a key per host now. So you can pinpoint key -> host. Some hosts have firewall rules that will block after X attempts were X might be low.

However the agent still has access to all your keys, obviously.

Re: Native Secure Enclave backed SSH keys on macOS

#177

Post by palata »

Nextgrid wrote: post #131
palata wrote: post #109

Earlier quoted context omitted.

> That's not meaningfully more difficult than tricking you into revealing your key file password. No, but that's meaningfully more difficult to do without an intervention from the user. Say your computer is infected, the malware won't silently do it: it will have to interact with you . And an important part is that you apparently don't have to make the key exportable: > So if that's in your threat model don't make th…

> Say your computer is infected, the malware won't silently do it: it will have to interact with you. MacOS is so needy about all kinds of fingerprint/password-related things (and has no context of secure desktop) that it is trivial for malware to simulate and no way for the user to tell whether it's genuine, so it's not a real barrier at all.

Which is why you don't have to export it.

Re: Native Secure Enclave backed SSH keys on macOS

#178

Post by palata »

__turbobrew__ wrote: post #164
palata wrote: post #109

Earlier quoted context omitted.

> That's not meaningfully more difficult than tricking you into revealing your key file password. No, but that's meaningfully more difficult to do without an intervention from the user. Say your computer is infected, the malware won't silently do it: it will have to interact with you . And an important part is that you apparently don't have to make the key exportable: > So if that's in your threat model don't make th…

I hit my touchid probably 10 times a day, seems pretty easy for me to be tricked into hitting touchid thinking that okta forgot my session or something like that.

Which is why you don't have to export it.

Re: Native Secure Enclave backed SSH keys on macOS

#179

Post by sisk »

atmosx wrote: post #176
larusso wrote: post #159

Ok I wished for this kind of feature for years. I started using a yubikey with an ssh key via gpg ssh-agent in 2018 or 2019. When resident ssh keys came around I switched over to FIDO2 based keys on my yubikey. The main issue with both was the fact that the default ssh setup wasn’t working anymore. One needs extra configs and more commands to get to the public key etc. Yubikey’s are great but block an USB port. And t…

I believe that in 1Passwd you can define / preselect a key per host now. So you can pinpoint key -> host. Some hosts have firewall rules that will block after X attempts were X might be low. However the agent still has access to all your keys, obviously.

Thanks for this info. First I'd heard of it. Here's a link for others. https://developer.1password.com/docs/ssh/bookmarks/

Re: Native Secure Enclave backed SSH keys on macOS

#180

Post by larusso »

atmosx wrote: post #176
larusso wrote: post #159

Ok I wished for this kind of feature for years. I started using a yubikey with an ssh key via gpg ssh-agent in 2018 or 2019. When resident ssh keys came around I switched over to FIDO2 based keys on my yubikey. The main issue with both was the fact that the default ssh setup wasn’t working anymore. One needs extra configs and more commands to get to the public key etc. Yubikey’s are great but block an USB port. And t…

I believe that in 1Passwd you can define / preselect a key per host now. So you can pinpoint key -> host. Some hosts have firewall rules that will block after X attempts were X might be low. However the agent still has access to all your keys, obviously.

Ah cool. I worked around by storing the public keys in my dot repo and use the identity file ssh config option for said host. Great if I don’t have to do this anymore.

Next level config madness: Use different ssh keys per GitHub org ;).

Post reply on HN