Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Native Secure Enclave backed SSH keys on macOS

gist.github.com

Post reply on HN
Print view View original

181–190 of 204 posts

Re: Native Secure Enclave backed SSH keys on macOS

#181

Post by jwr »

This is a good moment to remind everyone of this excellent guide: https://github.com/drduh/YubiKey-Guide

it describes how to use your YubiKeys (please always use at least two, so that you have a backup) for GnuPG keys and SSH.

I've been using this setup since 2018 and it is brilliant. I know GnuPG is not in fashion these days, but thanks to this setup I have SSH logins using YubiKeys, encrypted backups using GnuPG, and 2-factor authentication for a number of sites that support Webauthn. All with backup keys, which is IMPORTANT: do not get locked into using a single device, because sooner or later you will lose that device or it will suddenly die.

Re: Native Secure Enclave backed SSH keys on macOS

#182

Post by jwr »

nothrabannosir wrote: post #32
comprev wrote: post #17

Earlier quoted context omitted.

Inability to export the private key is no different from using an YubiKey? You can't "backup" the private key they generate either.

Which makes yubikey impossible to use with geographically distributed backups. You need the backup available at all times for when you want to register with any new service. This is why you should use a device which allows exporting the seed, like e.g. multi purpose hardware crypto wallets.

Not true. If you use YubiKeys to store your GPG key, it's not a problem. You can have multiple YubiKeys with the same private key, or you can encrypt to multiple recipients.

Re: Native Secure Enclave backed SSH keys on macOS

#183

Post by wink »

johnisgood wrote: post #26
comprev wrote: post #17

Earlier quoted context omitted.

Inability to export the private key is no different from using an YubiKey? You can't "backup" the private key they generate either.

Yeah, that is why you should not [always (depends on your use case)] generate it on a YubiKey. You need to have: - an offline master private key backup (air-gapped) - primary YubiKey (daily use) - backup YubiKey (locked away) - revocation certificate (separate storage) (it is your kill-switch) Having a second YubiKey enrolled is the standard practice. What people do wrong is: - They generate directly on YubiKey - The…

I faintly remember some service that would only let me add one YubiKey, taking the 2 in 2FA very literal.

Re: Native Secure Enclave backed SSH keys on macOS

#184

Post by Nextgrid »

palata wrote: post #177
Nextgrid wrote: post #131

Earlier quoted context omitted.

> Say your computer is infected, the malware won't silently do it: it will have to interact with you. MacOS is so needy about all kinds of fingerprint/password-related things (and has no context of secure desktop) that it is trivial for malware to simulate and no way for the user to tell whether it's genuine, so it's not a real barrier at all.

Which is why you don't have to export it.

If the key is marked as exportable the malware will happily export it for you. The only way to defend against that is to make the key non-exportable to begin with.

Re: Native Secure Enclave backed SSH keys on macOS

#185

Post by vladvasiliu »

awaikour wrote: post #152
lxgr wrote: post #101

Earlier quoted context omitted.

Is there a way to import an existing (compatible) key and still mark it as non-exportable? That seems more useful for the SSH key scenario: Generate a key in memory and back it up to offline storage once, and otherwise only use it in a way totally non-exportable by any malware. This sentence > The exportable private key is encrypted with Elliptic Curve Encryption Standard Variable IVX963 algorithm which is backed by…

Another option is to generate a key and put it on an offline storage, and have a second key only in the SE. This means you'll need to upload two public keys to places to have a backup instead of one, but I think would otherwise achieve the same thing. The nice thing with this is you can keep your backup public key easily accessible. I try to keep a primary and backup Yubikey on everything important, but you have to p…

The issue with this approach is that when you change your device for whatever reason, you'll need to upload the new key everywhere.

Re: Native Secure Enclave backed SSH keys on macOS

#186

Post by morshu9001 »

yjftsjthsd-h wrote: post #142
lxgr wrote: post #107

Earlier quoted context omitted.

But now you need to worry about revocation or at least key lifetimes.

I would argue that doing both of those is still less work than maintaining authorized_keys in many places.

Yes, also idk if the other way works with Secure Enclave

Re: Native Secure Enclave backed SSH keys on macOS

#188

Post by acdha »

burnt-resistor wrote: post #175

This isn't such a great idea for personal SSH or GPG keys that should be locked away in physical hardware thing that need to be moved to other devices/machines. What security processors are great for is corporate machine, system/service, and user key management IdM/MDM processes that need secret storage. Furthermore, with portable devices like Yubikey it's possible to create a master Certify-only GPG key where the su…

> This isn't such a great idea for personal SSH or GPG keys that should be locked away in physical hardware thing that need to be moved to other devices/machines

I would change this: it’s great for personal usage BUT you should always use n>1 keys to avoid being locked out. For example, using the Secure Enclave for your daily use is fine but you’d want to have, say, a FIDO2 hardware key setup so if your laptop fails or is reset you can get into anything where you use that key.

Re: Native Secure Enclave backed SSH keys on macOS

#189

Post by lxgr »

big-and-small wrote: post #165
cyberax wrote: post #144

Earlier quoted context omitted.

No. There is no way to import an existing key into the Secure Enclave. Only Apple is allowed to do that. The best you can do is use the SE to decrypt the key and then use the clear text key for encryption/decryption. This also means that passkeys on macOS/iOS are (at some point) exposed as clear text.

> The best you can do is use the SE to decrypt the key and then use the clear text key for encryption/decryption. AFAIK this is what "secretive" was doing all the time.

I'm pretty sure it creates SE resident keys, which can't be unwrapped by either userspace or the macOS kernel.

Re: Native Secure Enclave backed SSH keys on macOS

#190

Post by acdha »

greatgib wrote: post #2

It's a total pain in the ass to try to have password encrypted gpg or ssh keys in mac. Nothing better that another way to make it even more painful and complicated, so that people will just store plain text keys to not be annoyed.

It’s been easy since the 2000s. This makes it easier to be safer than the built in SSH agent + Keychain but pure usability was a solved problem around by the turn of the century.
Post reply on HN