Native Secure Enclave backed SSH keys on macOS • Hacker News Board

Re: Native Secure Enclave backed SSH keys on macOS

#201

Post by johnisgood » Wed, Nov 26, 2025, 7:44 AM UTC

johnisgood wrote: post #174

atrettel wrote: post #145

Earlier quoted context omitted.

This guide [1] mostly follows the practices the previous poster outlined. [1] https://github.com/drduh/YubiKey-Guide

At https://github.com/drduh/YubiKey-Guide?tab=readme-ov-file#co... , these options are not the most secure one. personal-cipher-preferences CHACHA20 AES256 AES192 personal-digest-preferences BLAKE2B SHA512 SHA384 SHA256 personal-compress-preferences Uncompressed personal-aead-preferences OCB EAX default-preference-list BLAKE2B SHA512 SHA384 SHA256 CHACHA20 AES256 AES192 Uncompressed OCB EAX cert-digest-algo BLAKE2B s…

On second thought, you may want to remove this line:

  compliance de-vs

Because DE-VS only recognizes AES/3DES for ciphers and SHA-2 for digests; conflicts with CHACHA20 and BLAKE2B and will reject operations using these algorithms.

Re: Native Secure Enclave backed SSH keys on macOS

#202

Post by morshu9001 » Wed, Nov 26, 2025, 5:09 PM UTC

morshu9001 wrote: post #186

yjftsjthsd-h wrote: post #142

Earlier quoted context omitted.

I would argue that doing both of those is still less work than maintaining authorized_keys in many places.

Yes, also idk if the other way works with Secure Enclave

oops replied to wrong comment

Re: Native Secure Enclave backed SSH keys on macOS

#203

Post by morshu9001 » Wed, Nov 26, 2025, 5:12 PM UTC

jedberg wrote: post #34

cedws wrote: post #31

Earlier quoted context omitted.

You're not really supposed to 'export' keys. Any time you move a key you risk exposing it. The idea of PKI is that only public keys move, the private key stays in one place, ideally never seen.

I've been in the security space for 25 years, and understand the theory of PKI. But I've also been in the ops space for 30 years, and understand that if you don't balance security theory with operational practice, critical business functions can fail. Ideally yes, the private key is never seen. In reality, it needs to be backed up in a secure place so it can be restored in the event of a failure.

This was a thing with Google Authenticator. People kept asking how to back up or transfer keys, official answer was you can't and WAI. Eventually they conceded and added a backup option, but it was still confusing. I think this ruined the entire reputation of TOTP.

Re: Native Secure Enclave backed SSH keys on macOS

#204

Post by morshu9001 » Wed, Nov 26, 2025, 5:15 PM UTC

yjftsjthsd-h wrote: post #81

morshu9001 wrote: post #64

Earlier quoted context omitted.

Yeah but if you get a new device, you have to go add its pubkey to every server you ever use. I wish there were an easier way, otherwise it's understandable that people copy privkeys.

There is an easier way: Create a SSH CA, add that to your authorized_keys everywhere, use it to sign the individual public keys.

That's good but more complicated, and not everything supports it. Like on GitHub, SSH CA requires subscribing to their enterprise service.

Also idk if you can store the root or the resulting signed key in the enclave the way this article says.