Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secretive – macOS native app to store SSH keys in the Secure Enclave

github.com

Post reply on HN
Print view View original

41–50 of 109 posts

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#41

Post by mfontani »

Metus wrote: post #8

For anyone not aware, you can use macOS's keychain to store ssh key passwords and have them unlock at login. This way you can have the benefits and convenience of password managers in the command line for SSH certificates. https://apple.stackexchange.com/questions/48502/how-can-i-pe...

Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)?

> You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.

That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is that okay?"

If I'm git pushing, that's fine. If I just connected to a random server... that's not okay. What is that trying to do? Deny.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#42

Post by techslave »

philistine wrote: post #2

Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for example.

thanks for not saying ‘begs’.

no, the secure enclave is not available to the user as such. a few crypto primitives are exported. that’s what this uses. there have been any number of such “agents” over the last few years.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#44

Post by trasz »

epistasis wrote: post #6
bdcravens wrote: post #4

Earlier quoted context omitted.

Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage

I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?

"Stable storage", perhaps; I seem to remember the SMTP RFC uses that name.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#45

Post by comex »

zymhan wrote: post #27
pqdbr wrote: post #22

Earlier quoted context omitted.

By "you just use multiple", you mean I would have to generate extra private keys, add them to authorized_keys, and store them somewhere other than my mac, right? Because just by using multiple keys I would still be locked out if all of them were stored in this 'Secretive' app.

If you only have a single SSH key as the only method of authenticating somewhere, you already have a dangerous single point of failure.

Not if you have multiple copies of the private key. But yes, there are advantages to having any given key only exist in one place.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#46

Post by GekkePrutser »

pqdbr wrote: post #22
_abox wrote: post #14

Earlier quoted context omitted.

Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file. This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can onl…

By "you just use multiple", you mean I would have to generate extra private keys, add them to authorized_keys, and store them somewhere other than my mac, right? Because just by using multiple keys I would still be locked out if all of them were stored in this 'Secretive' app.

Well, not exactly, I use multiple physical keys. Yubikeys and OpenPGP smartcards in my case. I use multiple different types too (the OpenPGP cards are quite cheap too).

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#47

Post by GekkePrutser »

jooize wrote: post #18
_abox wrote: post #14

Earlier quoted context omitted.

Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file. This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can onl…

Is there a convenient way to manage and maintain those keys? Keeping the public key of each device and easily select which ones to place on servers.

Very good question. I've been thinking about a central way to manage keys. There doesn't really seem to be one, and it would be a big point of attack because an attacker might abuse it to add their own key.

Right now what I do is I just log into my servers and copy the list :P I don't have that many anyway.

The openssh people are also advocating certificates now, which means you'll have to set up a PKI, which will take care of revocation and such.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#48

Post by Metus »

mfontani wrote: post #41
Metus wrote: post #8

For anyone not aware, you can use macOS's keychain to store ssh key passwords and have them unlock at login. This way you can have the benefits and convenience of password managers in the command line for SSH certificates. https://apple.stackexchange.com/questions/48502/how-can-i-pe...

Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)? > You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is th…

After researching this for a while, it seems there is no documented, native option to do this. The only option is to unlock all SSH keys all the time, which makes them less secure than the passwords for websites managed by the exact same keychain. Which, in my opinion, is weird.

Do they employees at Apple use a different system altogether? Because the built-in one doesn't seem very secure. Or maybe I am using it wrong, who knows.

In a similar vein, is there an exhaustive manual for macOS? It bugs me that Apple machines cost a small fortune, the OS is full of nifty features, but there is no non-superficial manual shipped with it.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#49

Post by XMPPwocky »

mfontani wrote: post #41
Metus wrote: post #8

For anyone not aware, you can use macOS's keychain to store ssh key passwords and have them unlock at login. This way you can have the benefits and convenience of password managers in the command line for SSH certificates. https://apple.stackexchange.com/questions/48502/how-can-i-pe...

Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)? > You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is th…

To be clear, that would be a privacy issue (a malicious server could tell what keys you have), but wouldn't allow a malicious server to log in to anything else with your keys. You don't send the private key when you log in.

Re: Secretive – macOS native app to store SSH keys in the Secure Enclave

#50

Post by foolmeonce »

g_p wrote: post #32

For anyone interested in a standardised/Linux-compatible version of this, check out PKCS11 tokens. Smartcards can and do implement this spec, and if you use PKCS11, the secret is used from the token to sign an SSH login (for example), without being revealed. This means the secret itself stays on the card. You can combine this with certificates if needed; the smartcard handles the authentication. Using PKCS11 tokens i…

This works ok and is the best option at the moment, but as more systems upgrade to newer versions I think the Fido/U2F support is probably going to take over. It's nice to not have anything key specific, any initialization steps, and so on.
Post reply on HN