it's SE limitation :(. also makes me sad, will be awesome if you can import a key generated by yourself. so if you reinstall you can import again to the enclave

It's common for hardware security tokens like this to limit themselves to self-generated private keys. The intent is the device needs to provide a guarantee that the private key is not otherwise accessible, whereas it would be if the user generated it, perhaps wrote it to disk, provided it to the SE, and perhaps SEs on other devices.

YubiKeys allow you to load your own private key, which turned out to be a great feature. [0]

[0]: https://www.yubico.com/support/security-advisories/ysa-2017-...

I was thinking more in terms of: I trust openssl to generate a non-broken key. (Yeah, even with all its faults...) But if SE turns out to use generate bad keys, like the recent popular issue, I can't use a better one instead.

You can wrap your private keys with the SE key, though! The same way you might wrap your SSH keys with a password.

Is there a way to back up your keys? If not it could be a problem to lose your laptop.

This shouldn't be a problem. Backing up a securely stored key is not a great solution. Instead you can generate a backup key that you provision everywhere as well, (the public part) but store completely offline.

Basically treat this the same as you would a physical 2fa token.

I'm thinking more about whether this could be used to store cryptocurrency keys, in place of a hardware wallet. It's a different elliptic curve (according to another HN commenter recently) but that's not necessarily a deal killer forever.

Without an export it could maybe be one key in a multisig.

I may be talking shit, but for what I understand of SE, it wouldn't make sense to loose the data if you reinstall macOS.

I tried to look up the info, but the only thing I found was this: "But because its backing storage is physically part of the Secure Enclave, you can never inspect the key’s data."

https://developer.apple.com/documentation/security/certifica...

That means that it get stored in SE instead of your computer's hard drive. Also, Apple have instructions to clean Secure Enclave if you're going to sell your macbook pro with touchid.

It's a design detail. You can't have a "secure enclave" if it accepts external private keys.

That's also why it only generates one kind of key. It's a black box that spits out public keys.

Secure enclave is just Apple's name for a secure cryptoprocessor implementation. Some other implementations are happy to accept your private key generated outside of the system.