You don’t actually need to store Secure Enclave protected data in the enclave. Can “wrap” it with the enclave’s key and store it on your own disk.

Unwrapping it puts the private key into memory, from which it can be extracted (it’s hard, of course, but looking at the state of Intel security, everything is possible). Secure Enclave is supposed to sign with non-extractable private key without putting it into RAM.

This is not what it does though. It says the private key can't be exported, and this wouldn't be the case if it was just a regular SSH keyfile encrypted using the Enclave's key.

You can ask the Secure Enclave or a smart card to perform operations using a key pair which is generated on and never leaves the device. In the case of SSH, you can use that directly as long as your SSH client and server support that algorithm: the client advertises the key fingerprint and just passes the server’s challenge through without modification. Apple has had native support built-in for using PIV/CAC tokens for years.

For storing arbitrary sized things, you’d typically use that key pair to sign an AES key used to encrypt the actual file so your device only needs to store the comparatively small keys.

There is an API to store custom keys in the Secure Enclave. It only supports 256-bit ECC keys and the private keys cannot be read or written, only operated on by the Enclave itself.

There is no official storage limit, it seems, but one Stack Overflow answer put the number at around 400. Interestingly, there appears to be no quota system for preventing one app from using them all.

Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage

I know! But I wanted to write something very clear, and I chose the clearest word in my mind to convey my idea. That word is steeped in old tech, it so happens.

Oh and by the way, I was shopping for a cheap laptop for a non-profit this week, and I still had to be careful to pick a laptop with an SSD. Those spinning horrors are still jammed into laptop cases to this day.

Many words are like this. Music albums haven’t been actual albums for decades. Now we barely remember how a collection of songs was distributed as multiple shellac 78 RPM records stored in an album.

That's how language works. We call people "engineers" who have never and will never work on any engines.

"engineer" comes from ingenium (mind, talent) in Latin.

Engineer in most latin languages would be a completely different word to Engine (usually Motor)

engineer

/ɛndʒɪˈnɪə/

Origin:

"Middle English (denoting a designer and constructor of fortifications and weapons; formerly also as ingineer ): in early use from Old French engigneor, from medieval Latin ingeniator, from ingeniare ‘contrive, devise’, from Latin ingenium (see engine); in later use from French ingénieur or Italian ingegnere, also based on Latin ingenium, with the ending influenced by -eer."

This is also where the term 'civil engineer' comes from [1]. It was civilian-focused "engineering" of fortifications like bridges or roads. I've wondered for a while if there was any controversy around the first use of the term "electrical engineer" or "chemical engineer" like how there was with software engineering not being considered "real engineering" around 10 years ago, but I can't really find any information on that.

[1] https://www.britannica.com/technology/civil-engineering

I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?

In the old Multics papers it was just long term storage as there was no difference between segments in memory and on disk. Which we are finally starting to catch up with 50 years later.

Non Volatile Memory

Volatile Memory gets “erased” when powered off

Wait until people confuse that with NVRAM.

Accurate, and in usage in technical circles already. But I've always found it awkward, and names based on what something is not are always unsettling to me.

Then just Memory. That’s what elderly and nontechies usually call it. And it’s correct. Even more correct with always-on-computing and automatic state saving

"Stable storage", perhaps; I seem to remember the SMTP RFC uses that name.

"Drive" is probably the best option

Not sure about how much is actually available but you can generate about 1000 keypairs before it starts to throw errors at you

thanks for not saying ‘begs’.

no, the secure enclave is not available to the user as such. a few crypto primitives are exported. that’s what this uses. there have been any number of such “agents” over the last few years.