Secretive – macOS native app to store SSH keys in the Secure Enclave

Re:Secretive – macOS native app to store SSH keys in the Sec... by GekkePrutser on Saturday June 27, 2020 @05:02PM (#23664666)

Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file.

This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can only prove you have it by using it to sign or encrypt something.

This is very different from SSH keyfiles on disk which can be stolen in many ways, and as such can be compromised without you ever knowing about it.

It's really cool that we can now use this functionality for SSH too. I currently use Yubikeys in OpenPGP mode for this but I might switch to this once I get a T2-enabled Mac.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by folmar on Saturday June 27, 2020 @07:29PM (#23665547)

"now" is at least 16 years now (with PKCS11 and opensc)

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by pqdbr on Saturday June 27, 2020 @05:13PM (#23664729)

By "you just use multiple", you mean I would have to generate extra private keys, add them to authorized_keys, and store them somewhere other than my mac, right?

Because just by using multiple keys I would still be locked out if all of them were stored in this 'Secretive' app.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by zymhan on Saturday June 27, 2020 @05:17PM (#23664762)

If you only have a single SSH key as the only method of authenticating somewhere, you already have a dangerous single point of failure.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by comex on Saturday June 27, 2020 @06:55PM (#23665350)

Not if you have multiple copies of the private key. But yes, there are advantages to having any given key only exist in one place.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by NovemberWhiskey on Saturday June 27, 2020 @08:36PM (#23665866)

If you are making multiple copies of a private key in different places, why wouldn't you just keep a different private key in each of those places along with its corresponding public key though?

That way, you can remove trust from just one of them if you (e.g.) have your computer stolen.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by GekkePrutser on Saturday June 27, 2020 @06:57PM (#23665356)

Well, not exactly, I use multiple physical keys. Yubikeys and OpenPGP smartcards in my case. I use multiple different types too (the OpenPGP cards are quite cheap too).

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by jooize on Saturday June 27, 2020 @05:08PM (#23664688)

Is there a convenient way to manage and maintain those keys? Keeping the public key of each device and easily select which ones to place on servers.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by GekkePrutser on Saturday June 27, 2020 @06:59PM (#23665379)

Very good question. I've been thinking about a central way to manage keys. There doesn't really seem to be one, and it would be a big point of attack because an attacker might abuse it to add their own key.

Right now what I do is I just log into my servers and copy the list :P I don't have that many anyway.

The openssh people are also advocating certificates now, which means you'll have to set up a PKI, which will take care of revocation and such.

[ Parent | on HN ]

Re:Secretive – macOS native app to store SSH keys in the Sec... by acdha on Saturday June 27, 2020 @05:15PM (#23664741)

In the case of SSH keys, when you export the key fingerprint you can edit the comment. I like the convention of email address & hostname to disambiguate the entries in a centrally-managed authorized keys list – when you get a new device, update the list and push the new version out.

[ Parent | on HN ]