Secretive: Store SSH Keys in the Secure Enclave

Re:Secretive: Store SSH Keys in the Secure Enclave by nixpulvis on Friday March 10, 2023 @08:39AM (#35094171)

Ahhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly.

I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc...

Thanks for the top though :)

[ Parent | on HN ]

Re:Secretive: Store SSH Keys in the Secure Enclave by ratorx on Friday March 10, 2023 @08:46AM (#35094243)

I’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.

[ Parent | on HN ]

Re:Secretive: Store SSH Keys in the Secure Enclave by TacticalCoder on Friday March 10, 2023 @10:13AM (#35095314)

> I was kinda hoping to avoid storing the private key on the local machine at all.

I may be misunderstanding but I use U2F with OpenSSH (8.3). The private key is not on the local machine. It's still SSH public/private key pair but the private key on the computer is only a "key handle", not the real private key. The private key is protected on the security key. I don't mind copying that private key around: although it looks like a private key, it's just a key handle and not the actual private key.

[ Parent | on HN ]

Re:Secretive: Store SSH Keys in the Secure Enclave by nixpulvis on Friday March 10, 2023 @11:29AM (#35096594)

Good point. I'm not being precise, sorry.

Still, I'm trying to avoid leaving so many breadcrumbs on my systems if they aren't needed.

[ Parent | on HN ]

Re:Secretive: Store SSH Keys in the Secure Enclave by phaer on Friday March 10, 2023 @05:32PM (#35102170)

Not using SSH resident keys myself yet, but you also require key identifiers for your gpg keys on the local machine if you use yubikeys with gpg afaik.

[ Parent | on HN ]

Re:Secretive: Store SSH Keys in the Secure Enclave by nixpulvis on Friday March 10, 2023 @11:32AM (#35096644)

Ugh, now I'm having the dreaded ERROR: Failed to connect to YubiKey when running ykman fido info. :(

[ Parent | on HN ]