Protecting SSH Keys with macOS Secure Enclave

Re:Protecting SSH Keys with macOS Secure Enclave by computerfriend on Wednesday November 11, 2026 @02:51AM (#50450786)

I wish there was a way to cache the touch. As it stands, this is mostly unusable for commit signing in a rebase-heavy workflow.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by szenrom on Wednesday November 11, 2026 @03:19AM (#50450922)

In case you want to just have an encrypted SSH key with password in keychain, you can make it work automatically when logged in (and when Mac is unlocked) by putting in .ssh/config:

  Host github.com
    AddKeysToAgent yes
    UseKeychain yes
    IdentityFile ~/.ssh/id_ed25519

Docs: https://docs.github.com/en/authentication/connecting-to-gith...

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by LtWorf on Wednesday November 11, 2026 @07:15AM (#50452537)

Normally with gpg agent that leaves the key unlocked it is not a problem.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by andelink on Wednesday November 11, 2026 @10:26PM (#50462685)

I use [1] ssh config ControlPersist for 10m to enable something like this:

    Host *
        IdentityAgent ~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
        IdentitiesOnly yes
        ControlMaster auto
        ControlPersist 10m
        ControlPath ~/.ssh/sockets/%r@%k:%p

[1] https://github.com/maxgoedjen/secretive/issues/531#issuecomm...

[ Parent | on HN ]