Protecting SSH Keys with macOS Secure Enclave

Re:Protecting SSH Keys with macOS Secure Enclave by jwr on Wednesday November 11, 2026 @07:58AM (#50452858)

I decided years ago that I want to protect my keys with a hardware device that is independent of the vendor of the machine that I'm currently using. I also want to have backup keys and I want to be able to freely move them around various physical locations. Or have a backup shipped to me across the world if necessary.

YubiKeys were the only solution that fit these requirements, so I went with those. I have been using them for the last ten years or so and I've been very happy with this solution. See https://github.com/drduh/YubiKey-Guide for a description of how to make your RSA keys stored on YubiKeys work with GPG and SSH at the same time.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by andix on Wednesday November 11, 2026 @10:54AM (#50454868)

The other option is to have device-bound keys and a script to sync them to all ssh servers you want to access.

Relying on a small set of ssh keys for a longer time is anyway not that great, it's best to have some mechanism to cycle them.

I wouldn't use any automated sync tool for that, just a script that ssh's into all the servers and replaces/edits authorized_keys if something changes.

I would never use something like this (https://github.com/shoenig/ssh-key-sync). It basically gives Github or someone who compromised Github access to all your systems.

[ Parent | on HN ]