Protecting SSH Keys with macOS Secure Enclave

Re:Protecting SSH Keys with macOS Secure Enclave by andix on Wednesday November 11, 2026 @10:50AM (#50454826)

Windows can do this too, btw: ssh-keygen -t ed25519-sk

It uses either the TPM with Windows Hello, or an external security key.

It might require downloading a newer Microsoft openssh release to generate the keys, but the current Windows 11 ssh can use those keys.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by gravifer on Wednesday November 11, 2026 @03:22PM (#50458133)

https://github.com/unreality/nCryptAgent works quite like Secretive

https://github.com/PowerShell/Win32-OpenSSH/issues/2040 https://github.com/PowerShell/Win32-OpenSSH/issues/2408 https://github.com/PowerShell/Win32-OpenSSH/issues/2413 so there are still some quirks at the moment

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by andix on Wednesday November 11, 2026 @04:53PM (#50459212)

I guess the blog post is still relevant. But it's quite easy:

Download the newest release here: https://github.com/PowerShell/Win32-OpenSSH/releases. Just use ssh-keygen from the release to generate the key, the key itself works fine with the older ssh shipped with Windows.

Some hardware features must be present for it to work. But I guess all (or most) Windows 11 compatible devices will do fine.

[ Parent | on HN ]