Protecting SSH Keys with macOS Secure Enclave

Re:Protecting SSH Keys with macOS Secure Enclave by briHass on Wednesday November 11, 2026 @12:09PM (#50455782)

Not sure how it works on macos, but on Windows the downside of agents using TPM backed Windows Hello keys (sk) is that the session can't be reused for scp/sftp and agents like to do one-action scripts, so you're doing the user presence pin/finger multiple times for each ssh command it executes.

I've started building a timeout-based ssh-agent population utility, but if I'm honest, TPM keys without user presence is probably sufficient.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by jon-wood on Thursday November 12, 2026 @05:50AM (#50465473)

Set the following in your SSH config, which will cause SSH to establish a single control channel when it first opens a connection to a host and maintain it until there's been 10 minutes of inactivity. That way the first connection requires auth for your SSH agent but it can then be reused for things like SFTP channels or opening another terminal.

  Host \*
    controlMaster auto
    controlPath ~/.ssh/master-%r@%n:%p
    controlPersist 10m

[ Parent | on HN ]