Re:Protecting SSH Keys with macOS Secure Enclave
by tonymet on Wednesday November 11, 2026 @01:25PM
(#50456711)
it’s a worthy experiment but I wouldn’t want hobbyists making life miserable for the rest of us.
There’s no reason the private key needs to be stored in Secure Enclave. Your passkeys are in the MacOS Keychain, encrypted using the Secure Enclave. They are decrypted when iCloud transfers them to a new machine.
A similar protocol could be used with ssh keys. Keep the keys on disk as usual, making them easy to back up. Encrypt them using the enclave. You can use the Secure Enclave to decrypt the key for backing up (with a backup-specific secret).
This way all of the protocols and tooling remains the same, except for obtaining the SSH key encryption secret from Secure Enclave. Backup, ssh login, ssh agent all use the same keys.
Do what Apple does. Making the process more difficult actually makes security worse.
There’s no reason the private key needs to be stored in Secure Enclave. Your passkeys are in the MacOS Keychain, encrypted using the Secure Enclave. They are decrypted when iCloud transfers them to a new machine.
A similar protocol could be used with ssh keys. Keep the keys on disk as usual, making them easy to back up. Encrypt them using the enclave. You can use the Secure Enclave to decrypt the key for backing up (with a backup-specific secret).
This way all of the protocols and tooling remains the same, except for obtaining the SSH key encryption secret from Secure Enclave. Backup, ssh login, ssh agent all use the same keys.
Do what Apple does. Making the process more difficult actually makes security worse.