Protecting SSH Keys with macOS Secure Enclave

Re:Protecting SSH Keys with macOS Secure Enclave by what on Wednesday November 11, 2026 @01:31PM (#50456770)

> it can just execute your remote stuff on its own

Presumably biometrics are required to use the key, so they have to convince you to prove presence when you aren’t expecting it?

> Or it can get the key by MitMing you by making your next "ssh" invocation steal your passphrase

What passphrase?

> or just read the unencrypted key out of the ssh process

The key never leaves the SE, so this is not possible.

> or even just reimplement ssh to do the SE negotiation on its own

See first point and biometrics.

[ Parent | on HN ]

Re:Protecting SSH Keys with macOS Secure Enclave by ajross on Wednesday November 11, 2026 @01:34PM (#50456819)

So, rather than argue the minutiae, let me rephrase: an article explaining a SE-based SSH key storage paradigm that was provably resistant to an attacker able to run code locally as the user would be an extremely interesting blog post to read.

This one is not that, and doesn't even seem aware of the complexities. Have a link?

[ Parent | on HN ]