Blog moves SSH keys onto YubiKey, TPM and Apple Secure Enclave
Original title: I deleted all my SSH keys
Leftover disk files are handles only; private material stays in the token, TPM or enclave.
A personal post describes dropping unprotected on-disk SSH keys for hardware-backed keys. OpenSSH can enroll resident ed25519-sk keys on a YubiKey 5 or newer with no extra software. TPM-backed keys use ssh-tpm-agent, which Ubuntu packages; the Apple Secure Enclave section is cut off. A no-touch YubiKey option removes presence checks and must be marked in authorized_keys.
Unconfirmed: The TPM and Apple Secure Enclave sections are incomplete in the provided text.
- The on-disk id_ed25519-sk file is a handle, not private key material.
- Default YubiKey use still requires a physical tap to confirm presence.
- no-touch-required keys need that prefix on the server or OpenSSH rejects them.
- ssh-tpm-agent is a small Go package, natively packaged by Ubuntu.
- Vendors
- Apple
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | b15235464f87ec7c8dee89bfa06399ffd6678e99 | rot Label Common Name Email Address Valid To Valid p-256-ne B15235464F87EC7C8DEE89BFA06399FFD6678E99 bio ssh-labelyourkey ssh-labelyourkey 04/11/2027, 09:29 YES |
From the original article
9 min read at blog.infected.systemsI’ve been using ed25519-sk keys with YubiKeys since practically the moment they were available. But because of some specific use-cases (and because, frankly, YubiKeys are expensive) I’ve had a few traditional on-disk keys hanging around for a while just waiting for me to finally decide to get rid of them.
By blog.infected.systems via pushcx · blog.infected.systems
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.