Native macOS Secure Enclave SSH keys work but feel awkward
Original title: Protecting SSH Keys with macOS Secure Enclave
The author rejected that built-in workflow after also weighing Secretive, YubiKey, and password-manager agents.
A developer describes keeping SSH private keys out of the home directory by using the Mac Secure Enclave, supported since macOS Sequoia. The native path creates a non-exportable P-256 key and has the enclave sign challenges after Touch ID approval. The author says the setup works but is too awkward to adopt, and also considered Secretive, a YubiKey, 1Password, and Bitwarden.
Unconfirmed: The post is cut off before the author finishes the SSH client configuration.
- The on-disk files are references, not an extractable private key.
- Touch ID enrollment had to be redone before key creation succeeded.
- ssh-add -K is deprecated and does not load these CryptoTokenKit keys.
- SSH did not automatically offer the generated id_ecdsa_sk_rk key.
- The listed key handle was valid through January 26, 2027.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | a71277f0bc5825a7b3576d014f31282a866ef3bc | lic Key Hash Prot Label Common Name Valid To Valid p-256-ne A71277F0BC5825A7B3576D014F31282A866EF3BC bio ssh-MacBook ssh-MacBook 2027-01-26, 10:18 YES Step 2: E |
From the original article
6 min read at gatezh.com
I’ve been paranoid about my SSH keys for a while now. They just sit there in ~/. ssh/ , protected by nothing but file permissions.
By js2 · gatezh.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.