Guide stores macOS SSH keys in the Secure Enclave with Touch ID
Original title: Setting up SSH keys on macOS with Touch ID
Non-extractable p-256-ne identities die with the Mac and must be re-registered, including on GitHub.
A October 19, 2026 post explains creating an SSH identity in the Mac Secure Enclave so the private key cannot be exported and each use can require Touch ID. The setup uses sc_auth with a p-256-ne key and biometric protection, then ssh-keychain.dylib so OpenSSH can sign without a key file on disk. The public handle, starting sk-ecdsa-sha2-nistp256, is what is added to servers such as GitHub, and the identity must be reloaded after reboot.
Unconfirmed: Much of the CryptoTokenKit behavior is undocumented and inferred by the author from manuals and tests.
- Accepted key types include p-256, p-384, p-521 and non-extractable -ne variants.
- OpenSSH does not support the p-384 curve, so the post uses p-256-ne.
- Protection bio prompts for Touch ID; none still keeps the key non-extractable.
- ssh-add -K -S must be run again after a reboot.
- If the Mac is lost, the identity cannot be recovered and must be recreated.
- 1.Create a non-extractable Secure Enclave SSH identity with biometric protection if replacing file-based keys.
- Vendors
- Apple
- Products
- macOSSecure EnclaveOpenSSH
- Organizations
- GitHub
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 458f712f281b53c683f23fc02e69d44dafdaa3de | ctk-identities Key Type Public Key Hash Prot Label p-256-ne 458F712F281B53C683F23FC02E69D44DAFDAA3DE bio ssh-key If you followed along in the Quick Setup , you |
From the original article
9 min read at nmattia.com
In the first part of this post I’ll show a simple, secure way to create an SSH key on Mac (it’s 3 commands, including support for GitHub). In the second part I’ll dig deeper and explain what’s actually happening for the curious reader. Macs have a built-in so-called Secure Enclave , where we can create “identities” that simply cannot be stolen (unless maybe you’ve made enemies with a nation state).
By nmattia.com by nmattia · nmattia.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.