Protecting SSH Keys with macOS Secure Enclave

Protecting SSH keys on macOS has become a priority for many users due to security concerns. Storing keys in a simple directory like ~/.ssh/ with just file permissions is not enough as malicious scripts could copy them. Switching to solutions like 1Password or Bitwarden, while encrypting keys at rest, still requires decrypting in memory, and hardware-backed security is desired.

The native macOS Secure Enclave provides an isolated security subsystem on the Mac's chip, creating a private key that never leaves it. When SSHing, the Mac asks the Secure Enclave to sign the challenge, requiring Touch ID approval. This key doesn't exist in memory or on disk, making it nearly impossible to extract even if the Mac is compromised.

To set up a Secure Enclave SSH key, commands like `ssh-add -K` are deprecated. Instead, the `SSH_SK_PROVIDER` environment variable is used. The public key must be added to the server's authorized_keys file with a specific name, and the configuration in ~/.ssh/config must explicitly include the Secure Enclave key first.

Using Touch ID requires extra verification steps, but this visibility into key usage is considered worth the inconvenience. However, if this becomes bothersome, alternatives like Secretive offer a more user-friendly interface. The Secure Enclave keys are tied to the specific Mac, and losing the device means losing access. Therefore, it's recommended to have more than one key for redundancy and access in case of device failure.

Despite its security benefits, the UI design of Secure Enclave keys is considered unpolished and unappealing, prompting the author to explore other solutions like Secretive for a better user experience.