Protecting SSH Keys with macOS Secure Enclave
The gist
Researchers documented ways to keep Mac SSH keys inside the Secure Enclave, unlocked by Touch ID.
Keys can't be backed up or moved, so a lost Mac means starting over.
How it unfolded
- Jan 2, 2026Korben reports that independent researcher Arian van Putten documented macOS's built-in Secure Enclave SSH feature, which lets OpenSSH reach the chip through Apple's CryptoTokenKit API.
- Oct 5, 2026Six Colors reports on using Secretive, an open-source tool by Max Goedjen and others, to store SSH keys in the Mac's Secure Enclave; on macOS Tahoe and later it can create post-quantum MLDSA-65 and MLDSA-87 keys.
- recentlySerge Gatezh documents the native route: create a key with sc_auth, export a key handle with ssh-keygen, and point SSH_SK_PROVIDER at the system library.
Key terms
- SSH keys
- Cryptographic credentials used to authenticate a client to a server over the Secure Shell protocol.
- Secure Enclave
- A secure area within a main processor that protects the confidentiality and integrity of the code and data inside it.
- OpenSSH
- A suite of secure networking utilities based on the SSH protocol that provides encrypted communication over insecure networks.
Source: Wikipedia