Secretive: An app for storing and managing SSH keys in the Secure Enclave | Hacker News Reader

Secretive: An app for storing and managing SSH keys in the Secure Enclave

github.com

48 pointstosh11 comments

These types of programs have gone through a few iterations since the secure enclave was released, but they all share a fatal flaw, probably from the SE itself:

You can only store keys that use the NIST P curves, which are not recommended for SSH, or any serious crypto. There are serious supicions that they were tampered with during design by NSA, and are listed in djb's https://safecurves.cr.yp.to/ as unsafe. Using this program would force you to configure your server to accept keys using unsafe curves.

Is it a bad idea to store ssh keys in a password manager like Bitwarden? If yes, what other easily portable options are out there?

Yubikey would probably be a better alternative.

Any idea how to set my YubiKey up to handle this?

If all the servers you talk to are up to date enough to accept SK keys, I would use one:

https://www.yubico.com/blog/github-now-supports-ssh-security...

I can recommend this guide [1] to setup your yubikey with gpg, which allows you to both use it to sign or encrypt with gpg and also to use it as an ssh key.

[1] https://github.com/drduh/YubiKey-Guide

The readme specifically mentions Yubikey support. Given the restrictions with Secure Enclave (no import, export, or backup), a smart card or Yubikey probably would be better.

Better than having then unencrypted (unless you set a passphrase) on the filesystem for every rogue process to grab. The issue with password managers is the key is then most likely still accessible from other processes while the password manager is unlocked. On linux for example by poking around in /dev/mem or /dev/kmem. There are way that help with that like memfd_secret. A secure enclave or similar side processor avoids this issue by running within its own isolated memory and this processor also handles all key operations, so the key never enters the main memory.

Looks like this is only for Macs with Secure Enclaves. Does Apple's own Keychain app not do this? I would have thought that would utilize Secure Enclave too.

Yeah I’m not sure why we wouldn’t just store it in the keychain. Maybe best to implement ssh-agent to look at the keychain?

That’s why /proc isn’t mounted as readable.

Problem solved, oh oops sorry systemd.

Reply on news.ycombinator.com