MacOS Tahoe Adds Native Support for Secure Enclave SSH Keys
By
arianvanp
Crisp on the outside, thoughtful on the inside. A keeper.
Summary
MacOS Tahoe now supports generating and using secure-enclave backed SSH keys natively, replacing third-party solutions like Secretive. The system's shared library /usr/lib/ssh-keychain.dylib, which traditionally provided smartcard support via PKCS11Provider interface, now also implements SecurityKeyProvider interface. This allows SSH keys to be loaded directly from the Mac's secure enclave hardware, similar to how FIDO2 devices like Yubikeys work, providing enhanced security for SSH authentication without external hardware.
Key quotes
· 5 pulledIt turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys!
This replaces projects like https://github.com/maxgoedjen/secretive
There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface.
However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave!
SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to the secure enclave.
You might also wanna read
North Korean Chollima Group Targets PHP Developers via Malicious Packagist Package
A malicious obfuscated JavaScript payload was discovered appended to tailwind.js in the Packagist development version dev-drewroberts/featur
socket.dev·3h ago
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
npm malware targeting Claude users leaks own GitHub token, reaches 676 downloads
An npm package called "mouse5212-super-formatter" targeting Claude users acted as information-stealing malware, reaching 676 downloads befor
theregister.com·1d ago
Attacker publishes 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A single npm user published 14 malicious packages over four hours, impersonating popular OpenSearch, Elasticsearch, DevOps, and environment-
briefly.co·2d ago
Extending Wazuh Detection with Clickdetect, OpenSearch PPL, and Sigma Rules
This blog post by "souzo" introduces clickdetect, a repository/tool designed to extend Wazuh's detection capabilities by integrating with Op
infosecwriteups.com·3d ago
FuzzingBrain V2: Multi-Agent LLM System Achieves 90% Vulnerability Detection Rate and Discovers 29 Zero-Day Flaws
FuzzingBrain V2 is a multi-agent LLM system for automated vulnerability discovery and reproduction in software. It addresses three key chall
arxiv.org·4d ago