I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be exploited, when generating ssh-key's on a macbookpro with T2-Secure Enclave:

sekey (cli-tool which utilizes touch-id to generate and store ssh-keys within MacBook-Pros that posses TouchID functionality. - hasn't been updated since february - neither does it have any mention of the new T2 implementation. sekey - github repo

Install gpg & gpg-agent with homebrew and continue make use of ssh merely thru the gpg smart card functionality on an old Yubikey 4 which i already own(though it will require an additional usb-c adapter [#living the dongle life sux])

Provision the smartcard with yubico-piv-tool, install opensc and switch from ssh'ing with gpg rsa enabled 4096 bit keys to pkcs11 module (im assuming that these could make use of ECC p384 PIV Cert generated by either the CLI or GUI version of yubico-piv-tool )

Password-encrypted, ssh-keygen -o -a 500 -t ed25519 keys stored within the mac's home dir; -- added to ssh-agent and maybe macOS keychain (ssh-add -K(however i'm not keen on storing the password within the keychain ))

(Despite my own personal opinion that keys stored within a separate hw should infact prove harder to be compromised; rather than 'having all eggs stored within the same basket')

I've gone thru the documentation of T2-Secure Enclave seeeveralll times; checked HN, reddit and possibly every other security blogs/resources which make reference to the new T2-Chip, TouchID enabled mac's and, whatnot (most of them just suggest using sekey...), however no one seems to give a clear explanation on **WHY**

the whole point of messing around with the T2-Chip kinda makes me uncomfortable (especially since i've already tried sekey and issuing 'brew zap sekey' or 'brew uninstall --force sekey' both yield a bunch of errors; which i believe are related to apple enforcing T2 as something that goes beyond regular TPM).

so my question is which protocol to go with and why...

Also, there's a never ending, geek-like, consumerism inspired voice inside my head which keeps telling me to scrap the whole thing and get myself a couple of new USB-C enabled Yubikey 5 devices(who supposedly provide support for WebAuthn, FIDO2 and some other stuff...)


also i've been thinking about running a dedicated Vault Instance and trying out a NitroKey...

  • WTF?! No one's got any info? – F M Aug 24 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.