Secretive – macOS native app to store SSH keys in the Secure Enclave
For anyone interested in a standardised&#x2F;Linux-compatible version of this, check out PKCS11 tokens. Smartcards can and do implement this spec, and if you use PKCS11, the secret is used from the token to sign an SSH login (for example), without being revealed.<p>This means the secret itself stays on the card. You can combine this with certificates if needed; the smartcard handles the authentication. Using PKCS11 tokens is supported in recent openssh versions. You can also use them for client certificate authentication in web browsers. For anyone familiar with DoD CACs, this is similar - I believe they use a particular card with a proprietary PKCS11 driver, but you can use opensc with any card running a PKCS11 applet.<p>Some refs:<p><a href="https:&#x2F;&#x2F;zerowidthjoiner.net&#x2F;2019&#x2F;01&#x2F;12&#x2F;using-ssh-public-key-authentication-with-a-smart-card" rel="nofollow">https:&#x2F;&#x2F;zerowidthjoiner.net&#x2F;2019&#x2F;01&#x2F;12&#x2F;using-ssh-public-key-...</a><p><a href="https:&#x2F;&#x2F;developers.yubico.com&#x2F;PIV&#x2F;Guides&#x2F;SSH_with_PIV_and_PKCS11.html" rel="nofollow">https:&#x2F;&#x2F;developers.yubico.com&#x2F;PIV&#x2F;Guides&#x2F;SSH_with_PIV_and_PK...</a>