Finally, a way to lock your SSH keys in Apple's digital vault

A developer explains their journey to secure SSH keys using macOS's built-in hardware security features. The article explores storing private SSH keys in the macOS Secure Enclave—a dedicated security chip on Apple Silicon Macs—so the keys are generated within and never leave this isolated hardware. This approach contrasts with software-only solutions like password managers or third-party apps where keys, while encrypted at rest, are decrypted in memory during use.

The goal is to achieve true hardware-backed security, making private keys impossible to extract even if the Mac is fully compromised. When connecting via SSH, the Secure Enclave signs the authentication challenge internally, with optional Touch ID confirmation for each operation. The piece serves as a practical guide for engineers seeking to move beyond basic file permissions for critical credentials, emphasizing that the best security often leverages the specialized hardware already in your device.