Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Why would you want the private key file if you store it within the secure enclave?




Probably for the same reason that OpenSSH's `sk` implementation also still needs a private key file (even for the "resident key" option): You need to be able to point OpenSSH's various tools to something in an identity context, and that something traditionally is a private key file.

The article even mentions that it doesn't contain any sensitive data:

> Note that the "private" key here is just a reference to the FIDO credential. It does not contain any secret key material.

It's a slightly different story for non-resident `sk`-backed keys; these actually require the private key file since the hardware authenticator itself is (or at least can be) stateless. (It's still not a security risk if it ever leaks, but it's an availability risk if it's ever lost.)

Not sure if macOS's backing implementation is stateful or stateless (or some unfortunate hybrid of both; i.e., it might just store a stateful wrapped key in some system-level keychain in a way that intransparently breaks if the OS is ever reinstalled, but also doesn't allow querying an intact system for any existing credentials).


Thanks I missed this in the description.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: