Apple Secure Enclave Support

[ravenium]

Hello,

I suspect this may be a neighbor/relative of #36 , but it would be nice to implement usage of the secure enclave in order to leverage TouchID on Macs.

There is already a project that has a PoC of this, so it's definitely possible.

Basically, you need to use something like Secretive to stand up an ssh agent that communicates with the SE. The PoC above has a subcommand that takes the raw public key and uses it to create a cert for use with IAM Roles Anywhere.

While the actual cert creation is probably out of scope for this feature, it would be nice to have a flag/format that could tell it when a private key is in the SE (or even just via the ssh agent).

[dwmw2]

Can this be done through PKCS#11?

[ravenium]

Possibly, but I think one would have to write a PKCS11 module for the Secure Enclave and it doesn't appear that one exists at the moment (Near as I can tell).

The way the PoC appears to work is it runs sign operations through the SSH Agent (agent package in go, client) and Secretive just so happens to run its own that talks to the SE.

Most SE implementations I've seen are Swift or Objective C, but I'll keep looking!

[udf2457]

I'm no expert, only someone who has occasionally vaguely researched the topic for their own interest. But I never tried coding anything, mostly becuase I don't speak Swift or Objective C and was hoping to find a way to do it in something else (e.g. Go or Rust).

My understanding is that broadly access to Apple Secure Enclave is further segregated by developer so as to combat the possibility of one developer gaining access to another's key output. And so this is ultimately the reason for the Swift/Objective C interface because of the root-of-trust flows (i.e. code signing required).

IIRC CryptoTokenKit has integrations with both SE and Keychain and so could potentially provide an interesting bridge between SE and reuse of existing code on this project for keychain ?

There is also an alternative approach mentioned on this Apple forum post.