IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.
There is no way to export data out of secure enclave. You cannot write arbitrary data to secure enclave, as well as read it out.
What happen though is the ability to encrypt the data with secure enclave, store it on our own. When migrating, we decrypt with secure enclave, get back original data and re-encryp on the new device.
As far as I know, you have never been able to import or export keys from the Secure Enclave. It’s more likely that previously keys were stored in the keychain and now they are generated in the SE by default.
Yes you can make private keys that are encrypted by the secure enclave, rather than stored inside it. The "sc_auth" tool on macos has a "ssh-exportable" variant
Comments
I'm more interested by the fact that it apparently didn't work this way before Tahoe.
IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.
There is no way to export data out of secure enclave. You cannot write arbitrary data to secure enclave, as well as read it out.
What happen though is the ability to encrypt the data with secure enclave, store it on our own. When migrating, we decrypt with secure enclave, get back original data and re-encryp on the new device.
As far as I know, you have never been able to import or export keys from the Secure Enclave. It’s more likely that previously keys were stored in the keychain and now they are generated in the SE by default.
Yes you can make private keys that are encrypted by the secure enclave, rather than stored inside it. The "sc_auth" tool on macos has a "ssh-exportable" variant