Secure Enclave-backed SSH keys (until FIDO2, see #1334)

[GuillaumeHullin]

From my view point FIDO2 (#1334) is the right long-term answer however Apple's Secure Enclave gets us most of the benefit as private key never leaves the chip... maybe easier to implement than YubiKey support for iOS and iPadOS?

Would it be possible to generate ecdsa-sha2-nistp256 keys inside the Secure Enclave and assign it to servers.
Of course, it would be device-bound so no iCloud sync.

I clearly took that idea from Termius ;)

[isontheline]

Yeah you're right

My main concern for both SE and FIDO is that I need to change the underlying library used to establish connections.

That's planned but I don't have an ETA yet

[GuillaumeHullin]

Oh I see :) it's that deep of a change. Yeah, I understand why you don't want to rush it :)
Thanks anyway for your work

[isontheline]

I want to rush, truly ;)

But as a "one man maker" I don't have - yet - the ability to put a date on it

Hope you will stay on WebSSH though