Security keys

What it is

A security key, such as a YubiKey, makes the private key inside itself and never lets it out. To sign in, you plug it in and touch it. It is the same kind of key that OpenSSH makes:

ssh-keygen -t ed25519-sk

Create one

1. Plug the security key into your Mac.
2. Open Keys, choose New Key, then Security key.
3. Give it a Name and choose Create key.
4. When the security key blinks, touch it. If it has a PIN, the app asks for it.

The new key opens in Keys. Add it to your servers as any key, with Add to a server: see SSH keys.

Show more

• Type: Automatic makes an Ed25519 key, or ECDSA when the security key cannot. You can also choose Ed25519 or ECDSA P-256.
• Ask for the PIN every time: each sign-in asks for the PIN as well as the touch.
• Store on the key: the key is also kept on the security key, to load it on another computer with ssh-keygen -K.
• Application: a name that starts with ssh:.

Sign in with it

1. Choose Use to sign in after Add to a server, or choose the key in the server's Key field.
2. Connect. When the app says Touch your security key, touch it, and type the PIN if asked.

With the SSH agent

Terminal, git and the other programs on your Mac that use ssh can sign in with the security key too.

1. In Settings, SSH agent, turn on Use Wardterm for SSH keys.
2. Next to ~/.ssh/config, choose Set up…, then Add lines. To use the agent in one terminal only, copy the line under Only in one terminal instead.
3. Under Keys offered, keep the switch of the security key on.
4. When a program asks for the key, choose Allow, then touch the security key.

With Face ID or Touch ID

A key on this device works without anything to plug in: it lives in the secure chip and you confirm with Face ID or Touch ID. In the menu of New Key it comes right after Generate key. See Keys on this device.