originally documented in this gist, but had to give some clarity since i didnt understand some steps. Below is a rewrite from claude
macOS Tahoe (26+) has built-in support for Secure Enclave-backed SSH keys via ssh-keychain.dylib. This means Touch ID-protected SSH with no third-party apps like Secretive required.
The private key is generated inside and never leaves the Secure Enclave chip. Even if someone steals your Mac, they cannot extract the key.
It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive
There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support
to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder
which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!
I’ve written a newer optimized 2026 version of this guide with a faster setup using Zinit + Starship and improved plugin loading.
This version avoids slow shell startups and works better with modern Zsh setups.
Updated guide: https://gist.github.com/n1snt/2cccc8aa5f7b645a7628d3512c70deb6
1) Filter Table
Filter is default table for iptables. So, if you don’t define you own table, you’ll be using filter table. Iptables’s filter table has the following built-in chains.
