Kowyo kowyo

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!

Note

I’ve written a newer optimized 2026 version of this guide with a faster setup using Zinit + Starship and improved plugin loading.

This version avoids slow shell startups and works better with modern Zsh setups.

Updated guide: https://gist.github.com/n1snt/2cccc8aa5f7b645a7628d3512c70deb6

	"""
	The most atomic way to train and run inference for a GPT in pure, dependency-free Python.
	This file is the complete algorithm.
	Everything else is just efficiency.

	@karpathy
	"""

	import os # os.path.exists
	import math # math.log, math.exp

	brew install pandoc
	brew tap homebrew/cask
	brew install --cask basictex
	eval "$(/usr/libexec/path_helper)"
	# Update $PATH to include `/usr/local/texlive/2022basic/bin/universal-darwin`
	sudo tlmgr update --self
	sudo tlmgr install texliveonfly
	sudo tlmgr install xelatex
	sudo tlmgr install adjustbox
	sudo tlmgr install tcolorbox

Kowyo kowyo

Native Secure Enclave backed ssh keys on MacOS

Note

Oh my zsh.