HN Showcase
Back to browse
Sod – Touch ID-Backed SSH Keys Using the Secure Enclave

Sod – Touch ID-Backed SSH Keys Using the Secure Enclave

by botanica_labs·Jun 30, 2026·1 point·0 comments
Visit ProjectView on HN

AI Analysis

●●●BangerWizardrySolve My Problem

Touch ID for SSH using Secure Enclave—keys can't be stolen even if disk is compromised.

Strengths
  • •Unexportable keys in Secure Enclave prevent theft even with disk access
  • •Zero server-side changes required, works with any OpenSSH server
  • •Minimal Swift codebase with zero external dependencies
Weaknesses
  • •macOS-only, no cross-platform support for Linux or Windows
  • •Requires Apple hardware with Secure Enclave chip
Category
Security
Target Audience

macOS developers and sysadmins using SSH

Similar To

macOS built-in ssh-agent · ssh-keygen

Post Description

Hi HN! Showcasing sod - a minimal Secure Enclave harness for ssh keys.

sod generates an ecdsa-sha2-nistp256, unexportable key inside the Apple Secure Enclave.

It then orchestrates a barebones ssh-agent session which, in short - allows authenticating to OpenSSH servers the same way you would normally - but with your fingerprint instead of your password.

No special support required on the server side, this simply bridges typical ssh client behavior with Secure Enclave signing primitives.

sod is CLI-only, and "speaks" in typical OpenSSH verbs: ssh-keygen, ssh-add, ssh-agent.

sod is a lean codebase written in Swift - zero dependencies (outside of Swift's own). It does not implement any cryptography itself but rather delegates to macOS and OpenSSH crypto.

Quickstart: brew install botanica-consulting/tap/sod

sd install

ssh-copy-id -i ~/.ssh/id_sod.pub user@host

ssh user@host

Pre-built .pkg and the code for your perusal at: https://github.com/botanica-consulting/sod

Any feedback is welcome!

-- sod is a FOSS project by https://botanica.software

Similar Projects