macOS Tahoe breaks manual login keychain transfers on Secure Enclave Macs
Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe
Copying a login keychain file between Macs used to work by supplying the keychain password. On macOS Tahoe, Secure Enclave-equipped Macs no longer allow this: the decryption keys are tied to the source Mac's Secure Enclave, so the destination Mac cannot unlock the keychain even with the correct password. A test copying login.keychain-db from an Apple Silicon Mac to a VM confirmed the failure and showed macOS creates a new keychain instead.
The metadata key is protected by the Secure Enclave but is cached in the Application Processor to allow fast queries of the keychain. The secret key always requires a round trip through the Secure Enclave.
- xmddmx
Disturbing if true, as it suggests my "everything" backups aren't really full backups at all.
I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?
Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?
- shenenee
This is pretty much how it's suppose to work...
- Jhsto
Switching from macOS to Linux was quite painful because the security was so seamless on Mac. But I also realized I had no idea how my passwords are stored and under what guarantees. Learning and getting the hardware tokens to do it properly on Linux was a PITA. But reading this post made me feel a pinch better.
- dfabulich
Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
- ok_dad
It sounds like they are using envelope encryption and using the Secure Enclave to derive the row keys each time. Not really any easy way around that except they should provide a tool to export it, TBH. I am guessing they weren’t using envelope encryption before or they were deriving the row keys from the password. This is a secure design but more security usually means less usability these days.