Secure Enclave SSH Keys on iPhone
Almost every SSH key in existence is a file. That is its great convenience and its central weakness: a file can be copied, and a copied key is indistinguishable from the original. A Secure Enclave key is different in kind. It is generated inside a dedicated coprocessor on Apple silicon, the private half never leaves that hardware, and no software can extract it. That includes the app that created it, and anything running as root on a jailbroken device. You do not get a copy because there is no copy to get.
Written by the GateShell team at Hefty Innovations
Step by step
- 1
Decide whether this is the right key for the host
Worth thinking about before generating, because the property that makes these keys strong also makes them inflexible. A Secure Enclave key is bound to one device forever. It cannot be backed up, synced to your other devices, or recovered if the device is lost or wiped. That is ideal for a key that only ever authenticates from this phone, and wrong for a key you expect to reuse elsewhere. Use it as a per-device credential, not as your identity.
- 2
Generate the key
In Settings, under SSH Keys, give the key a name and choose the Secure Enclave option, then generate. It is a P-256 key, because the Secure Enclave supports that curve specifically, which is why ed25519 is not offered for hardware-backed keys. Generation is instant and needs no network connection, so this step works on a plane.
- 3
Install the public half on the server
Copy the public key and append it to ~/.ssh/authorized_keys on the target server. Standard practice applies: the file should be mode 600 and the .ssh directory 700, or sshd will silently ignore it, a failure that looks exactly like a wrong key. Do this over an existing working connection, whether that is password auth from the phone or a session from your laptop.
- 4
Assign the key to the server and test it
Set the server's authentication method to use the new key, then connect. Test before removing any other access method. Locking yourself out of a server by disabling password auth while assuming a new key works is a common and entirely avoidable mistake.
- 5
Plan for losing the device
This is the step people skip, and it is the one that matters. Because the key cannot be backed up, a lost phone means that key is simply gone. Keep a second means of access, such as another key from your laptop or a console through your cloud provider, and when the device goes, remove its public key from authorized_keys. That last part is easy and worth doing promptly: the key is unusable without the hardware, but stale entries in authorized_keys are their own small liability.
- 6
Layer the app lock on top
The Secure Enclave protects the key from extraction, not from use by whoever is holding an unlocked phone. Enabling Face ID or Touch ID for the app closes that gap. The two mechanisms address genuinely different threats. Hardware protection guards against copying and biometric lock against casual physical access, and neither substitutes for the other.
Frequently asked questions
Can I back up a Secure Enclave key?+
No, and that is the point rather than a limitation. The private key never exists outside the Secure Enclave, so there is nothing to export, copy, or sync: not to iCloud, not to another device, not to a backup. Treat it as a per-device credential and keep another route into your servers.
Why P-256 and not ed25519?+
The Secure Enclave implements P-256 (also called ECDSA with the NIST P-256 curve) in hardware, and that is what it can generate and sign with. Ed25519 keys are fully supported in GateShell as software keys stored in the Keychain; they just cannot be hardware-backed. OpenSSH accepts both.
Does the server need anything special?+
No. The server sees an ordinary ECDSA public key and verifies signatures as it always would. Nothing about the hardware backing is visible to it, and no server-side configuration or module is required.
What if my phone is lost or stolen?+
The key is unusable without that specific device, and it cannot be extracted from it. Remove the public key from authorized_keys on your servers anyway. It is good hygiene, and it keeps the file honest. This is also why the second access route matters: you cannot restore this key onto a replacement phone.
Is this the same as a YubiKey?+
Same idea, different hardware. Both keep the private key in a device that will not surrender it. A YubiKey is portable across machines, which is its advantage; the Secure Enclave is already in your phone and needs no accessory, which is its. GateShell supports Secure Enclave keys; FIDO2 hardware tokens are not currently supported.
Try it in GateShell
GateShell is a zero-backend SSH client for iPhone, iPad, and Mac, with no vendor cloud, no accounts and no telemetry. Everything above works out of the box.
Guide reflects GateShell's shipped features as of September 2026. Steps assume basic familiarity with SSH and the command line; server-side commands may vary by distribution. All product names, logos, and brands are property of their respective owners.