In the first part of this post, the author shows a simple and secure way to create an SSH key on a Mac in three commands, including support for GitHub. The second part explains what is happening behind the scenes for readers who are curious.
Macs include a built-in Secure Enclave, where identities can be created that are very difficult to steal. These identities are protected by Touch ID and can be used for SSH authentication. Compared with traditional SSH key files, this approach has several benefits. The private key material cannot be extracted or displayed, so it cannot be stolen. The user is prompted whenever the identity is used. There are also no key files such as ~/.ssh/id_ed25519 cluttering the file system, and no risk of deleting them by mistake. This protection applies whenever SSH is used, including git-over-SSH with GitHub.
The quick setup has three steps. First, create the identity with the sc_auth command and confirm with Touch ID. Second, run ssh-add with the ssh-keychain.dylib library to tell SSH to use the identity, leaving the PIN prompt empty. SSH forgets this setting after a reboot, so it must be run again. Third, run ssh-add -L to display the public key, and add it to GitHub. Lines beginning with sk-ecdsa-sha2-nistp256 identify the correct key when several are listed.
Once configured, operations such as git push trigger a Touch ID prompt. The private key cannot be given away, but if the Mac is lost or fails, the identity is lost too, and a new one must be created and re-registered with services such as GitHub.
Source: Hacker News · Summarized by HeadlinesBriefing