I recently encountered an issue with the login keychain on macOS. The login keychain is automatically created for each user account, and its password matches the login password. It is stored as an encrypted database file and unlocks automatically when the user logs in.

As of macOS Tahoe, the login keychain is a SQLite database file named login.keychain-db, stored in `/Users/username_goes_here/Library/Keychains`. Historically, you could copy the login keychain file from one Mac to another and open it on the destination Mac by providing the password. As of macOS Tahoe, this does not work for Macs which use Secure Enclave.

For those Macs, only having the password is no longer sufficient. According to Apple’s Platform Security documentation, keychain items are encrypted using two AES-256-GCM keys: a metadata key and a per-row secret key. The metadata key is protected by the Secure Enclave but cached in the Application Processor.

The secret key always requires a round trip through the Secure Enclave. Thus, unlocking the login keychain requires more than the password because the keys are tied to the Secure Enclave of the Mac where the keychain was created. I tested this by copying a login.keychain-db file from an Apple Silicon Mac to a macOS VM (which lacks a Secure Enclave).

After replacing the VM’s login.keychain-db and restarting, a new login keychain file was created automatically when I logged in, instead of unlocking the copied one.