Does that work with macOS? I’m currently using 1Password as my ssh key agent.

koito17 · on June 7, 2024

It indeed works on Mac OS. I have been using SoloKeys with ed25519-sk keys for about three years now. It should be sufficient to run

  ssh-keygen -t ed25519-sk

while a FIDO2 key is connected. You may need to touch the key to confirm user presence. (At least SoloKeys do).

If I recall correctly, the SSH binaries provided by Apple don't have built-in support for signing keys, but if you install OpenSSH from Nix, MacPorts, etc., then you don't have to worry about this.

Another thing to be mindful of is that some programs have a very low timeout for waiting on SSH authentication, particularly git. SSH itself will wait quite a long time for user presence when using a signing key, whereas Git requires me to confirm presence within about 5 seconds or else operations fail with a timeout.