Skip to content
SigilTTYSigilTTY Docs

Security keys (FIDO)

A FIDO key is an SSH key whose private half lives inside a hardware security key — a USB or NFC token — and never exists in software, not on your device and not in Keychain. Every connection is signed by the hardware itself, after you physically touch it.

What you need

Section titled “What you need”
  • A FIDO2 security key over USB or NFC.
  • A server running OpenSSH 8.2 or later (that is where sk- key types were added).

Creating a key

Section titled “Creating a key”

Security keys are created inside SigilTTY — you cannot import a key pair generated elsewhere with ssh-keygen -t ecdsa-sk, because those keys are bound to a different application identity and could never be used to sign here.

In the key library, choose Create FIDO Key and set:

  • Name — how the key appears in your key library and profile pickers.
  • Store on the security key (resident) — optional. A resident credential lives on the token itself instead of only as a handle in your Keychain.
  • Require PIN — ask the security key for its PIN in addition to the touch.

Your Mac or iPhone then shows the system security key sheet. Insert or tap the key, touch it, and enter its PIN if it has one.

Adding the key to your server

Section titled “Adding the key to your server”

Copy the public key from the key library and append it to ~/.ssh/authorized_keys on the server, exactly like any other public key. It is a standard OpenSSH line:

sk-ecdsa-sha2-nistp256@openssh.com AAAA… name@SigilTTY

With Require PIN on, the copied line is prefixed with the verify-required option, which tells the server to reject any signature that was not confirmed with the PIN:

verify-required sk-ecdsa-sha2-nistp256@openssh.com AAAA… name@SigilTTY

Require PIN can be toggled later from the key’s edit panel — copy the public key again and update the server afterwards, otherwise the server keeps enforcing the old setting.

What connecting feels like

Section titled “What connecting feels like”

Signing happens per connection, and there is no way to cache it — expect one touch for each of these:

  • Opening a terminal session, and again each time it reconnects.
  • Opening an SFTP file browser, plus one more the first time you transfer a file (transfers use their own connection).
  • Opening a tunnel session.
  • Every hop of a jump-host chain that uses the key.
  • Each server in a batch connect on Mac — the sheets appear one after another.

Cancelling the system sheet is treated as a failed authentication: the session parks and does not retry by itself.

Not supported

Section titled “Not supported”

FIDO keys deliberately stay out of a few places:

  • Key Handoff — there is no private key to hand over. Use the same security key on your other device, or enroll a second one.
  • Agent forwarding — FIDO keys are not offered to remote hosts as forwardable identities.
  • Biometric protection and passphrases — the touch is already proof of possession, so those options are hidden for FIDO keys.
  • Importing existing *-sk key files, and exporting the key out of SigilTTY.

Sync

Section titled “Sync”

The credential handle is stored in Keychain like any other credential, so it travels through iCloud Keychain when credential sync is on — but the handle alone cannot sign anything. The security key itself must be present on whichever device you connect from. See iCloud sync.

If something goes wrong

Section titled “If something goes wrong”

See Authentication failures for the security key error cases.