You should link your Apple Watch with a device where you are logged in if it is currently connected to one where you are not (for example, your spouse's iPad). There are a few warnings Apple lists in its online instructions before you get started. Lastly, make sure you have access to both your password, which should ideally be generated randomly and kept in a password manager, as well as a way to confirm your identity. Only versions of iOS 16.3, iPadOS 16.3, or macOS Ventura 13.2 or later from Apple enable security key enrolment.

Most crucially, you won't be able to add security keys until a few weeks have passed if MFA hasn't previously been set for your Apple ID.īefore you start, you should update all of your Apple products. Key things to remember while setting up security keys for Apple IDīefore you enroll security keys with your Apple ID, there are a few things to complete. The blue version of this key has been retired by Yubico, and a new black-clad key will soon replace it (Opens in a new window). dist/bin/ssh-keygen -vvv -t ecdsa-sk -f ~/.ssh/id_ecdsa_skWhat security keys are appropriate for Apple ID?Īpple has suggestions in form of the YubiKey 5C NFC, YubiKey 5Ci, and Feitan ePass K9 NFC USB-A.Īlthough we think the YubiKey 5C NFC is a fantastic alternative, the YubiKey Security Key C NFC could be a better choice for beginners because it is less expensive than the 5C.

Sisyphus ~/t/openssh-portable > FIDO_DEBUG=1. I set a breakpoint on fido_dev_open and it fails at This happens with both libfido 1.4.0 and the latest git checkout. Zsh: command not found: cccccctnugdfjnubhvhfıenhhjıvefbtllvvllıcgnkk Sisyphus ~ > cccccctnugdfjnubhvhfıenhhjıvefbtllvvllıcgnkk You may need to touch your authenticator to authorize key generation.ĭebug1: start_helper: starting /usr/lib/ssh/ssh-sk-helperĭebug1: sshsk_enroll: provider 'internal', device '(null)', application 'ssh:', userid '(null)', flags 0x01, challenge len 0ĭebug1: sshsk_enroll: using random challengeĭebug1: ssh_sk_enroll: using device /dev/hidraw5ĭebug1: ssh_sk_enroll: fido_dev_open: FIDO_ERR_RXĭebug1: sshsk_enroll: provider 'internal' returned failure -1ĭebug1: ssh-sk-helper: Enrollment failed: invalid formatĭebug1: client_converse: helper returned error -4 Generating public/private ecdsa-sk key pair. Sisyphus ~ > ssh-keygen -vvv -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk

Yubikey 5ci keychain