● Covered by 1 source · 1 reportMedium impact1 neutral
Login Keychain Copying Fails on Secure Enclave Macs with macOS Tahoe
Key points
- Login keychain copying fails on Secure Enclave Macs with macOS Tahoe.
- Keychain decryption keys are tied to the Secure Enclave.
- Metadata key is protected by Secure Enclave and cached in Application Processor.
- Secret key always requires a round trip through the Secure Enclave.
Login Keychain Changes in macOS Tahoe
With macOS Tahoe, the login keychain, a SQLite database file named login.keychain-db, is stored in the user’s home folder. Historically, users could copy this file between Macs and open it with the correct password.
Secure Enclave Integration Prevents Copying
This manual copying method no longer functions on Macs equipped with a Secure Enclave when running macOS Tahoe. The change stems from how keychain items are encrypted and protected.
Keychain items use two AES-256-GCM keys: a metadata key and a per-row secret key. The metadata key is protected by the Secure Enclave and cached in the Application Processor, while the secret key always requires a round trip through the Secure Enclave for decryption.
Impact on Keychain Portability
The keys required to decrypt the login keychain are now tied to the specific Secure Enclave of the Mac where the keychain was created. Consequently, even with the correct password, the necessary decryption keys are unavailable on a different Mac, rendering copied keychains inaccessible.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub rtrouton/a4b0ebbe505fb32212f22581148c7d55 GitHub rtrouton/43d8799c5cdb847e73fbed0a295be728 GitHub rtrouton/b9c849b07becb9eda0b3e1b39f441bf0 GitHub rtrouton/1a1d972888ccf94b1ab21e620ab241d6 GitHub WordPress/WordPressReporting from
Manually copying login keychain files between Macs no longer works on Secure Enclave-equipped Macs running macOS Tahoe. This change is due to keychain decryption keys being tied to the Secure Enclave of the originating Mac, preventing access on a different device.