Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe
5 days ago
- Manually copying login keychains between Macs no longer works on Secure Enclave-equipped Macs running macOS Tahoe.
- The login keychain is a SQLite database file (login.keychain-db) stored in the user's Library/Keychains folder.
- Historically, copying the login keychain file and providing the password allowed it to be opened on another Mac, but this is no longer supported on Macs with Secure Enclave.
- Keychain items are encrypted with two AES-256-GCM keys: a metadata key (cached in the Application Processor) and a secret key (requires Secure Enclave round trip).
- Unlocking a keychain from another Mac fails because the required decryption keys are tied to the source Mac's Secure Enclave.
- Testing showed that copying a login keychain from an Apple Silicon Mac to a macOS VM (which lacks Secure Enclave) resulted in the unlock failing, and macOS created a new login keychain instead.
- Logs confirmed the unlock failed despite the correct password, as macOS fell back to creating a new keychain.
- The author questions how Migration Assistant handles keychain migration and suggests relying on Federated Apple Accounts and cloud sync to move keychains between machines.