Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe
summary
Manually copying login keychain files between Macs no longer works on devices with a Secure Enclave running macOS Tahoe. This is because the decryption keys required to unlock the keychain are now tied to the specific hardware of the source Mac. Even with the correct user password, the destination Mac cannot access the necessary hardware-backed keys to decrypt the data.
key points
- Apple's platform security now uses two AES-256-GCM keys for keychain items: a metadata key and a secret key. The secret key specifically requires a round trip through the Secure Enclave, making it hardware-dependent.
- Testing via a macOS virtual machine confirms that when a keychain file is moved to a system without the original Secure Enclave, the unlock attempt fails. The system then automatically renames the old file and creates a fresh, empty keychain.
who should read it
Mac system administrators and power users who perform manual backups or migrations of user data. It is particularly useful for those troubleshooting keychain migration issues on newer Apple Silicon hardware.
discussion skeptical
consensus
Most commenters agree that tying encryption keys to a specific device's Secure Enclave makes backups virtually useless for disaster recovery on new hardware. While some argue this is a standard security practice for hardware security modules, the majority view it as a failure of usability and transparency, especially since it reportedly changed in macOS 26.4. There is a strong recommendation to use iCloud Keychain, hardware keys like Yubikeys, or third-party managers to avoid total data loss.
top insight
The critical realization is that 'everything' backups (like Time Machine) are deceptive if they include data encrypted by the Secure Enclave, as the backup is only recoverable if the original hardware is intact. This highlights a fundamental gap between data redundancy (having the files) and data accessibility (having the keys). Users are advised to verify backups by attempting a full restore on different hardware, not just checking file hashes.
Generated by an LLM from the article and thread. Check the sources before relying on it.