Der FlounderFrom Der Flounder · · 2m
Your login keychain won't travel anymore
On Tahoe, copying a login keychain to another Mac fails even with the right password, and the Secure Enclave is why.
In brief
On Tahoe, copying a login keychain to another Mac fails even with the right password, and the Secure Enclave is why. On Secure Enclave Macs running Tahoe, a login keychain is bound to the machine that made it. Migrate accounts properly instead of copying the file. Originally reported by Der Flounder.
What the login keychain is
macOS makes one for every user account. Its password matches your login password, so it unlocks automatically when you sign in.
Where it lives on Tahoe
It's a SQLite database called login.keychain-db, sitting in /Users/username/Library/Keychains.
The old trick that worked
For years you could copy that file to another Mac, type the keychain password, and get your saved secrets back.
Tahoe broke it
On Macs with a Secure Enclave, the password alone no longer opens a copied login keychain.
Two keys, not one
Apple encrypts keychain items with two AES-256-GCM keys: a metadata key for fast searching and a per-row secret key for the actual values.
“Keychain items are encrypted using two different AES-256-GCM keys: a table key (metadata) and a per-row key (secret key).”
The Secure Enclave holds them
The metadata key is cached in the main processor for speed, but the secret key has to go through the Secure Enclave every single time.
“The secret key always requires a round trip through the Secure Enclave.”
Why the copy fails
The decryption keys stay in the source Mac's Secure Enclave. On a second Mac, the password is right but the keys simply aren't there.
The test setup
Rich Trouton copied a login.keychain-db from an Apple Silicon Mac into a macOS VM with an identical username and password.
A VM makes a clean control
Virtual machines have no Secure Enclave. If the keys really live there, the VM has no way to reach them.
“VMs don't have a Secure Enclave.”
What happened at login
Instead of unlocking, macOS built a brand new login keychain. The copied one was renamed to login_renamed_1.keychain-db.
The logs name the failure
securityd logged SecKeychainLogin failed: -2147413984, password was supplied. The password reached the unlock attempt and still wasn't enough.
“SecKeychainLogin failed: -2147413984, password was supplied”
Not a typo, a lockout
Because the password was confirmed correct in setup and the log shows it was supplied, a mismatch is ruled out. Hardware binding is what's blocking it.
What this means for admins
Stop treating the keychain file as portable. Move credentials through account migration, iCloud Keychain, or a password manager instead.
The takeaway
On Secure Enclave Macs running Tahoe, a login keychain is bound to the machine that made it. Migrate accounts properly instead of copying the file.
