macOS Tahoe silently sabotaged the login keychain

With great dismay I read the blog post by Rich Trouton, Manually copying login keychain files from one Mac to another no longer works on Secure Enclave-equipped Macs running macOS Tahoe. As far as I’m aware, this blog post has not yet received widespread attention, but it should, and I hope to remedy that with my own blog post. According to Apple, all Apple silicon Macs, as well as some Intel Mac models, have the secure enclave processor, so the issue affects millions of Mac users. In short, I would describe the issue in this way: you do not and cannot have a reliable backup of your login keychain. The problem is that on Tahoe and Golden Gate, the login keychain is encrypted not only with your login password but also with the secure enclave, which by design creates and stores encryption keys that are unique to your device and cannot be extracted from your device. In other words, your login keychain file cannot be decrypted on another device, even with your login password. If anything…