3

I'm researching on hardware-backed keychain for iOS and Android, in order to store some certificates in hardware rather than software. According to Android docs (https://source.android.com/security/keystore) Android versions 4.3 and above support hardware-backed keychain, but with limitations on devices. I'm assuming it requires some sort of SoC with ARM Trustzone (or the equivalent intel x86 counterpart). Is there a list of such devices and/or SoCs?

In the iOS world, Apple seems to offer secure enclave technology (http://spr.com/ios-security-protecting-the-ios-keychain) which is a co-processor. Can keys and certs be stored in this secure enclave by app developers?

Thanks.

3 Answers 3

2

No the enclave is just for the iOS encryption processes.

It turns out this was the perfect convergence for the synergy needed to allow Apple to move forward with TouchID. Apple has customized a highly optimized version of TrustZone and created what is now known Secure Enclave. Of course Apple will likely never release the details of what they do in the custom hardware for number of reasons. Thus I will speak directly of TrustZone and extrapolate to Secure Enclave.

...snip...

Apple has wisely restricted very, very limited access to Touch ID and does not have any APIs available for developers. In fact Apple has removed the iCloud Keychain from the most recent developer build of iOS 7. I can only publicly say this has a lot of reasons that will be very clear in the next few months. The technology is now limited to just two use cases, device unlock and iTunes and App Store purchases. Of course this was not the limited intent of this technology and there will be full developer API access at some point, perhaps not in some areas that Apple will limit as they want to be the sole provider in those areas.

Source

More information about it can be found here:iOS and here:Android.

2
  • Thanks. Does that mean that there aren't ways for iOS app developers to generate/store keys/certs within the secure enclave like it's possible on Android? Commented Aug 22, 2016 at 8:09
  • Correct it is not possible. Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple. When the device starts up, an ephemeral key is created, entangled with its UID, and used to encrypt the Secure Enclave’s portion of the device’s memory space. -Source: apple.com/business/docs/iOS_Security_Guide.pdf
    – HashHazard
    Commented Aug 22, 2016 at 13:09
2

Note that the answer from HashHazard is outdated; in the meantime Apple has published an API to store keys in the Secure Enclave: https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave

1
  • Keys and any data really. One purpose is that the developer can store data in the keychain that will survive deleting and reinstalling the application.
    – gnasher729
    Commented Dec 29, 2022 at 16:22
0

Keys and secrets stored by the Secure Enclave can be created just like any other secret, using SecKeyCreateRandomKey. The difference in implementation is to use kSecAttrTokenIDSecureEnclave attribute. [1],[2]

In general, the private key would normally be briefly copied to memory as plain-text to perform cryptographic operations. With the use of Secure Enclave, all operations are performed inside Secure Enclave and the key would never leave it. (thus having a smaller attack surface)

In short, in order to create a pair of keys inside Secure Enclave:

  1. Specify access control attributes - kSecAttrAccessibleWhenUnlockedThisDeviceOnly allows to use the key only on the device that created it, and only when device is unlocked. The .privateKeyUsage allows Secure Enclave to use it for signing. This flag can be combined with biometryAny to require FaceID/TouchID authentication before the key can be used.
let access = SecAccessControlCreateWithFlags(
    kCFAllocatorDefault,
    kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
    .privateKeyUsage,
    nil)! // Ignore errors.
  1. Now, we can create dictionary specifying key type and other attributes. With kSecAttrKeyTypeECSECPrimeRandom we use elliptic curve keys with 256 bits size, and kSecAttrTokenIDSecureEnclave specifies that key is to be stored inside SecureEnclave. We also specify access control attributes that we just created, and a key name for later retrieval.
let tag = "MyNewKeyPair".data(using: .utf8)!
let attributes: NSDictionary = [
    kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
    kSecAttrKeySizeInBits: 256,
    kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
    kSecPrivateKeyAttrs: [
        kSecAttrIsPermanent: true,
        kSecAttrApplicationTag: tag,
        kSecAttrAccessControl: access
    ]
]
  1. Finally, we can create the key and retrieve reference to it:
var error: Unmanaged<CFError>?
guard let privateKey = SecKeyCreateRandomKey(attributes, &error) else {
    throw error!.takeRetainedValue() as Error
}

and use it for i.e. signing with SecKeyCreateSignature function [3].

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .