What is difference between Keychain and Secure Enclave

Question

I've been in searching where keychain stores either secure enclave or any other, I found many articles (one of this stackoverflow answer) which says following but I'm looking for some Authenticated like Apple statement

The keychain stores the keys (and other small data) encrypted and restricts access to that data. Additionally in recent iPhones (5S and later) the keychain is in a separate processor, the Secure Enclave which additionally restricts access. There is no more secure way to store keys in iOS.

So my queries on the basis of above statement.

• Is Keychain Items store in secure Enclave
• If yes then where Public key and Private key CFTypeRef Store

• Why we use this kSecAttrTokenIDSecureEnclave while creating key pair. (example following code).

  -(bool) generateKeyPairWithAccessControlObject:(SecAccessControlRef)accessControlRef
  {
        CFMutableDictionaryRef accessControlDict = newCFDict;;
        CFDictionaryAddValue(accessControlDict, kSecAttrAccessControl, accessControlRef);
        CFDictionaryAddValue(accessControlDict, kSecAttrIsPermanent, kCFBooleanTrue);
        CFDictionaryAddValue(accessControlDict, kSecAttrLabel, kPrivateKeyName);
  
        // create dict which actually saves key into keychain
        CFMutableDictionaryRef generatePairRef = newCFDict;
        CFDictionaryAddValue(generatePairRef, kSecAttrTokenID, kSecAttrTokenIDSecureEnclave);
        CFDictionaryAddValue(generatePairRef, kSecAttrKeyType, kSecAttrKeyTypeEC);
        CFDictionaryAddValue(generatePairRef, kSecAttrKeySizeInBits, (__bridge const void *)([NSNumber numberWithInt:256]));
        CFDictionaryAddValue(generatePairRef, kSecPrivateKeyAttrs, accessControlDict);
  
        OSStatus status = SecKeyGeneratePair(generatePairRef, &publicKeyRef, &privateKeyRef);
  
        if (status != errSecSuccess)
            return NO;
  
        [self savePublicKeyFromRef:publicKeyRef];
        return YES;
  }
  

Looking for authenticated answer. Cheers

Zouave

Answer 1

Not all keychain items are stored in secure enclave
From Apple document

The only keychain items supported by the Secure Enclave are 256-bit elliptic curve private keys (those that have key type kSecAttrKeyTypeEC). Such keys must be generated directly on the Secure Enclave using the SecKeyGeneratePair(::_:) function with the kSecAttrTokenID key set to kSecAttrTokenIDSecureEnclave in the parameters dictionary. It is not possible to import pre-existing keys into the Secure Enclave.

Hyacinthhyacintha

Answer 2

Take a look at Apple's iOS security whitepaper, it describes what Secure Enclave and Keychain are exactly.

A Secure Enclave is a coprocessor fabricated within the system on chip (SoC). It uses encrypted memory and includes a hardware random number generator. As for the Keychain, the iOS Keychain provides a secure way to store these (passwords and other short but sensitive bits of data) items. [...] The Keychain is implemented as a SQLite database stored on the file system..

Keychain is a piece of software that stores encrypted data (such as passwords) in a SQLite database. The key that encrypts this data is inside the Secure Enclave - it never leaves the SE, as per this paragraph

Keychain items are encrypted using two different AES-256-GCM keys, a table key (metadata) and per-row key (secret-key). Keychain metadata (all attributes other than kSecValue) is encrypted with the metadata key to speed search while the secret value (kSecValueData) is encrypted with the secret-key. The metadata key is protected by Secure Enclave processor, but cached in the application processor to allow fast queries of the keychain. The secret key always requires a round-trip through the Secure Enclave processor.

To answer your question: are keychain items stored inside Secure Enclave, no, they are stored inside a SQLite database on disk, but the encryption key needed to decrypt this data is inside the Secure Enclave. As for kSecAttrTokenIDSecureEnclave that apperas to be a flag that indicates that the key should be generated inside the Secure Element.

Monteux

Answer 3

The Keychain uses Secure Enclave, the Secure Enclave is implemented in hardware.

From what I understand:
By default asymmetric key-pairs are created and stored in the secure enclave. The private key is available only at creation time and can not be obtained later. Asymmetric operations that use the private key obtain it from the keychain without exposing it to user code.

There is an exception that allows access to the private key, the Keychain Access app.

Sightless

Thanks for your response, so what this line is use to do kSecAttrTokenIDSecureEnclave , if Keychain use Secure Enclave? – Zouave

One more question more If I created private key from OpenSSL and then convert into SecKeyRef and then store, so will that be store into secure enclave ? . And can we retrieve these later on like for signing. – Zouave

You don't retrieve the private key for signing, the signing operation accesses the key from the Keychain. – Sightless

Answer 4

Is Keychain Items store in secure Enclave

No, they are not, Secure Enclave only support Elliptic Curve Keys with 256 bits. The Secure Enclave is a hardware-based key manager that’s isolated from the main processor to provide an extra layer of security. When you protect a private key with the Secure Enclave, you never handle the plain-text key, making it difficult for the key to become compromised. Instead, you instruct the Secure Enclave to create and encode the key, and later to decode and perform operations with it. You receive only the output of these operations, such as encrypted data or a cryptographic signature verification outcome.

Why we use this kSecAttrTokenIDSecureEnclave while creating key pair. (example following code).

Indicates that the generation operation should take place inside the Secure Enclave. You don't need to pass the attribute if you don't want to create the key pair in Secure Enclave.

Kong