I'm researching on hardware-backed keychain for iOS and Android, in order to store some certificates in hardware rather than software. According to Android docs (https://source.android.com/security/keystore) Android versions 4.3 and above support hardware-backed keychain, but with limitations on devices. I'm assuming it requires some sort of SoC with ARM Trustzone (or the equivalent intel x86 counterpart). Is there a list of such devices and/or SoCs?

In the iOS world, Apple seems to offer secure enclave technology (http://spr.com/ios-security-protecting-the-ios-keychain) which is a co-processor. Can keys and certs be stored in this secure enclave by app developers?



No the enclave is just for the iOS encryption processes.

It turns out this was the perfect convergence for the synergy needed to allow Apple to move forward with TouchID. Apple has customized a highly optimized version of TrustZone and created what is now known Secure Enclave. Of course Apple will likely never release the details of what they do in the custom hardware for number of reasons. Thus I will speak directly of TrustZone and extrapolate to Secure Enclave.


Apple has wisely restricted very, very limited access to Touch ID and does not have any APIs available for developers. In fact Apple has removed the iCloud Keychain from the most recent developer build of iOS 7. I can only publicly say this has a lot of reasons that will be very clear in the next few months. The technology is now limited to just two use cases, device unlock and iTunes and App Store purchases. Of course this was not the limited intent of this technology and there will be full developer API access at some point, perhaps not in some areas that Apple will limit as they want to be the sole provider in those areas.


More information about it can be found here:iOS and here:Android.

  • Thanks. Does that mean that there aren't ways for iOS app developers to generate/store keys/certs within the secure enclave like it's possible on Android? – user1118764 Aug 22 '16 at 8:09
  • Correct it is not possible. Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple. When the device starts up, an ephemeral key is created, entangled with its UID, and used to encrypt the Secure Enclave’s portion of the device’s memory space. -Source: apple.com/business/docs/iOS_Security_Guide.pdf – HashHazard Aug 22 '16 at 13:09

Note that the answer from HashHazard is outdated; in the meantime Apple has published an API to store keys in the Secure Enclave: https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave

Your Answer

