title: Does Apple have a method in iOS to securely provide the services from a public/private key pair to all instances of the same iOS app on 9.3 or later?
body: <p><strong>What is a valid method to securely provide all instances of an app across different devices with a public/private key pair that would be used both to encrypt and decrypt data records created any of those devices, such that any instance of the app on any device can decrypt the records encrypted with those keys?</strong></p>
  
  <p>In particular, this is for a cloud-based iOS app on 9.3 or later that stores extremely sensitive information in some proprietary cloud-based servers. We don't want our own cloud server having the private key however, to eliminate the possibility of the key being leaked should our main server get hacked. </p>
  
  <p>I was hoping there'd be a way for example to have Apple inject a common key to the system keychain at app install, so that no human outside of Apple's security fortress itself could see the private keys, and it would be as secure as the device's system keychain.</p>
  
  <hr>
  
  <p><strong>Existing options that I know about for storing a private key that would be accessed across all instances of the same app</strong>:</p>
  
  <p>(1) <strong>Hard-code a key-pair right into the app.</strong>
  Downfall: If someone gets access to the code repository, and/or sufficiently decompiles the app, they can reconstruct the private key.</p>
  
  <p>(2) <strong>Have the device connect to iCloud via CloudKit and pull down the key-pair from the app's public container, then store it into the system keychain.</strong> Downfall: an attacker who compromises the right AppleID credentials could gain access to everything needed to decrypt the data. Also, Apple's latest security white paper says an app's public iCloud container is "not encrypted". </p>
  
  <p>(3) <strong>Have the app require a configuration profile be installed that contains the certs.</strong> Downfall: the source of the configuration profile could be owned by an attacker. </p>
  
  <p>(4) <strong>Combination of 1 through 3: assemble the private key at launch time from a bunch of bits and pieces that are hard-coded, come from iCloud, and come from some.</strong> Downfall: less downfall by making an attacker jump over more hurdles is not <em>no downfall</em>. </p>
  
  <p>(5) Is there a five? </p>
  
  <hr>
  
  <p><strong>What I want ideally</strong> is an Apple-provided way to inject a special key-pair into the system keychain of the device at the time of app install, such that that:</p>
  
  <ul>
  <li><p>the app itself has role in the key injection, which would be done prior to the app launching</p></li>
  <li><p>the app itself has no direct access to the key pair</p></li>
  <li><p>all the app can do is pass things to a system framework to handle signing/encrypting/decrypting operations that rely on these keys</p></li>
  <li><p>this key-pair is not available to versions of the app that are not signed by Apple (i.e. beta/dev/QA versions rely on proxy certs)</p></li>
  <li><p>all copies of the app the same results from the same key-pair</p></li>
  <li><p>the developer can reset the key-pair, at which point subsequent updates of the app can have the system do a one-time transition of data from being encrypted with the old key to being encrypted with the new one</p></li>
  </ul>
  
  <p>... does Apple provide such a method? Or anyone else?</p>