iOS Keychain
Was ist iOS Keychain?
iOS KeychainApple's encrypted credential store on iOS, iPadOS, and macOS, backed by the Secure Enclave and graded by per-item accessibility classes that bind decryption to device unlock, passcode, biometric, or hardware-bound state.
The iOS Keychain is the OS-level encrypted credential and secret store used by iOS, iPadOS, macOS, watchOS, and tvOS, accessed via the SecItem* APIs. Items are encrypted with keys ultimately rooted in the Secure Enclave's hardware key and tied to the device's UID, so a Keychain database extracted off the device cannot be decrypted on different hardware. Each Keychain item carries an accessibility class that controls when it can be unlocked: `kSecAttrAccessibleWhenUnlocked`, `kSecAttrAccessibleAfterFirstUnlock`, the more restrictive `*ThisDeviceOnly` variants, and biometric- or passcode-gated `kSecAccessControl` constraints that require Face ID/Touch ID or the device passcode for each read. Common pitfalls in mobile AppSec include using too-permissive accessibility (e.g. `WhenUnlocked` without `ThisDeviceOnly`, which lets the item iCloud-sync across devices), storing high-entropy bearer tokens that don't need device-bound protection, and skipping `SecAccessControl` for credentials worth biometric-gating. Frida-based attacks on jailbroken devices can dump the Keychain unless items also carry hardware-bound access control. OWASP MASVS controls MSTG-CRYPTO and MSTG-STORAGE map directly to correct Keychain usage.
● Beispiele
- 01
A banking app stores its OAuth refresh token with `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` and `kSecAccessControlBiometryCurrentSet`, requiring fresh Face ID on every read.
- 02
An audit finds an app storing API keys with `kSecAttrAccessibleAlways`, allowing extraction from a backup; the finding maps to MASVS MSTG-STORAGE-2.
● Häufige Fragen
Was ist iOS Keychain?
Apple's encrypted credential store on iOS, iPadOS, and macOS, backed by the Secure Enclave and graded by per-item accessibility classes that bind decryption to device unlock, passcode, biometric, or hardware-bound state. Es gehört zur Kategorie Mobile Sicherheit der Cybersicherheit.
Was bedeutet iOS Keychain?
Apple's encrypted credential store on iOS, iPadOS, and macOS, backed by the Secure Enclave and graded by per-item accessibility classes that bind decryption to device unlock, passcode, biometric, or hardware-bound state.
Wie funktioniert iOS Keychain?
The iOS Keychain is the OS-level encrypted credential and secret store used by iOS, iPadOS, macOS, watchOS, and tvOS, accessed via the SecItem* APIs. Items are encrypted with keys ultimately rooted in the Secure Enclave's hardware key and tied to the device's UID, so a Keychain database extracted off the device cannot be decrypted on different hardware. Each Keychain item carries an accessibility class that controls when it can be unlocked: `kSecAttrAccessibleWhenUnlocked`, `kSecAttrAccessibleAfterFirstUnlock`, the more restrictive `*ThisDeviceOnly` variants, and biometric- or passcode-gated `kSecAccessControl` constraints that require Face ID/Touch ID or the device passcode for each read. Common pitfalls in mobile AppSec include using too-permissive accessibility (e.g. `WhenUnlocked` without `ThisDeviceOnly`, which lets the item iCloud-sync across devices), storing high-entropy bearer tokens that don't need device-bound protection, and skipping `SecAccessControl` for credentials worth biometric-gating. Frida-based attacks on jailbroken devices can dump the Keychain unless items also carry hardware-bound access control. OWASP MASVS controls MSTG-CRYPTO and MSTG-STORAGE map directly to correct Keychain usage.
Wie schützt man sich gegen iOS Keychain?
Schutzmaßnahmen gegen iOS Keychain kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für iOS Keychain?
Übliche alternative Bezeichnungen: Apple Keychain, iOS Keychain Services.
● Verwandte Begriffe
- mobile-security№ 052
Android Keystore System
Android's hardware-backed key container that confines cryptographic key material to a Trusted Execution Environment or StrongBox, exposing keys only by reference and enforcing per-key access policies such as biometric or device-credential gating.
- mobile-security№ 772
Sicherheit mobiler Anwendungen
Die Praxis, iOS- und Android-Apps so zu entwerfen, zu entwickeln und zu testen, dass Nutzerdaten geschuetzt sind und Reverse Engineering sowie Laufzeit-Manipulation erschwert werden.
- compliance№ 871
OWASP MASVS
OWASP Mobile Application Security Verification Standard, eine Basislinie testbarer Sicherheitsanforderungen fur iOS- und Android-Mobile-Apps.
- cloud-security№ 1097
Secure Enclave
Hardware-isolierter, integritätsgeschützter Bereich eines Prozessors oder SoC, der sensiblen Code ausführt und Schlüssel außer Reichweite des Hauptbetriebssystems speichert.
- identity-access№ 112
Biometrische Authentifizierung
Ein Authentifizierungsverfahren, das die Identität anhand einzigartiger körperlicher oder physiologischer Merkmale wie Fingerabdruck, Gesicht, Iris oder Stimme prüft.
- cryptography№ 457
FIDO-Sicherheitsschluessel
Hardware-Authenticator, der ueber FIDO U2F oder FIDO2/WebAuthn eine phishing-resistente Public-Key-Authentifizierung gegenueber Web- und Enterprise-Diensten leistet.
● Siehe auch
- № 062Apple App Attest