iOS Keychain
O que é iOS Keychain?
iOS KeychainApple's encrypted credential store on iOS, iPadOS, and macOS, backed by the Secure Enclave and graded by per-item accessibility classes that bind decryption to device unlock, passcode, biometric, or hardware-bound state.
The iOS Keychain is the OS-level encrypted credential and secret store used by iOS, iPadOS, macOS, watchOS, and tvOS, accessed via the SecItem* APIs. Items are encrypted with keys ultimately rooted in the Secure Enclave's hardware key and tied to the device's UID, so a Keychain database extracted off the device cannot be decrypted on different hardware. Each Keychain item carries an accessibility class that controls when it can be unlocked: `kSecAttrAccessibleWhenUnlocked`, `kSecAttrAccessibleAfterFirstUnlock`, the more restrictive `*ThisDeviceOnly` variants, and biometric- or passcode-gated `kSecAccessControl` constraints that require Face ID/Touch ID or the device passcode for each read. Common pitfalls in mobile AppSec include using too-permissive accessibility (e.g. `WhenUnlocked` without `ThisDeviceOnly`, which lets the item iCloud-sync across devices), storing high-entropy bearer tokens that don't need device-bound protection, and skipping `SecAccessControl` for credentials worth biometric-gating. Frida-based attacks on jailbroken devices can dump the Keychain unless items also carry hardware-bound access control. OWASP MASVS controls MSTG-CRYPTO and MSTG-STORAGE map directly to correct Keychain usage.
● Exemplos
- 01
A banking app stores its OAuth refresh token with `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` and `kSecAccessControlBiometryCurrentSet`, requiring fresh Face ID on every read.
- 02
An audit finds an app storing API keys with `kSecAttrAccessibleAlways`, allowing extraction from a backup; the finding maps to MASVS MSTG-STORAGE-2.
● Perguntas frequentes
O que é iOS Keychain?
Apple's encrypted credential store on iOS, iPadOS, and macOS, backed by the Secure Enclave and graded by per-item accessibility classes that bind decryption to device unlock, passcode, biometric, or hardware-bound state. Pertence à categoria Segurança móvel da cibersegurança.
O que significa iOS Keychain?
Apple's encrypted credential store on iOS, iPadOS, and macOS, backed by the Secure Enclave and graded by per-item accessibility classes that bind decryption to device unlock, passcode, biometric, or hardware-bound state.
Como funciona iOS Keychain?
The iOS Keychain is the OS-level encrypted credential and secret store used by iOS, iPadOS, macOS, watchOS, and tvOS, accessed via the SecItem* APIs. Items are encrypted with keys ultimately rooted in the Secure Enclave's hardware key and tied to the device's UID, so a Keychain database extracted off the device cannot be decrypted on different hardware. Each Keychain item carries an accessibility class that controls when it can be unlocked: `kSecAttrAccessibleWhenUnlocked`, `kSecAttrAccessibleAfterFirstUnlock`, the more restrictive `*ThisDeviceOnly` variants, and biometric- or passcode-gated `kSecAccessControl` constraints that require Face ID/Touch ID or the device passcode for each read. Common pitfalls in mobile AppSec include using too-permissive accessibility (e.g. `WhenUnlocked` without `ThisDeviceOnly`, which lets the item iCloud-sync across devices), storing high-entropy bearer tokens that don't need device-bound protection, and skipping `SecAccessControl` for credentials worth biometric-gating. Frida-based attacks on jailbroken devices can dump the Keychain unless items also carry hardware-bound access control. OWASP MASVS controls MSTG-CRYPTO and MSTG-STORAGE map directly to correct Keychain usage.
Como se defender contra iOS Keychain?
As defesas contra iOS Keychain costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para iOS Keychain?
Nomes alternativos comuns: Apple Keychain, iOS Keychain Services.
● Termos relacionados
- mobile-security№ 052
Android Keystore System
Android's hardware-backed key container that confines cryptographic key material to a Trusted Execution Environment or StrongBox, exposing keys only by reference and enforcing per-key access policies such as biometric or device-credential gating.
- mobile-security№ 772
Seguranca de aplicacoes moveis
Pratica de projetar, desenvolver e testar aplicacoes iOS e Android para proteger dados do utilizador, impedir engenharia reversa e resistir a manipulacao em tempo de execucao.
- compliance№ 871
OWASP MASVS
Mobile Application Security Verification Standard da OWASP, conjunto base de requisitos de seguranca testaveis para aplicacoes moveis iOS e Android.
- cloud-security№ 1097
Enclave seguro
Região de um processador ou SoC isolada por hardware e protegida em integridade, que executa código sensível e guarda chaves fora do alcance do sistema operativo principal.
- identity-access№ 112
Autenticação biométrica
Método de autenticação que verifica a identidade com base em traços físicos ou fisiológicos únicos, como impressões digitais, rosto, íris ou voz.
- cryptography№ 457
Chave de seguranca FIDO
Autenticador de hardware que usa os padroes FIDO U2F ou FIDO2/WebAuthn para autenticacao baseada em chave publica resistente a phishing em servicos web e corporativos.
● Veja também
- № 062Apple App Attest