Secure Enclave
An independent coprocessor subsystem in Apple-designed chips and T1/T2 chips, dedicated to cryptographic operations, key management, and biometric data processing. Its core characteristic is that hardware-bound keys never leave the chip, providing hardware-level security isolation.
Core Facts
Timeline (last 90 days)
The iOS kernel attack surface is relatively narrow and protected by the hardware Secure Enclave, and exploit chains for such vulnerabilities typically require combining multiple vulnerabilities, making the cost extremely high.
On non-Apple hardware, not only is the Secure Enclave physical module missing, but so is the matching encryption key system, which is a hard barrier that pure software emulation cannot cross.
Even if the main system is fully compromised, it cannot directly read the keys stored inside the Secure Enclave.
The Secure Enclave communicates with the main processor through a dedicated mailbox mechanism and has its own independent boot ROM and signature verification process.
HomeView's facial recognition verification process is performed locally on the device, and biometric data is stored in the Secure Enclave.
Touch ID stores and compares fingerprint templates via the Secure Enclave hardware-isolated area, and apps can only get a verification pass/fail result and cannot read the raw fingerprint data.
Data in the system Keychain is encrypted at rest at the system level and can only be read by authorized processes of the current user, making the use of Keychain an industry-recommended security practice.
Secure Enclave is an independent security coprocessor introduced by Apple starting with the A7 chip, physically isolated from the main processor, with its own encrypted storage and random number generator.
Even if the main operating system is compromised, the private keys in the Secure Enclave cannot be extracted, and Face ID biometric data and device keys are all stored there.
Signal may prove that a registration request originates from a real device by combining with the device hardware's trusted execution environment, such as iOS's Secure Enclave or Android's StrongBox.
8 more timeline events
All Facts (19)
Secure Enclave is an independent security coprocessor introduced by Apple starting with the A7 chip, physically isolated from the main processor, with its own encrypted storage and random number generator.
65%UnverifiedThe root cause of keychain migration failure is that the encryption key is sealed within the source device's Secure Enclave and cannot be exported, leaving the target device unable to provide the same hardware key for decryption
60%UnverifiedThe iOS kernel attack surface is relatively narrow and protected by the hardware Secure Enclave, and exploit chains for such vulnerabilities typically require combining multiple vulnerabilities, making the cost extremely high.
50%UnverifiedOn non-Apple hardware, not only is the Secure Enclave physical module missing, but so is the matching encryption key system, which is a hard barrier that pure software emulation cannot cross.
50%UnverifiedEven if the main system is fully compromised, it cannot directly read the keys stored inside the Secure Enclave.
50%UnverifiedThe Secure Enclave communicates with the main processor through a dedicated mailbox mechanism and has its own independent boot ROM and signature verification process.
50%UnverifiedHomeView's facial recognition verification process is performed locally on the device, and biometric data is stored in the Secure Enclave.
50%UnverifiedTouch ID stores and compares fingerprint templates via the Secure Enclave hardware-isolated area, and apps can only get a verification pass/fail result and cannot read the raw fingerprint data.
50%UnverifiedData in the system Keychain is encrypted at rest at the system level and can only be read by authorized processes of the current user, making the use of Keychain an industry-recommended security practice.
50%UnverifiedEven if the main operating system is compromised, the private keys in the Secure Enclave cannot be extracted, and Face ID biometric data and device keys are all stored there.
50%UnverifiedSignal may prove that a registration request originates from a real device by combining with the device hardware's trusted execution environment, such as iOS's Secure Enclave or Android's StrongBox.
50%UnverifiedApple's hardware-bound security model means that even if an attacker physically obtains the device's storage, they cannot decrypt the data on other hardware
50%UnverifiedThe Secure Enclave hardware generates a unique device private key (UID Key) at the time of manufacture, physically burned into the chip, whose raw value cannot be read through software-layer interfaces
50%UnverifiedThe core design principle of the Secure Enclave is that certain keys never leave the Secure Enclave hardware, meaning even the operating system cannot directly read the plaintext
50%UnverifiedThe Secure Enclave is an independent coprocessor subsystem found in Apple silicon chips and certain Intel Macs with a T2 chip, responsible for encryption operations, key management, and biometric data processing
50%UnverifiedWhen running macOS Tahoe on a Mac equipped with a Secure Enclave, it is not possible to complete migration by directly copying the login keychain file between two Macs
50%UnverifiedApple Silicon's boot security uses a chained trust model starting from a Boot ROM hardware root of trust; Reduced Security mode relaxes third-party kernel signature verification, but the Secure Enclave continues to operate independently.
50%UnverifiedTouch ID is particularly difficult to support under Linux because it relies on a closed communication protocol of the Secure Enclave.
50%UnverifiediOS原生App认证链路包含三层结构：操作系统级Keychain（含Secure Enclave硬件加密）、平台设备证明服务（Device Check/App Attest）、应用层业务鉴权
50%