iOS Keychain
Definition
A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys derived from the device passcode and a hardware UID, making them inaccessible without the passcode or a physical acquisition with decryption support.
- Stores
- Passwords, auth tokens, cryptographic keys
- Protection
- Hardware-backed encryption tied to device passcode
- Key derivation
- Combines passcode with hardware UID
- Extraction difficulty
- Requires passcode or supported physical/decryption exploit
Common questions
Why can't investigators just copy the Keychain file off a locked device?+
The file itself can often be copied, but each entry is encrypted with a key wrapped around the device's hardware UID and the user's passcode, both of which never leave the secure enclave in usable form, so the copied file stays unreadable without that passcode.
How does Keychain access differ from a full filesystem extraction?+
A filesystem extraction can pull unencrypted app data and caches even from a locked device in some cases, but Keychain items sit behind a separate protection class and typically require the device to be unlocked, or an exploit that defeats the secure enclave, before they decrypt.
Related terms
- App Sandbox Container
- An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp...
- NAND Flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
- Plist (Property List)
- A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...
- Wear-Leveling
- A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell....