Secure Enclave
Definition
The dedicated security coprocessor on iPhone 5s and later, running a separate microkernel and holding the per-class encryption keys, the passcode verifier and the Touch ID / Face ID templates.
- Platform
- iPhone 5s and later
- Role
- Dedicated security coprocessor
- Runs
- Separate microkernel from the main iOS kernel
- Holds
- Per-class encryption keys, passcode verifier, biometric templates
Common questions
Why does the Secure Enclave complicate mobile forensic acquisition?+
Because the encryption keys never leave it and passcode attempts are throttled and counted inside it, an examiner generally cannot brute-force the passcode at software speed or read keys off the main processor.
Is the Secure Enclave the same across all iPhone models?+
No, its hardware revision and the mitigations built into it have changed across device generations, which is why extraction techniques that work on one model often fail on a newer one.
Related terms
- APK / IPA
- Android Package and iOS App Store package, the installable bundles for the two platforms. APK is a ZIP containing AndroidManifest.xml, classes.dex and...
- ART
- Android Runtime, the AOT-compiling successor to the Dalvik virtual machine since Android 5.0 Lollipop. Apps compile to OAT files on install for...
- FBE
- File-Based Encryption, the per-file key scheme that replaced Full-Disk Encryption (FDE) from Android 7.0 Nougat onward. Splits files into Credential Encrypted (CE)...
- TCC.db
- Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts,...
- WAL
- Write-Ahead Log, the SQLite journaling mode that writes new pages to a sibling .db-wal file before checkpointing them into the main database....