Data Protection overview (2024)

Table of Contents

Apple Platform Security

Welcome
Intro to Apple platform security
- Hardware security overview
- Apple SoC security
- Secure Enclave
- - Face ID and Touch ID security
  - Magic Keyboard with Touch ID
  - Face ID, Touch ID, passcodes and passwords
  - Facial matching security
  - Uses for Face ID and Touch ID
  - Secure intent and connections to the Secure Enclave
- Hardware microphone disconnect
- Express Cards with power reserve
- System security overview
- - Boot process for iPhone and iPad devices
  - Memory safe iBoot implementation
  - - Boot process
    - Boot modes
    - Paired recoveryOS restrictions
    - Startup Disk security policy control
    - LocalPolicy signing-key creation and management
    - Contents of a LocalPolicy file for a Mac with Apple silicon
  - - Boot process
    - Boot modes
    - Startup Security Utility
    - Firmware password protection
    - recoveryOS and diagnostics environments
- Signed system volume security
- Secure software updates
- Operating system integrity
- Activating data connections securely
- Verifying accessories
- BlastDoor for Messages and IDS
- Lockdown Mode security
- - Additional macOS system security capabilities
  - System Integrity Protection
  - Trust caches
  - Peripheral processor security
  - Rosetta 2 on a Mac with Apple silicon
  - Direct memory access protections
  - Securely extending the kernel
  - Option ROM security
  - UEFI firmware security in an Intel-based Mac
- System security for watchOS
- Random number generation
- Apple Security Research Device
- Encryption and Data Protection overview
- Passcodes and passwords
- - Data Protection overview
  - Data Protection
  - Data Protection classes
  - Keybags for Data Protection
  - Protecting keys in alternative boot modes
  - Protecting user data in the face of attack
  - Sealed Key Protection (SKP)
  - Role of Apple File System
  - Keychain data protection
- - Volume encryption with FileVault
  - Managing FileVault
- - Protecting app access to user data
  - Protecting access to user’s health data
- Digital signing and encryption
- App security overview
- - Intro to app security for iOS and iPadOS
  - About App Store security
  - App code signing process
  - Security of runtime process
  - Supporting extensions
  - App protection and app groups
- - Intro to app security for macOS
  - App code signing process
  - Gatekeeper and runtime protection
  - Protecting against malware
  - Controlling app access to files
- Secure features in the Notes app
- Secure features in the Shortcuts app
- Services security overview
- - Apple ID security
  - Managed Apple ID security
- - iCloud security overview
  - iCloud encryption
  - Advanced Data Protection for iCloud
  - Security of iCloud Backup
  - iCloud Private Relay security
  - Account recovery contact security
  - Legacy Contact security
- - Passcode security overview
  - Sign in with Apple security
  - Automatic strong passwords
  - Password AutoFill security
  - App access to saved passwords
  - Password security recommendations
  - Password Monitoring
  - Sending passwords
  - Credential provider extensions
  - - iCloud Keychain security overview
    - Secure keychain syncing
    - Secure iCloud Keychain recovery
    - Escrow security for iCloud Keychain
- - Apple Pay security overview
  - Apple Pay component security
  - How Apple Pay keeps users’ purchases protected
  - - Card provisioning security overview
    - Adding credit or debit cards to Apple Pay
  - Payment authorisation with Apple Pay
  - Paying with cards using Apple Pay
  - Contactless passes in Apple Pay
  - Rendering cards unusable with Apple Pay
  - Apple Card security
  - Apple Cash security
  - Tap to Pay on iPhone
- - Access using Apple Wallet
  - Access key types
  - Car key security
  - Adding travel and eMoney cards to Apple Wallet
  - - IDs in Apple Wallet
    - Security of IDs in Apple Wallet
- - iMessage security overview
  - How iMessage sends and receives messages
  - Secure iMessage name and photo sharing
- Secure Apple Messages for Business
- FaceTime security
- - Find My security
  - Locating missing devices
- - Continuity security overview
  - Handoff security
  - iPhone mobile call relay security
  - iPhone Text Message Forwarding security
  - Instant Hotspot security
- Network security overview
- TLS security
- IPv6 security
- VPN security
- - Secure access to wireless networks
  - Wi-Fi privacy
- Bluetooth security
- Ultra Wideband security in iOS
- Single sign-on security
- AirDrop security
- Wi-Fi password sharing security on iPhone and iPad
- Firewall security in macOS
- Developer kit security overview
- - Communication security
  - Data security
  - Securing routers with HomeKit
  - Camera security
  - Security with Apple TV
- SiriKit security
- WidgetKit security
- DriverKit security
- ReplayKit security
- ARKit security
- Secure device management overview
- Pairing model security
- - MDM security overview
  - Configuration enforcement
  - Automated Device Enrolment
  - Activation Lock security
  - Managed Lost Mode and remote wipe
  - Shared iPad security
- Apple Configurator security
- Screen Time security
Glossary
Document revision history
Copyright

Apple uses a technology called Data Protection to protect data stored in flash storage on the devices that feature an Apple SoC — such as iPhone, iPad, Apple Watch, Apple TV and a Mac with Apple silicon. With Data Protection, a device can respond to common events, such as incoming phone calls, while at the same time providing a high level of encryption for user data. Certain system apps (such as Messages, Mail, Calendar, Contacts, Photos) and Health data values use Data Protection by default. Third-party apps receive this protection automatically.

Implementation

Data Protection is implemented by constructing and managing a hierarchy of keys and builds on the hardware encryption technologies built into Apple devices. Data Protection is controlled on a per-file basis by assigning each file to a class; accessibility is determined according to whether the class keys have been unlocked. APFS (Apple File System) allows the file system to further subdivide the keys into a per-extent basis (where portions of a file can have different keys).

Every time a file on the data volume is created, Data Protection creates a new 256-bit key (the per-file key) and gives it to the hardware AES Engine, which uses the key to encrypt the file as it’s being written to flash storage. On A14 to A17 and M1 to M3 devices, the encryption uses AES-256 in XTS mode, where the 256-bit-per-file key goes through a Key Derivation Function (NIST Special Publication 800-108) to derive a 256-bit tweak and a 256-bit cipher key. On A9 to A13 and S5 to S9 devices, the encryption uses AES-128 in XTS mode, where the 256-bit-per-file key is split to provide a 128-bit tweak and a 128-bit cipher key.

On a Mac with Apple silicon, Data Protection defaults to Class C (see Data Protection classes) but utilises a volume key rather than a per-extent or per-file key — effectively recreating the security model of FileVault for user data. Users must still opt in to FileVault to receive the full protection of entangling the encryption key hierarchy with their password. Developers can also opt in to a higher protection class that uses a per-file or per-extent key.

See alsoInternal volume encryption and FileVaultAutomatic strong passwords

Download this guide as a PDF

Helpful?

Thanks for your feedback.