What is the Secure Enclave on iPhone?
A small, separate computer inside your iPhone whose job is to keep keys it never hands out.
In short
The Secure Enclave is a dedicated security subsystem built into the iPhone’s chip since iPhone 5s, isolated from the main processor. It protects Face ID and Touch ID data and the keys behind your iPhone’s encryption, and is designed to keep them safe even if the main operating system is compromised. Apps can ask it to create and use keys, but can never read those keys out.
Key takeaways
- Its own processor, protected memory and secure boot.
- It helps enforce the limit on passcode attempts.
- Apps can use keys inside it but can’t extract them.
A computer inside the computer
Your iPhone’s main processor runs iOS and every app. The Secure Enclave is apart from all that: a dedicated processor running its own small operating system, with memory that is encrypted and authenticated so the rest of the chip can’t read or tamper with it. Apple describes it as designed to keep sensitive data secure even if the iOS kernel is compromised.
It is present in every iPhone from iPhone 5s onwards, and in iPad, Macs with Apple silicon, Apple Watch and other Apple devices.
What it protects
- Face ID and Touch ID data, which is processed and protected inside the Secure Enclave and tied to your device.
- The keys behind data protection. The key hierarchy behind your iPhone’s file encryption includes a unique key fused into the chip at manufacture, which Apple says isn’t available to Apple or its suppliers.
- Your passcode. Unlock attempts go through the Secure Enclave; on recent devices, a dedicated secure storage component counts them and erases the protected data once the limit is exceeded — for example, 10 attempts on iPhone.
Keys that can be used but not seen
The core idea is simple. The Secure Enclave has its own encryption engine whose hardware keys stay inside it, out of reach even of the Secure Enclave’s own software. The rest of the system can ask it to encrypt or decrypt, and gets the result back — but it can never ask for the key itself.
What apps can do with it
Apps can ask the Secure Enclave to create a private key and keep it. The app never holds that key in plain text: it sends data in and receives the output, such as a signature or the result of a key exchange used for encryption. An app can also require Face ID, Touch ID or the passcode before the key can be used. Apple’s developer documentation lists the trade-offs:
- One kind of key: 256-bit elliptic-curve keys (NIST P-256), used for signatures and key agreement — and, through that, for encryption.
- No importing: keys must be created inside the Secure Enclave. There is no way to move a plain key in or out.
- One device: only the Secure Enclave that created a key can use it.
What it doesn’t do
The Secure Enclave protects keys, not what is on screen. Once your iPhone is unlocked, apps read their data normally, and anyone holding the unlocked phone sees what those apps show. And because its keys never leave the device, data protected only by them can’t follow you to a new iPhone: an app that relies on the Secure Enclave needs a separate, safe way to restore.
How Latent uses it
Latent protects each vault key with a key held in the Secure Enclave, unlocked by your pattern or password. Copying the app’s files off the phone yields encrypted data and nothing else. Because that key can’t leave your iPhone, restoring a vault on a new one uses your nine-word recovery phrase instead.