way to attest that a Secure Enclave key is hardware-bound on macOS

Question

Created 1w

Replies 1

Boosts 0

Participants 2

We generate Secure Enclave keys via SecKeyCreateRandomKey with kSecAttrTokenIDSecureEnclave on macOS. We need to prove to a remote server that the key is genuinely hardware-bound, not a software key claiming to be one.

Is there any API on macOS for an app to obtain an Apple-signed certificate or attestation statement for such a Secure Enclave key, similar to how ASAuthorizationProviderExtensionLoginManager.attestKey() works within Platform SSO but available to general apps? Or other possible workaround for this? Thank you!

Answered by DTS Engineer in 886552022

I don’t think there’s a good way to do that. I’m not even sure how that’d work, because the only info you can extract from the key is the public key bits, and there’s nothing special about those.

Realistically, you need something like App Attest, to give you a signal that the device as a whole can be trusted. Sadly, that’s not available on macOS.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

1w

Recommended

I don’t think there’s a good way to do that. I’m not even sure how that’d work, because the only info you can extract from the key is the public key bits, and there’s nothing special about those.

Realistically, you need something like App Attest, to give you a signal that the device as a whole can be trusted. Sadly, that’s not available on macOS.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0