Welcome
Intro to Apple platform security
Hardware security and biometrics
System security
- System security overview
- Secure boot
  - Boot process for iPad and iPhone devices
  - Memory safe iBoot implementation
  - Mac computers with Apple silicon
  - Intel-based Mac computers
- Signed system volume security
- Secure software updates
- Background Security Improvements
- Operating system integrity
- Device pairing and connection security
- BlastDoor for Messages and IDS
- Lockdown Mode security
- Overview of additional macOS system security capabilities
- System security for watchOS
- Random number generation
- Communicating emergency information using satellites
- Apple Security Research Device
Encryption and Data Protection
- Encryption and Data Protection overview
- Quantum-secure cryptography with Apple devices
- Passcodes and passwords
- Data Protection
- FileVault
  - Volume encryption with FileVault
  - Managing FileVault
- How Apple protects users personal data
  - Protecting app access to user data
  - Protecting access to user health data
- Digital signing and encryption
App security
- App security overview
- App code signing process
- App security in iOS, iPadOS and visionOS
- App security in macOS
- Supporting extensions
- Secure features in the Notes app
- Secure features in the Shortcuts app
Services security
- Services security overview
- Apple Account and Managed Apple Account
  - Apple Account security
  - Managed Apple Account security
- iCloud
- Passcode and password management
- Apple Pay
- Using Apple Wallet
  - Access using Apple Wallet
  - Access key types
  - Car key security
    - Car key security
    - Car key transactions
  - Adding travel and eMoney cards to Apple Wallet
  - IDs in Apple Wallet
    - IDs in Apple Wallet
    - Security of IDs in Apple Wallet
- iMessage
- Secure Apple Messages for Business
- FaceTime security
- Find My
  - Find My security
  - Locating missing devices
- Continuity
Network security
Developer kit security
Secure device management
Glossary
Document revision history
Copyright and trademarks

Escrow security for iCloud Keychain

iCloud provides a secure infrastructure for keychain escrow to help ensure that only authorised users and devices can perform a recovery. Topographically positioned behind iCloud are clusters of hardware security modules (HSMs) that guard the escrow records. As described previously, each has a key thats used to encrypt the escrow records under their watch.

To recover a keychain, users must authenticate with their iCloud account and password and respond to an SMS sent to their registered phone number. After this is done, users must enter their iCloud security code. The HSM cluster verifies that a user knows their iCloud security code using the Secure Remote Password (SRP) protocol; the code itself isnt sent to Apple. Each member of the cluster independently verifies that the user hasnt exceeded the maximum number of attempts allowed to retrieve their record, as discussed below. If a majority agree, the cluster unwraps the escrow record and sends it to the users device.

The device uses the escrowed data to unwrap the random keys used to encrypt the users keychain. With that key, the keychain retrieved from CloudKit and iCloud key-value storage is decrypted and restored onto the device. The escrow service allows only 10 attempts to authenticate and retrieve an escrow record. After several failed attempts, the record is locked and the user must call Apple Support to be granted more attempts. After the 10th failed attempt, the HSM cluster destroys the escrow record and the keychain is lost forever. This provides protection against a brute-force attempt to retrieve the record, at the expense of sacrificing the keychain data in response.

These policies are coded in the HSM firmware. The administrative access cards that permit the firmware to be changed have been destroyed. Any attempt to alter the firmware or access the private key causes the HSM cluster to delete the private key. Should this occur, the owner of each keychain protected by the cluster receives a message informing them that their escrow record has been lost. They can then choose to re-enrol.

Published Date: 07 May 2024

Previous Secure iCloud Keychain recovery Next Apple Pay security overview

Helpful?

Yes No

Apple Platform Security

Escrow security for iCloud Keychain

Apple Footer