VEYRNOX · Learn · iOS Secure Enclave
iOS Secure Enclave
The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware. Keys created inside the Enclave cannot be exported — they can only be used for on-chip signing or decryption.
How it works
The Secure Enclave runs a separate operating system (sepOS) with its own memory and boot chain. When an app requests a key of a supported type (Elliptic Curve P-256), the Enclave generates it internally and returns a reference — never the raw key material. Subsequent signing operations pass the data to the Enclave, which signs and returns the signature. Face ID and Touch ID authentication is enforced by the Enclave before releasing keys guarded by biometric policy.
Why it matters
A key that never leaves hardware is a key that cannot be stolen by malware, extracted by an OS exploit, or lifted from a memory dump. For a wallet, this raises the bar from "attacker needs software access" to "attacker needs the physical device and biometric enrolment". The trade-off is a P-256 signing surface only — Enclave keys sign Bitcoin, Ethereum, and Solana transactions via wrapping schemes rather than native curves.
Related concepts
- Android StrongBox — StrongBox is a tamper-resistant hardware element on modern Android devices that backs the Android Keystore.
- KEK (Key Encryption Key) — A KEK — Key Encryption Key — is a cryptographic key used to encrypt other keys rather than user data directly.
- Biometric Authentication — Biometric authentication uses a physical characteristic — fingerprint, face, iris — to authorise access.
- AES-256-GCM — AES-256-GCM is Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode.
Frequently asked questions
Can the Secure Enclave hold Bitcoin or Ethereum keys directly?
Not on native curves (secp256k1 or Ed25519). Wallets wrap the on-chain key with an Enclave-protected P-256 key.
What happens if I restore the phone from backup?
Secure Enclave keys are not backed up. A restore triggers Veyrnox recovery from your Shamir shards.
Is StrongBox the Android equivalent?
Yes — StrongBox is the tamper-resistant hardware backing Android Keystore.
In Veyrnox
Veyrnox binds the wallet KEK to a Secure Enclave key at onboarding. The vault is decrypted only after the Enclave releases the KEK under biometric or PIN gating. The seed itself is Shamir-sharded and never sits decrypted on disk.