14.7 · Trust in practice: pinning by public key, ATS scope, code signatures and Secure Enclave keys

Where do trust decisions actually happen? In the certificate check on every connection, in the policy that allows a connection at all, in the signature the kernel checks on every launch, and in keys that never leave hardware.

Mental model. Trust is decided by code you can run: a hash comparison, a policy table, a signature check. Run them and the folklore becomes testable.

The connection

Pinning a public key and the exact reach of App Transport Security.

  1. How do you compute a public-key (SPKI) pin, how does the system evaluate a trust object with a custom anchor, and what does that prove? 14.7.1 · L5
    Pinning by public key survives certificate renewal as long as the key pair is reused, which is why it is preferred over pinning the certificate (Q317). The pin…
  2. What exactly does App Transport Security block, which Info.plist keys unlock what, and what do you see when it blocks a request? 14.7.2 · L3
    ATS applies to app bundles: a bare command-line tool run in the simulator fetched plain http://example.com successfully, while the same code packaged as an…

The binary and the key

What a code signature protects, and how Secure Enclave keys behave.

  1. What does a code signature actually protect, what does it not say about the signer, and what happens when a signed binary is modified? 14.7.3 · L3
    A code signature stores, in the binary’s CodeDirectory, a hash for each page of the code and for the resources and entitlements, and the signature covers that…
  2. How does a Secure Enclave key behave in code: what is stored, what can be restored, and what can you not do with it? 14.7.4 · L3
    A Secure Enclave key is created inside the coprocessor and its private part never leaves it, so what your app keeps is a dataRepresentation: an opaque blob…

More in Security & privacy