14.2 · LocalAuthentication, the Secure Enclave, and App Attest

Authenticating the person (Face ID), protecting keys in hardware (Secure Enclave) and proving the app is genuine (App Attest) are three different jobs that people often mix up.

Mental model. Biometrics are a convenient way to unlock a secret, not a secret themselves. The security comes from what the unlock protects.

The user and the device

Biometrics and the Secure Enclave.

1. How do Face ID and Touch ID with LocalAuthentication work, and what does the Secure Enclave add? 14.2.1 · L3
   LocalAuthentication (LAContext) asks the system to verify the user: canEvaluatePolicy(_:error:) checks availability first, and…

The app

App Attest and DeviceCheck: what they prove, and what they do not.

1. What do App Attest and DeviceCheck prove, when do they help, and what are their limits? 14.2.2 · L5
   App Attest (the DeviceCheck framework’s DCAppAttestService) lets your server ask: “is this request coming from a genuine, unmodified instance of my app on a…

More in Security & privacy

• 14.1 · Hashing, MACs, encryption and signatures with CryptoKit
• 14.3 · Privacy manifests, tracking and ATT, and everyday data hygiene
• 14.4 · Deep links, secrets in the binary, and jailbreak detection
• 14.5 · A threat model for a consumer app
• 14.6 · CryptoKit in practice: AEAD, key agreement, signatures, one-time codes and tokens
• 14.7 · Trust in practice: pinning by public key, ATS scope, code signatures and Secure Enclave keys
• 14.8 · Defensive coding: secure decoding, injection, dependency integrity and file protection