The macOS Keychain and the Secure Enclave - Cryptographic Services, Data Protection Classes, and FileVault Internals #1008127

Every secret on a Mac — a password, a signing key, a Wi-Fi credential, a TLS client certificate — lives behind a cryptographic stack that most developers never see. This book takes it apart.

It begins with the Keychain: how securityd mediates every access, why macOS has two distinct implementations (file-based with ACLs, Data Protection with access groups), and which one modern code should target. From there it covers the SecItem API in full — add, copy, update, delete — with working Swift wrappers, error-code tables, and the parameter-block semantics that trip up most developers. It examines item classes, access control flags, biometric gates through LAContext, and the difference between .biometryAny and .biometryCurrentSet.

The second half moves down the stack. It covers the Secure Enclave — the UID key, sepOS, the Memory Protection Engine, anti-replay, and key attestation — and the CryptoKit API that exposes P-256 operations inside the SEP. It walks Data Protection classes A through D, explaining how per-file keys are wrapped with class keys and entangled with the passcode. It covers FileVault's VEK → KEK → media key hierarchy, the anti-replay mechanism that protects against downgrade, fast wipe, and recovery key management. It examines the five keybag types (User, Device, Backup, Escrow, iCloud), the keybag rotation problem, and enterprise escrow through MDM.

Real code throughout — SecItemAdd, SecItemCopyMatching, SecAccessControlCreateWithFlags, SecureEnclave.P256.Signing.PrivateKey, fdesetup, sysadminctl, sc_auth, security dump-keychain — with terminal output you can reproduce on your own machine. Written for security engineers, systems programmers, and anyone who needs to understand where secrets actually live on macOS.