iOS Internals · Locks & Encryption · Lesson 1 of 5

The Secure Enclave

Meet the vault inside your iPhone's chip that checks passcodes and guards keys.

A vault inside the chip

Inside the main chip of every recent iPhone sits a smaller, walled-off computer called the Secure Enclave. It's a separate processor with its own startup code, its own protected memory and its own encryption hardware. Apple built it so your most sensitive secrets stay safe even if the main processor, where iOS and your apps run, were ever taken over by an attacker.

Picture the main processor as a busy office and the Secure Enclave as a small vault room inside it. People in the office can pass a request through a slot in the door, such as "is this the right passcode?", and get a yes or no back. They can never walk in and read what's on the shelves.

Here's what the Secure Enclave handles:

• Passcode checks. When you type your passcode, the Secure Enclave is the part that decides whether it's right.
• Face ID and Touch ID data. The math that describes your face or fingerprint is stored and compared here. iOS and apps only ever hear "match" or "no match".
• Encryption keys. Each Secure Enclave has a UID (unique ID), a secret key built into the chip when it's made. It can't be read out, not even by iOS, and it isn't linked to any other identifier on the phone.

The UID is the clever part. Your passcode is mixed with it to make the keys that protect your data. Apple calls this entangling the passcode with the UID. Because the UID never leaves the chip, Apple says your passcode can't be learned by sending guesses from anywhere other than that phone's own Secure Enclave.

So copying the storage chip onto a powerful computer doesn't help an attacker. Every guess has to go through that one phone, at the speed the phone allows. Apple tunes the key-making math so that each attempt takes about 80 milliseconds, even before any extra waiting is added. You'll see in the next task how that waiting grows.

Making guessing slow

A short passcode doesn't have that many combinations. A 6-digit passcode has a million. If a phone let someone try them as fast as possible, a patient attacker could get through a lot of them. So iOS adds a growing wait after wrong guesses, and Apple says the Secure Enclave enforces it, not iOS. That means a compromised iOS can't simply skip the wait.

Here's the delay Apple lists for the iPhone Lock Screen:

• 1 to 3 wrong attempts: no delay
• 4th attempt: 1 minute
• 5th attempt: 5 minutes
• 6th attempt: 15 minutes
• 7th attempt: 1 hour
• 8th attempt: 3 hours
• 9th attempt: 8 hours
• 10 or more: the iPhone stops accepting guesses

Two details make this harder to cheat. Typing the same wrong passcode again doesn't count as a new attempt, so a toddler hammering one number doesn't burn through your tries as fast. And restarting the phone during a delay doesn't cancel it. The timer starts over for that period.

Once an iPhone stops accepting guesses, the only way back in is to erase it. That's why a backup matters.

There's also an optional setting called Erase Data. You'll find it at the bottom of Settings, Face ID & Passcode (or Touch ID & Passcode). With it on, Apple says that after 10 wrong passcodes in a row, all content and settings are removed. Because everything on the phone is encrypted, erasing just means destroying the keys, which is fast and thorough.

Is Erase Data right for you? It's a strong choice if you worry about someone guessing your passcode. It's riskier if small children play with your phone, or if you don't have a recent backup. The delays alone already make guessing a 6-digit passcode take an extremely long time, and a longer passcode with letters helps even more.