security//secure enclave

A secure enclave is an isolated processor inside a device that generates and stores private keys and performs operations with them, without ever letting the keys out to the main operating system. Phones use it for biometric unlock, payments and app keys; laptops carry a similar chip (a **TPM**); servers that sign at scale use a separate **hardware security module** (HSM).

A secure enclave is an isolated processor inside a device that generates and stores private keys and performs operations with them, without ever letting the keys out to the main operating system. Phones use it for biometric unlock, payments and app keys; laptops carry a similar chip (a TPM); servers that sign at scale use a separate hardware security module (HSM).

The point is the interface. A program can ask the enclave to create a key, to sign some bytes with it or to perform a key exchange, and receives the result; it cannot ask for the key itself, because no such operation exists. Malware that takes over the phone can still request signatures while it is running, but it cannot copy the key to use elsewhere or later. The enclave can also demand a condition before each use, such as a fingerprint or a face scan.

A key that cannot be exported cannot be stolen in bulk.

Theft has to happen on the device, one operation at a time and under whatever gate the enclave enforces, instead of once by copying a file.

The enclave fixes the algorithms. Apple's Secure Enclave handles only NIST P-256 elliptic-curve keys, so an SSH key created inside it is an ECDSA P-256 key rather than Ed25519; a server accepts either, since SSH treats the algorithm as a detail.

Non-exportable keys cannot be backed up. Losing the device loses the key, so every service that trusts it needs a second way in or a way to register a new key.

It does not protect what the key authorises. A stolen phone with a weak unlock gate can still sign logins, which is why the public key should be removable from the server the moment the device is lost (public-key cryptography).