How Passkeys Use the Secure Enclave in iOS 16

Passkeys in iOS 16 replace traditional passwords by leveraging public-key cryptography, the device’s Secure Enclave, and end-to-end encrypted iCloud Keychain syncing. When a user creates a passkey, iOS 16 establishes a hardware-anchored, asymmetric cryptographic key pair that allows seamless authentication without exposing secrets to external servers. This article explains how the Secure Enclave enforces physical isolation, manages biometric authorization, and protects these cryptographic keys during creation and sign-in operations.

In iOS 16, passkeys are built on the FIDO Alliance and W3C WebAuthn standards, relying on asymmetric public-key cryptography. Every passkey consists of a public key, which is sent to and stored by the website or app (the relying party), and a private key, which never leaves the user’s ecosystem. The cryptographic operations governing the authentication challenges are tied directly to the hardware-based security architecture of the Apple device.

Because passkeys are designed to sync across a user's Apple devices, their relationship with the Secure Enclave differs from traditional hardware-bound private keys. A standard Secure Enclave private key is permanently bound to a single physical chip and can never be exported. To enable multi-device availability while maintaining hardware-level defense, iOS 16 uses the Secure Enclave as the root of trust to manage and protect the iCloud Keychain sync circle rather than burning the passkey's private key directly into non-exportable hardware registers.

When a passkey is generated:

1. The system creates a standard elliptic curve (typically P-256) cryptographic key pair for the specific service domain.
2. The private key is encrypted and stored in the local data protection keychain.
3. Access to this key is governed by access control lists managed by the Secure Enclave, requiring explicit local verification via Face ID, Touch ID, or the device passcode before the key can be decrypted into memory.

For synchronization, the passkey is encrypted using end-to-end encryption keys managed through the iCloud Keychain escrow architecture. Each participating device uses its local Secure Enclave to generate its own unique device identity key. The iCloud Keychain sync circle establishes cryptographic trust among these hardware-verified devices. The passkey's private key is encrypted in transit and at rest, meaning Apple cannot view the private key or the credentials it unlocks.

During an authentication attempt, the relying party issues a cryptographic challenge. iOS 16 invokes the Secure Enclave to process the user's biometric verification. Once Face ID or Touch ID confirms identity within the isolated processor, the system is authorized to use the private key to sign the server's challenge. The resulting digital signature is returned to the relying party to verify against the public key, completing the login securely without the private key ever leaving the local processing environment.