Mac OS 9 Keychain Encryption Algorithms

This article provides an overview of the encryption algorithms and security mechanisms used to protect keychain data in Apple’s Mac OS 9. It explains the specific cipher used to secure sensitive credentials stored on disk, the key derivation process from the user's master password, and how these legacy standards compared to the modern cryptography Apple implemented in later operating systems.

The Primary Cipher: RC4

In Mac OS 9, the Keychain Manager relied on RC4 (Rivest Cipher 4) as the primary symmetric stream cipher to encrypt sensitive data stored inside keychain files on disk.

When a user saved passwords, private keys, or secure notes in Mac OS 9, the Keychain Manager stored the entries within a single file in the System Folder:Preferences:Keychains directory. While general metadata (such as application names, account labels, and creation dates) remained unencrypted to allow the system to search and index entries quickly, the actual secrets—specifically the password payloads—were encrypted using RC4.

Key Derivation and Hashing

To lock and unlock the keychain, the operating system derived an encryption key from the user’s master keychain password:

• Password Hashing: The system processed the plaintext passphrase using one-way cryptographic hash functions, typically MD5 or SHA-1, to generate a fixed-length key suitable for the RC4 cipher.
• Key Lengths and Export Controls: Because Mac OS 9 was released in the late 1990s during the transition out of strict U.S. cryptographic export regulations, early releases were restricted to smaller key sizes (such as 40-bit or 56-bit RC4) for international distributions, while domestic versions used full 128-bit RC4 keys. Subsequent updates and the easing of export rules allowed 128-bit encryption to become standard.

File Structure and Security Limitations

The architecture of the Mac OS 9 keychain was designed primarily around convenience rather than resilience against modern cryptanalysis:

• Selective Encryption: The keychain file did not encrypt the entire database container. Instead, only the sensitive attribute fields of each record were encrypted, leaving record headers and identifiers readable.
• Stream Cipher Vulnerabilities: Because RC4 is a stream cipher, improper nonce or key reuse across entries could expose keystreams to known-plaintext attacks.

Transition to Mac OS X

Following the transition from Classic Mac OS to Mac OS X, Apple deprecated the RC4-based Keychain Manager. Mac OS X rebuilt the keychain infrastructure on top of the Common Security Architecture (CDSA), replacing RC4 initially with Triple DES (3DES) in Mac OS X 10.3 Panther, and eventually adopting 128-bit and 256-bit AES (Advanced Encryption Standard) for modern disk-level keychain protection.