iOS Security Internals: Entitlements, Code Signing, Keychain and Data Protection — DedSec Project

Go deeper than generic mobile testing by studying iOS trust chains, app identities, entitlements, sandbox containers, keychain access groups, Data Protection classes and secure hardware boundaries.

Learning objectives

By the end of this module you should be able to:

• Explain secure boot chain and code signing and identify its most important trust boundary, state transition, and evidence source.
• Explain application sandbox containers and identify its most important trust boundary, state transition, and evidence source.
• Explain entitlements and capabilities and identify its most important trust boundary, state transition, and evidence source.
• Explain Keychain access groups and identify its most important trust boundary, state transition, and evidence source.
• Explain Data Protection classes and identify its most important trust boundary, state transition, and evidence source.
• Explain Secure Enclave and key handling and identify its most important trust boundary, state transition, and evidence source.

Deep concepts

1. secure boot and code signing

iOS uses a hardware-rooted boot chain and mandatory code-signing model to establish platform integrity. Security review should distinguish platform trust, application signing, provisioning, and runtime authorization rather than treating them as one control.

2. sandbox containers

Applications receive isolated containers and restricted system interfaces. Data leakage often comes from deliberately shared surfaces—extensions, pasteboard, app groups, URL handling, cloud sync, or exported documents—so review those boundaries explicitly.

3. entitlements and capabilities

Entitlements declare privileged platform capabilities such as application groups, keychain sharing, associated domains, or special services. Compare the signed entitlement set with actual product requirements and remove capabilities that are no longer needed.

4. Keychain access groups

Keychain access groups control which signed applications can share stored credentials. Review group membership, accessibility class, synchronization, and recovery behavior so a helper/extension does not inherit more secret access than intended.

5. Data Protection classes

iOS Data Protection ties file encryption behavior to device lock state and key availability. Select protection classes according to when the application genuinely needs data, and test backup/export paths because copies can have different protection semantics.

6. Secure Enclave and key handling

Secure Enclave-backed keys can keep private key material outside the normal application processor while still allowing authorized operations. Define user-presence/biometric requirements, fallback behavior, device migration, and what happens when credentials must be recovered.

7. privacy permissions

Camera, microphone, photos, location, contacts, Bluetooth, and tracking-related access require platform and application-level justification. Request permission only when needed, handle denial safely, and avoid collecting a broader data set than the feature requires.

8. managed-device and enterprise trust

MDM can install configuration, certificates, network settings, managed apps, and restrictions according to organization policy. Enterprise security should separate device management authority from application identity and audit high-impact profile or certificate changes.

Authorized lab sequence

• Lab 1 — Design an iOS app threat model using only public architecture documentation and a fictional app.

• Lab 2 — Compare storage choices for a sample token: plain file, protected file and Keychain, documenting security properties rather than extracting secrets.

• Lab 3 — Map a fictional app’s entitlements to least-privilege requirements and flag unnecessary capabilities.

Knowledge checks

Answer these without looking at the notes:

Next modules

Recommended related modules: 017, 039, 054, 056, 082, 103. From the main menu, choose Search lessons to find related sections across the full guide.