Security provides the core services your app uses to protect data and verify identity: keychain access, certificates, trust evaluation, cryptography, and TLS cipher suites. Store and retrieve secrets through SecKeychain and SecKeychainItem, guard them with SecAccess, SecACL, and SecAccessControl, and work with cryptographic material using SecKey, SecCertificate, and SecIdentity. Evaluate signing and trust with SecPolicy, SecCode, SecStaticCode, and SecRequirement, encode and decode signed messages through CMSEncoder and CMSDecoder, and select transport security with SSLCiphersuiteGroup. The framework is available on iOS, macOS, tvOS, watchOS, and visionOS.
Keychain Storage 15
Store, search, and protect secrets in the system keychain.
- ClSecKeychainmacOS 10.0+@typedef SecKeychainRef
- ClSecKeychainItem@typedef SecKeychainItemRef
- ClSecKeychainSearch@typedef SecKeychainSearchRef
- ClSecPassword@typedef SecPasswordRef
- StSecKeychainAttribute@struct SecKeychainAttribute
- StSecKeychainAttributeList@typedef SecKeychainAttributeList
- StSecKeychainAttributeInfo@typedef SecKeychainAttributeInfo
- StSecKeychainSettings@typedef SecKeychainSettings
- StSecKeychainEventMask@enum KeychainEventConstants
- StSecKeychainCallbackInfo@typedef SecKeychainCallbackInfo
- StSecKeychainPromptSelectorOptions that control when the system prompts the user during keychain access.
- EnSecKeychainEvent@enum KeychainEventConstants
- EnSecItemClass@enum ItemClassConstants
- EnSecItemAttr@enum ItemAttributeConstants
- EnSecPreferencesDomainConstants that identify the preference domain a keychain search list belongs to.
Access Control 5
Govern which applications and operations may use a protected item.
- ClSecAccess@typedef SecAccessRef
- ClSecACL@typedef SecACLRef
- ClSecAccessControl@typedef SecAccessControl
- StSecAccessControlCreateFlagsmacOS 10.10+@typedef SecAccessControlCreateFlags
- ClSecTrustedApplication@typedef SecTrustedApplicationRef
Cryptographic Keys and Certificates 5
Represent cryptographic keys, certificates, and combined identities.
- ClSecKey@typedef SecKeyRef
- ClSecCertificate@typedef SecCertificateRef
- ClSecIdentity@typedef SecIdentityRef
- ClSecIdentitySearch@typedef SecIdentitySearchRef
- StSecKeyUsage@typedef SecKeyUsage
Trust Evaluation 8
Evaluate certificate chains and trust policies, and configure trust settings.
- ClSecTrust@typedef SecTrustRef
- ClSecPolicy@typedef SecPolicyRef
- ClSecPolicySearch@typedef SecPolicySearchRef
- EnSecTrustResultType@typedef SecTrustResultType
- EnSecTrustSettingsResult@enum SecTrustSettingsResult
- EnSecTrustSettingsDomainConstants that identify the domain in which trust settings are stored.
- StSecTrustSettingsKeyUsageFlags that constrain the key usages permitted by a trust setting.
- StSecTrustOptionFlags@typedef SecTrustOptionFlags
Key Import and Export 6
Convert keys and certificates to and from external interchange formats.
- StSecItemImportExportFlagsFlags that control the import and export of keychain items.
- StSecKeyImportExportFlagsFlags that control the import and export of cryptographic keys.
- StSecKeyImportExportParametersA structure that holds parameters governing key import and export.
- StSecItemImportExportKeyParametersA structure that holds key-specific parameters for item import and export.
- EnSecExternalFormatConstants that specify the external data format for imported or exported keys and certificates.
- EnSecExternalItemTypeConstants that specify the type of an imported or exported security item.
Code Signing and Trust 9
Inspect running and on-disk code against signing requirements.
- ClSecCode@typedef SecCodeRef
- ClSecStaticCode@typedef SecStaticCodeRef
- ClSecRequirement@typedef SecRequirementRef
- ClSecTask@typedef SecTaskRef
- EnSecRequirementType@typedef SecRequirementType
- EnSecCSDigestAlgorithmTypes of cryptographic digests (hashes) used to hold code signatures
- StSecCSFlags@typedef SecCSFlags
- StSecCodeSignatureFlags@typedef SecCodeSignatureFlags
- StSecCodeStatus@typedef SecCodeStatus
Cryptographic Message Syntax 5
Encode and decode signed and encrypted CMS messages.
- ClCMSEncoderAn object that creates signed or encrypted Cryptographic Message Syntax (CMS) messages.
- ClCMSDecoderAn object that decodes and verifies Cryptographic Message Syntax (CMS) signed or encrypted messages.
- StCMSSignedAttributesOptions that specify which signed attributes to include in a CMS message.
- EnCMSSignerStatusConstants that describe the verification status of a CMS message signer.
- EnCMSCertificateChainModeConstants that specify which certificates to include in a CMS signed message.
Authorization Services 4
Request and serialize user authorization rights.
- StAuthorizationFlags@typedef AuthorizationFlags
- StAuthorizationItem@typedef AuthorizationItem
- StAuthorizationItemSet@typedef AuthorizationItemSet
- StAuthorizationExternalForm@typedef AuthorizationExternalForm
Transport Security 7
Select TLS protocol versions and cipher suites for secure connections.
- EnSSLCiphersuiteGroupmacOS 10.14+Constants that identify predefined groups of TLS cipher suites by security profile.
- EnSSLProtocol@enum SSLProtocol enumeration
- EnSecProtocolType@enum ProtocolTypeConstants
- EnSecAuthenticationTypeConstants that specify the authentication scheme of an internet keychain item.
- Entls_protocol_version_tmacOS 10.15+@enum tls_protocol_version_t enumeration
- Entls_ciphersuite_t@enum tls_ciphersuite_t enumeration
- Entls_ciphersuite_group_tmacOS 10.15+@enum tls_ciphersuite_group_t enumeration
Secure Transport Protocol Objects 6
Underlying object protocols backing modern secure-connection metadata.
- PrOS_sec_objectA `sec_object` is a generic, ARC-able type wrapper for common CoreFoundation Security types.
- PrOS_sec_protocol_metadataA `sec_protocol_metadata` instance conatins read-only properties of a connected and configured
- PrOS_sec_protocol_optionsA `sec_protocol_options` instance is a container of options for security protocol instances,
- PrOS_sec_trustThese are os_object compatible and ARC-able wrappers around existing CoreFoundation
- PrOS_sec_identityA protocol describing an identity object used in secure-transport connections.
- PrOS_sec_certificateA protocol describing a certificate object used in secure-transport connections.
Transforms 1
Attributes for the data-transform pipeline used by cryptographic operations.
- EnSecTransformMetaAttributeType@enum Custom Transform Attribute Metadata
ASN.1 Encoding 3
Low-level structures for ASN.1 templates and encoded key information.
- StSecAsn1AlgIdA structure that holds an ASN.1-encoded algorithm identifier.
- StSecAsn1PubKeyInfoA structure that holds ASN.1-encoded public key information.
- StSecAsn1Template_structA structure that defines an ASN.1 encoding or decoding template.
Certificate Extension Structures 29
Decoded representations of X.509 certificate and CRL extensions.
- St__CE_GeneralNameTypeAn enumeration of the kinds of general names found in a certificate extension.
- St__CE_OtherNameA structure that represents an otherName entry in a certificate general name.
- St__CE_GeneralNameA structure that represents a single general name in a certificate extension.
- St__CE_GeneralNamesA structure that holds a sequence of certificate general names.
- St__CE_AuthorityKeyIDA structure that represents the authority key identifier extension of a certificate.
- St__CE_ExtendedKeyUsageA structure that represents the extended key usage extension of a certificate.
- St__CE_BasicConstraintsA structure that represents the basic constraints extension of a certificate.
- St__CE_PolicyQualifierInfoA structure that holds qualifier information for a certificate policy.
- St__CE_PolicyInformationA structure that represents a single certificate policy entry.
- St__CE_CertPoliciesA structure that holds the certificate policies extension.
- St__CE_CrlDistributionPointNameTypeAn enumeration of the name types used in a CRL distribution point.
- St__CE_DistributionPointNameA structure that represents the name of a CRL distribution point.
- St__CE_CRLDistributionPointA structure that represents a single CRL distribution point.
- St__CE_CRLDistPointsSyntaxA structure that holds a sequence of CRL distribution points.
- St__CE_AccessDescriptionA structure that describes an access location in an authority information access extension.
- St__CE_AuthorityInfoAccessA structure that represents the authority information access extension of a certificate.
- St__CE_SemanticsInformationA structure that holds semantics information for a qualified certificate statement.
- St__CE_QC_StatementA structure that represents a single qualified certificate statement.
- St__CE_QC_StatementsA structure that holds a sequence of qualified certificate statements.
- St__CE_IssuingDistributionPointA structure that represents the issuing distribution point extension of a CRL.
- St__CE_GeneralSubtreeA structure that represents a single subtree in a name constraints extension.
- St__CE_GeneralSubtreesA structure that holds a sequence of general subtrees for name constraints.
- St__CE_NameConstraintsA structure that represents the name constraints extension of a certificate.
- St__CE_PolicyMappingA structure that represents a single policy mapping entry.
- St__CE_PolicyMappingsA structure that holds the policy mappings extension of a certificate.
- St__CE_PolicyConstraintsA structure that represents the policy constraints extension of a certificate.
- St__CE_DataTypeAn enumeration of the data types used within decoded certificate extensions.
- St__CE_DataAndTypeA structure that pairs decoded extension data with its type.
- Stextension_data_formatAn enumeration of the formats used to represent decoded certificate extension data.
CSSM Compatibility Structures 35
Legacy Common Security Services Manager data types retained for compatibility.
- Stcssm_dataA structure that holds a length-prefixed block of opaque data.
- Stcssm_acl_process_subject_selectorA structure that selects a process subject for a CSSM access control list entry.
- Stcssm_acl_keychain_prompt_selectorA structure that configures keychain prompting for a CSSM access control list entry.
- Stcssm_appledl_open_parameters_maskA structure that masks the open parameters for the Apple data storage library.
- Stcssm_appledl_open_parametersA structure that holds open parameters for the Apple data storage library.
- Stcssm_applecspdl_db_settings_parametersA structure that holds database settings parameters for the Apple CSP/DL module.
- Stcssm_applecspdl_db_is_locked_parametersA structure that reports the lock state of an Apple CSP/DL database.
- Stcssm_applecspdl_db_change_password_parametersA structure that holds parameters for changing an Apple CSP/DL database password.
- StCSSM_APPLE_TP_NAME_OIDA structure that associates a name with an object identifier in an Apple trust policy.
- StCSSM_APPLE_TP_CERT_REQUESTA structure that describes a certificate request for the Apple trust policy module.
- StCSSM_APPLE_TP_SSL_OPTIONSA structure that holds SSL-specific options for the Apple trust policy module.
- StCSSM_APPLE_TP_CRL_OPTIONSA structure that holds CRL-checking options for the Apple trust policy module.
- StCSSM_APPLE_TP_SMIME_OPTIONSA structure that holds S/MIME-specific options for the Apple trust policy module.
- StCSSM_APPLE_TP_ACTION_DATAA structure that holds action data passed to the Apple trust policy module.
- StCSSM_TP_APPLE_EVIDENCE_HEADERA structure that heads the evidence returned by an Apple trust policy evaluation.
- StCSSM_APPLE_CL_CSR_REQUESTA structure that describes a certificate signing request for the Apple certificate library.
- Stcssm_kr_nameA structure that names a key recovery entity in CSSM.
- Stcssm_guidA structure that holds a globally unique identifier for a CSSM module.
- Stcssm_versionA structure that holds a major and minor CSSM version number.
- Stcssm_listA structure that represents a linked list of CSSM data elements.
- Stcssm_memory_funcsA structure that holds the memory allocation functions used by a CSSM module.
- Stcssm_parsed_certA structure that holds a parsed representation of a certificate in CSSM.
- Stcssm_authorizationgroupA structure that holds a group of authorization tags in CSSM.
- Stcssm_func_name_addrA structure that pairs a CSSM function name with its address.
- Stcssm_dateA structure that represents a date in CSSM.
- Stcssm_rangeA structure that represents a numeric range in CSSM.
- Stcssm_query_size_dataA structure that reports size data for a CSSM query.
- Stcssm_key_sizeA structure that describes the size of a cryptographic key in CSSM.
- Stcssm_dl_db_handleA structure that holds a handle to a CSSM data storage library database.
- Stcssm_csp_operational_statisticsA structure that reports operational statistics for a CSSM cryptographic service provider.
- Stcssm_parsed_crlA structure that holds a parsed representation of a certificate revocation list in CSSM.
- Stcssm_tp_result_setA structure that holds the result set returned by a CSSM trust policy operation.
- Stcssm_dl_pkcs11_attributesA structure that holds PKCS#11 attributes for a CSSM data storage library.
- Stcssm_name_listA structure that holds a list of names in CSSM.
- Stcssm_db_schema_index_infoA structure that describes index information for a CSSM database schema.
Type Aliases 210
- TyAuthorizationRef@typedef AuthorizationRef
- TyAuthorizationString@typedef AuthorizationString
- TyAuthorizationRights@typedef AuthorizationRights
- TyAuthorizationEnvironment@typedef AuthorizationEnvironment
- TyAuthorizationAsyncCallback@typedef AuthorizationAsyncCallback
- TySecGuestRef@typedef SecGuestRef
- TySSLCipherSuite
- TySecAccessOwnerType
- TySecAsn1Item
- TySecAsn1Oid
- TySecAsn1Template
- TySecAsn1TemplateChooser
- TySecAsn1TemplateChooserPtr
- TySecKeychainAttrType@typedef SecKeychainAttrType
- TySecKeychainAttributePtr@typedef SecKeychainAttributePtr
- TySecKeychainStatus@typedef SecKeychainStatus
Show 194 more
- TySecTransformAttribute@typedef SecTransformAttributeRef
- TySecTransformStringOrAttribute@typedef SecTransformStringOrAttributeRef
- TySecTransformActionBlock@typedef SecTransformActionBlock
- TySecTransformAttributeActionBlock@typedef SecTransformAttributeActionBlock
- TySecTransformDataBlock@typedef SecTransformDataBlock
- TySecTransformInstanceBlock@typedef SecTransformInstanceBlock
- TySecTransformImplementationRef@typedef SecTransformImplementationRef
- TySecTransformCreateFP@typedef SecTransformCreateFP
- TySecKeychainCallback@typedef SecKeychainCallback
- TySecAFPServerSignature@typedef SecAFPServerSignature
- TySecPublicKeyHash@typedef SecPublicKeyHash
- Tysec_protocol_metadata_tA `sec_protocol_metadata` instance conatins read-only properties of a connected and configured
- Tysec_object_tA `sec_object` is a generic, ARC-able type wrapper for common CoreFoundation Security types.
- Tysec_protocol_options_tA `sec_protocol_options` instance is a container of options for security protocol instances,
- Tysec_protocol_pre_shared_key_selection_complete_t@block sec_protocol_pre_shared_key_selection_complete_t
- Tysec_protocol_pre_shared_key_selection_t@block sec_protocol_pre_shared_key_selection_t
- Tysec_protocol_key_update_complete_t@block sec_protocol_key_update_complete_t
- Tysec_protocol_key_update_t@block sec_protocol_key_update_t
- Tysec_protocol_challenge_complete_t@block sec_protocol_challenge_complete_t
- Tysec_protocol_challenge_t@block sec_protocol_challenge_t
- Tysec_protocol_verify_complete_t@block sec_protocol_verify_complete_t
- Tysec_protocol_verify_t@block sec_protocol_verify_t
- Tysec_trust_tThese are os_object compatible and ARC-able wrappers around existing CoreFoundation
- Tysec_identity_t
- Tysec_certificate_t
- TySecTransform
- TySecGroupTransform
- TySecMessageBlock@typedef SecMessageBlock
- TySecTrustCallback@typedef SecTrustCallback
- TySecTrustWithErrorCallback@typedef SecTrustWithErrorCallback
- TyCE_GeneralNameType
- TyCE_ExtendedKeyUsage
- TyCE_CrlNumberCRL extensions
- TyCE_DeltaCrl
- TyCE_DataType
- TyCSSM_ACL_PROCESS_SUBJECT_SELECTOR
- TyCSSM_ACL_KEYCHAIN_PROMPT_SELECTOR
- TyCSSM_ACL_PREAUTH_TRACKING_STATE
- TyCSSM_APPLEDL_OPEN_PARAMETERS
- TyCSSM_APPLEDL_OPEN_PARAMETERS_PTR
- TyCSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS
- TyCSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR
- TyCSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS
- TyCSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR
- TyCSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS
- TyCSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS_PTR
- TyCSSM_APPLE_TP_CRL_OPT_FLAGS
- TyCSSM_APPLE_TP_ACTION_FLAGS
- TyCSSM_TP_APPLE_CERT_STATUS
- Tysint64
- Tyuint64
- Tysint32
- Tysint16
- Tysint8
- Tyuint32
- Tyuint16
- Tyuint8
- TyCSSM_INTPTR
- TyCSSM_SIZE
- TyCSSM_KRSP_HANDLE
- TyCSSM_KR_POLICY_TYPE
- TyCSSM_KR_POLICY_FLAGS
- TyCSSM_CONTEXT_EVENT
- TyCSSM_HANDLE
- TyCSSM_HANDLE_PTR
- TyCSSM_LONG_HANDLE
- TyCSSM_LONG_HANDLE_PTR
- TyCSSM_MODULE_HANDLE
- TyCSSM_MODULE_HANDLE_PTR
- TyCSSM_CC_HANDLE
- TyCSSM_CSP_HANDLE
- TyCSSM_TP_HANDLE
- TyCSSM_AC_HANDLE
- TyCSSM_CL_HANDLE
- TyCSSM_DL_HANDLE
- TyCSSM_DB_HANDLE
- TyCSSM_BOOL
- TyCSSM_RETURN
- TyCSSM_STRING
- TyCSSM_BITMASK
- TyCSSM_KEY_HIERARCHY
- TyCSSM_PVC_MODE
- TyCSSM_PRIVILEGE_SCOPE
- TyCSSM_SERVICE_MASK
- TyCSSM_SERVICE_TYPE
- TyCSSM_MODULE_EVENT
- TyCSSM_MODULE_EVENT_PTR
- TyCSSM_ATTACH_FLAGS
- TyCSSM_PRIVILEGE
- TyCSSM_USEE_TAG
- TyCSSM_NET_ADDRESS_TYPE
- TyCSSM_NET_PROTOCOL
- TyCSSM_WORDID_TYPE
- TyCSSM_LIST_ELEMENT_TYPE
- TyCSSM_LIST_ELEMENT_TYPE_PTR
- TyCSSM_LIST_TYPE
- TyCSSM_LIST_TYPE_PTR
- TyCSSM_LIST_ELEMENT_PTR
- TyCSSM_SAMPLE_TYPE
- TyCSSM_MALLOC
- TyCSSM_FREE
- TyCSSM_REALLOC
- TyCSSM_CALLOC
- TyCSSM_CERT_TYPE
- TyCSSM_CERT_TYPE_PTR
- TyCSSM_CERT_ENCODING
- TyCSSM_CERT_ENCODING_PTR
- TyCSSM_CERT_PARSE_FORMAT
- TyCSSM_CERT_PARSE_FORMAT_PTR
- TyCSSM_CERTGROUP_TYPE
- TyCSSM_CERTGROUP_TYPE_PTR
- TyCSSM_ACL_SUBJECT_TYPE
- TyCSSM_ACL_AUTHORIZATION_TAG
- TyCSSM_ACL_HANDLE
- TyCSSM_ACL_EDIT_MODE
- TyCSSM_PROC_ADDR
- TyCSSM_PROC_ADDR_PTR
- TyCSSM_HEADERVERSION
- TyCSSM_KEYBLOB_TYPE
- TyCSSM_KEYBLOB_FORMAT
- TyCSSM_KEYCLASS
- TyCSSM_KEYATTR_FLAGS
- TyCSSM_KEYUSE
- TyCSSM_ALGORITHMS
- TyCSSM_ENCRYPT_MODE
- TyCSSM_CSPTYPE
- TyCSSM_CONTEXT_TYPE
- TyCSSM_ATTRIBUTE_TYPE
- TyCSSM_PADDING
- TyCSSM_KEY_TYPE
- TyCSSM_SC_FLAGS
- TyCSSM_CSP_READER_FLAGS
- TyCSSM_CSP_FLAGS
- TyCSSM_PKCS_OAEP_MGF
- TyCSSM_PKCS_OAEP_PSOURCE
- TyCSSM_PKCS5_PBKDF2_PRF
- TyCSSM_TP_AUTHORITY_REQUEST_TYPE
- TyCSSM_TP_AUTHORITY_REQUEST_TYPE_PTR
- TyCSSM_TP_SERVICES
- TyCSSM_TP_ACTION
- TyCSSM_TP_STOP_ON
- TyCSSM_TIMESTRING
- TyCSSM_CRL_PARSE_FORMAT
- TyCSSM_CRL_PARSE_FORMAT_PTR
- TyCSSM_CRL_TYPE
- TyCSSM_CRL_TYPE_PTR
- TyCSSM_CRL_ENCODING
- TyCSSM_CRL_ENCODING_PTR
- TyCSSM_CRLGROUP_TYPE
- TyCSSM_CRLGROUP_TYPE_PTR
- TyCSSM_EVIDENCE_FORM
- TyCSSM_TP_CONFIRM_STATUS
- TyCSSM_TP_CONFIRM_STATUS_PTR
- TyCSSM_TP_CERTISSUE_STATUS
- TyCSSM_TP_CERTCHANGE_ACTION
- TyCSSM_TP_CERTCHANGE_REASON
- TyCSSM_TP_CERTCHANGE_STATUS
- TyCSSM_TP_CERTVERIFY_STATUS
- TyCSSM_TP_CERTNOTARIZE_STATUS
- TyCSSM_TP_CERTRECLAIM_STATUS
- TyCSSM_TP_CRLISSUE_STATUS
- TyCSSM_TP_FORM_TYPE
- TyCSSM_CL_TEMPLATE_TYPE
- TyCSSM_CERT_BUNDLE_TYPE
- TyCSSM_CERT_BUNDLE_ENCODING
- TyCSSM_DB_ATTRIBUTE_NAME_FORMAT
- TyCSSM_DB_ATTRIBUTE_NAME_FORMAT_PTR
- TyCSSM_DB_ATTRIBUTE_FORMAT
- TyCSSM_DB_ATTRIBUTE_FORMAT_PTR
- TyCSSM_DB_RECORDTYPE
- TyCSSM_DB_INDEX_TYPE
- TyCSSM_DB_INDEXED_DATA_LOCATION
- TyCSSM_DB_ACCESS_TYPE
- TyCSSM_DB_ACCESS_TYPE_PTR
- TyCSSM_DB_MODIFY_MODE
- TyCSSM_DB_OPERATOR
- TyCSSM_DB_OPERATOR_PTR
- TyCSSM_DB_CONJUNCTIVE
- TyCSSM_DB_CONJUNCTIVE_PTR
- TyCSSM_QUERY_FLAGS
- TyCSSM_DLTYPE
- TyCSSM_DLTYPE_PTR
- TyCSSM_DL_CUSTOM_ATTRIBUTES
- TyCSSM_DL_LDAP_ATTRIBUTES
- TyCSSM_DL_ODBC_ATTRIBUTES
- TyCSSM_DL_FFS_ATTRIBUTES
- TyCSSM_DL_PKCS11_ATTRIBUTE
- TyCSSM_DL_PKCS11_ATTRIBUTE_PTR
- TyCSSM_DB_RETRIEVAL_MODES
- TyCSSM_MANAGER_EVENT_TYPES
- TyMDS_HANDLE
- TyCSSM_BER_TAG
- TyCSSM_X509_OPTION
- TyCSSM_X509EXT_DATA_FORMAT