What's new in CryptoKit — iOS & macOS 27 SDK

New

protocol

`KEMOneTimePrivateKey`

NewiOSmacOStvOSwatchOS

public protocol KEMOneTimePrivateKey : Sendable, ~Copyable

A one-time private key for a key encapsulation mechanism, which can only decapsulate once but it does so faster.

Declaration

@preconcurrency public protocol KEMOneTimePrivateKey : Sendable, ~Copyable {

    associatedtype PublicKey : KEMPublicKey

    /// Generates a new random private key.
    /// - Returns: The generated private key.
    ///
    /// Give the ``publicKey`` to another person so that they can encapsulate
    /// shared secrets that you recover by calling ``decapsulate(_:)``.
    static func generate() throws -> Self

    /// Recovers a shared secret from an encapsulated representation.
    /// - Parameter encapsulated: The encapsulated shared secret that someone created using this key's ``publicKey``.
    /// - Returns: The decapsulated shared secret.
    consuming func decapsulate(_ encapsulated: Data) throws -> SymmetricKey

    /// The associated public key.
    var publicKey: Self.PublicKey { get }
}

func

`AES.GCM.open`

NewiOSmacOStvOSwatchOS

public static func open(inPlace message: inout MutableRawSpan, using key: SymmetricKey, nonce: AES.GCM.Nonce, authenticating authenticatedData: RawSpan? = nil, tag: RawSpan) throws

Decrypts the message and verifies its authenticity.

tag : The 16-byte authentication tag.
authenticatedData: Additional data that was authenticated.

The call throws an error if decryption or authentication fail.

Parameters

message: The message, which will be decrypted in place.
key: The cryptographic key that was used to seal the message.
nonce: The nonce used to encrypt the message.

func

`AES.GCM.seal`

NewiOSmacOStvOSwatchOS

public static func seal(inPlace message: inout MutableRawSpan, using key: SymmetricKey, nonce: AES.GCM.Nonce, authenticating authenticatedData: RawSpan? = nil, tag: inout OutputRawSpan) throws

Secures the given plaintext message with encryption and an optional authentication tag.

Parameters

message: The plaintext data to seal, which will be updated in place.
key: A cryptographic key used to seal the message.
nonce: The nonce the sealing process requires.
authenticatedData: Additional data to be authenticated, if provided.
tag: receives the 16-byte authentication tag

init

`AES.GCM.Nonce.init`

NewiOSmacOStvOSwatchOS

public init(copying bytes: RawSpan) throws

Creates a nonce from the given data.

Unless your use case calls for a nonce with a specific value, use the init() method to instead create a random nonce.

Parameters

bytes: The bytes that represent the nonce. The initializer throws an error if the data has a length smaller than 12 bytes.

func

`ChaChaPoly.open`

NewiOSmacOStvOSwatchOS

public static func open(inPlace message: inout MutableRawSpan, using key: SymmetricKey, nonce: ChaChaPoly.Nonce, authenticating authenticatedData: RawSpan? = nil, tag: RawSpan) throws

Decrypts the message and verifies the authenticity of both the encrypted message and additional data.

tag : The 16-byte authentication tag.
authenticatedData: Additional data that was authenticated.

The call throws an error if decryption or authentication fail.

Parameters

message: The message, which will be decrypted in place.
key: The cryptographic key that was used to seal the message.
nonce: The nonce used to encrypt the message.

func

`ChaChaPoly.seal`

NewiOSmacOStvOSwatchOS

public static func seal(inPlace message: inout MutableRawSpan, using key: SymmetricKey, nonce: ChaChaPoly.Nonce, authenticating authenticatedData: RawSpan? = nil, tag: inout OutputRawSpan) throws

Secures the given plaintext message in place with encryption and an authentication tag.

Parameters

message: The plaintext data to seal.
key: A cryptographic key used to seal the message.
nonce: The nonce the sealing process requires.
authenticatedData: Additional data to be authenticated.
tag: Will be updated with the 16-byte authentication tag.

init

`ChaChaPoly.Nonce.init`

NewiOSmacOStvOSwatchOS

public init(copying bytes: RawSpan) throws

Creates a nonce from the given data.

Unless your use case calls for a nonce with a specific value, use the init() method to instead create a random nonce.

Parameters

bytes: The bytes that represent the nonce. The initializer throws an error if the data isn't 12 bytes long.

func

`HKDF.deriveKey`

NewiOSmacOStvOSwatchOS

public static func deriveKey(inputKeyMaterial: SymmetricKey, salt: RawSpan? = nil, info: RawSpan? = nil, output outputKey: inout OutputRawSpan)

Derives a symmetric encryption key from a main key or passcode using HKDF key derivation with information and salt you specify.

uses to derive a key.

salt: The salt to use for key derivation.
info: The shared information to use for key derivation.
outputKey: An output span that will be populated with the derived

symmetric key.

Parameters

inputKeyMaterial: The main key or passcode the derivation function

func

`HKDF.expand`

NewiOSmacOStvOSwatchOS

public static func expand(pseudoRandomKey prk: RawSpan, info: RawSpan?, into output: inout OutputRawSpan)

Expands cryptographically strong key material into a derived symmetric key.

Generate cryptographically strong key material to use with this function by calling extract(inputKeyMaterial:salt:).

extract(inputKeyMaterial:salt:) function.

info: The shared information to use for key derivation.
outputByteCount: The length in bytes of the resulting symmetric key.

Parameters

prk: A pseudorandom, cryptographically strong key generated from the

ReturnsThe derived symmetric key.

func

`HKDF.extract`

NewiOSmacOStvOSwatchOS

public static func extract(inputKeyMaterial: SymmetricKey, salt: RawSpan?) -> HashedAuthenticationCode<H>

Creates cryptographically strong key material from a main key or passcode that you specify.

Generate a derived symmetric key from the cryptographically strong key material this function creates by calling expand(pseudoRandomKey:info:outputByteCount:).

uses to derive a key.

salt: The salt to use for key derivation.

hashed authentication code.

Parameters

inputKeyMaterial: The main key or passcode the derivation function

ReturnsA pseudorandom, cryptographically strong key in the form of a

func

`HMAC.authenticationCode`

NewiOSmacOStvOSwatchOS

public static func authenticationCode(for data: RawSpan, using key: SymmetricKey) -> HMAC<H>.MAC

Computes a message authentication code for the given data.

Parameters

data: The data for which to compute the authentication code.
key: The symmetric key used to secure the computation.

ReturnsThe message authentication code.

func

`HMAC.update`

NewiOSmacOStvOSwatchOS

public mutating func update(bytes: RawSpan)

struct

`MLKEM1024.OneTimePrivateKey`

NewiOSmacOStvOSwatchOS

public struct OneTimePrivateKey : KEMOneTimePrivateKey, ~Copyable

Declaration

public struct OneTimePrivateKey : KEMOneTimePrivateKey, ~Copyable {

    /// Generates a new, random one-time-use private key.
    public static func generate() throws -> MLKEM1024.OneTimePrivateKey

    /// Initializes a random one-time-use private key.
    public init() throws

    /// Decapsulate a shared secret.
    ///
    /// - Parameters:
    ///   - encapsulated: An encapsulated shared secret, that you get by calling ``MLKEM1024/PublicKey/encapsulate()`` on the corresponding public key.
    /// - Returns: The shared secret.
    public consuming func decapsulate<D>(_ encapsulated: D) throws -> SymmetricKey where D : DataProtocol

    /// The corresponding public key.
    public var publicKey: MLKEM1024.PublicKey { get }

    @available(macOS 27.0, iOS 27.0, tvOS 27.0, watchOS 27.0, *)
    public typealias PublicKey = MLKEM1024.PublicKey
}

typealias

`MLKEM1024.OneTimePrivateKey.PublicKey`

NewiOSmacOStvOSwatchOS

public typealias PublicKey = MLKEM1024.PublicKey

struct

`MLKEM768.OneTimePrivateKey`

NewiOSmacOStvOSwatchOS

public struct OneTimePrivateKey : KEMOneTimePrivateKey, ~Copyable

Declaration

public struct OneTimePrivateKey : KEMOneTimePrivateKey, ~Copyable {

    /// Generates a new, random one-time-use private key.
    public static func generate() throws -> MLKEM768.OneTimePrivateKey

    /// Initializes a random one-time-use private key.
    public init() throws

    /// Decapsulate a shared secret.
    ///
    /// - Parameters:
    ///   - encapsulated: An encapsulated shared secret, that you get by calling ``MLKEM768/PublicKey/encapsulate()`` on the corresponding public key.
    /// - Returns: The shared secret.
    public consuming func decapsulate<D>(_ encapsulated: D) throws -> SymmetricKey where D : DataProtocol

    /// The corresponding public key.
    public var publicKey: MLKEM768.PublicKey { get }

    @available(macOS 27.0, iOS 27.0, tvOS 27.0, watchOS 27.0, *)
    public typealias PublicKey = MLKEM768.PublicKey
}

typealias

`MLKEM768.OneTimePrivateKey.PublicKey`

NewiOSmacOStvOSwatchOS

public typealias PublicKey = MLKEM768.PublicKey

var

`SymmetricKey.bytes`

NewiOSmacOStvOSwatchOS

public var bytes: RawSpan { get }

Access the raw bytes of the key.

init

`SymmetricKey.init`

NewiOSmacOStvOSwatchOS

public init(copyingWithZeroing bytes: inout MutableRawSpan)

Creates a key from the given data, zeroing out the bytes afterward.

Parameters

byte: The span of bytes from which to create the key.

init

`SymmetricKey.init`

NewiOSmacOStvOSwatchOS

public init<E>(size: SymmetricKeySize, initializingWith callback: @_lifetime(0: copy 0) (inout OutputRawSpan) throws(E) -> Void) throws(E) where E : Error

Creates a new key of the given size where the key contents are initialized via a callback.

sizes, like bits256, or you can create a key of custom length by initializing a SymmetricKeySize instance with a non-standard value.

callback: A callback that will be invoked to initialize the contents

of the key. It must initialize the full set of size.bitCount / 8 bytes in the provided output span.

Parameters

size: The size of the key to generate. You can use one of the standard

struct

`XWingMLKEM768X25519.OneTimePrivateKey`

NewiOSmacOStvOSwatchOS

public struct OneTimePrivateKey : KEMOneTimePrivateKey, ~Copyable

Declaration

public struct OneTimePrivateKey : KEMOneTimePrivateKey, ~Copyable {

    /// Generates a new, random one-time-use private key.
    public static func generate() throws -> XWingMLKEM768X25519.OneTimePrivateKey

    /// Decapsulate a shared secret.
    ///
    /// - Parameters:
    ///   - encapsulated: An encapsulated shared secret, that you get by calling ``XWingMLKEM768X25519/PublicKey/encapsulate()`` on the corresponding public key.
    /// - Returns: The shared secret.
    public consuming func decapsulate(_ encapsulated: Data) throws -> SymmetricKey

    /// The corresponding public key.
    public var publicKey: XWingMLKEM768X25519.PublicKey { get }

    @available(macOS 27.0, iOS 27.0, tvOS 27.0, watchOS 27.0, *)
    public typealias PublicKey = XWingMLKEM768X25519.PublicKey
}

typealias

`XWingMLKEM768X25519.OneTimePrivateKey.PublicKey`

NewiOSmacOStvOSwatchOS

public typealias PublicKey = XWingMLKEM768X25519.PublicKey

No APIs match your filter.

← More in Privacy, Security & Identity