Cartera usando el enclave seguro del iPhone

Actualmente,noexiste unabilleteraparaiOS que utiliceelenclave seguro. Pero las cuentastz3 usan cifradop-256 y seinstalaronprincipalmentepara admitiriOS,Android y otros dispositivos que solo son compatibles conp-256. Ha habido algo detrabajo hacia los contratos demúltiplesfirmas destinados a usarse conbilleteras segurasbasadasen enclaves,espero que veamos algopronto.

Elprincipal desafíoes que,a diferencia de un dispositivo debilletera de hardware como Ledger,elenclave seguronopermite laimportación/restauración de una clave. Las claves se creaninternamente ynunca salen delenclavepor lo queno hayexportación. Esto hace que la copia de seguridad/restauración sea un desafíoen caso depérdida de un dispositivo. La soluciónmás común será unafirmamúltiple donde la clavebasadaen enclavees solo 1 de x.

Asíes como Apple describeelenclave seguro:

Losbeneficios de Secure Enclave seequilibran con algunas restricciones. Enparticular,Secure Enclave:

• Es unafunción de hardware delprocesador de la serie A de Apple A7 oposterior. Solo los dispositivosiOS con uno deestosprocesadores o una MacBook Pro con Touch Bar y Touch ID admitenestafunción.

• Almacena solo clavesprivadas de curvaelíptica de 256bits. Estas claves solo sepueden utilizarpara crear y verificarfirmas criptográficas,oparaelintercambio de claves Diffie-Hellman de curvaelíptica (yporextensión,cifrado simétrico).

• No sepuedenimportar clavespreexistentes. Debe crear claves directamente dentro de Secure Enclave. Notener unmecanismoparatransferir datos clave dentro ofuera de Secure Enclaveesfundamentalpara su seguridad.

(fuente )

There isn't currently a wallet for iOS using the secure enclave. But the tz3 accounts use p-256 encryption and were put in primarily to support iOS, Android, and other devices which are only compatible with p-256. There has been some work toward multisig contracts intended for use with secure enclave based wallets, I would expect we will see something soon.

The main challenge is that unlike a hardware wallet device such as Ledger, the secure enclave does not allow the importing/restoring of a key. The keys are created internally and never leave the enclave so there is no export. This makes backup/restore challenging in the case of a lost device. The most common solution will be a multisig where the enclave based key is only 1 of x.

This is how Apple describes the secure enclave:

The benefits of the Secure Enclave are balanced against a few restrictions. In particular, the Secure Enclave:

• Is a hardware feature of the Apple A7 or later A-series processor. Only iOS devices with one of these processors or a MacBook Pro with the Touch Bar and Touch ID support this feature.

• Stores only 256-bit elliptic curve private keys. These keys can only be used for creating and verifying cryptographic signatures, or for elliptic curve Diffie-Hellman key exchange (and by extension, symmetric encryption).

• Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security.

(source)

Taylor Keefer demostró unprototipo de aplicacióniOSel 6 demayo de 2019en un artículo de Medium " Firma detransacciones de Tezos con Secure Enclave y Face ID deiOS ".Comoen la solución descritapor @cousinit,esteprototipo usa un "contratointeligente defirmamúltiple 1 de 2" con una segunda clave utilizadaen caso de queel acceso a la claveen elenclave seguro yanoesté disponible.

Taylor Keefer demonstrated a prototype iOS app on May 6, 2019 in a Medium article "Signing Tezos Transactions with iOS’s Secure Enclave and Face ID". As in the solution described by @cousinit, this prototype uses a "1 of 2 multi signature smart contract" with a second key used in case the access to the key in the secure enclave is not available anymore.