# What EC curve is used by Apple iOS platform?

I can't find information about EC curve used by Apple's iOS platform. The algorithm name that I could see in their docs is:

eciesEncryptionCofactorVariableIVX963SHA256AESGCM


However, there is no any explanation what it refers to. I've tried to find info about cofactor IVX963 with n/a so far. I read somewhere that Apple has adopted DJB's Curve25519. Is this the one that iOS uses as well?

If not, probably you can provide some pointers like NIST refs or anything else in public domain explaining what this is exactly.

Answer below is good (I've accepted it) and it does provide a lot of information, but clarification is still required.

The only ref that links curve in question with p256r1 is from a private blogger who primarily talks about generating curves of different types. While p256r1 has been generated in the demo, he doesn't know what other curves can be generated this way, nor it's clear how his curve generating scripts are related to the curve in this post.

This rough demo script isn’t set up to handle curves other than P256v1

1. A more official link that explains what this curve is
2. Equation type, domain parameters, etc.

I hope, it's not P256r1/v1

Please also note that the recommended curve is not even available in iOS 14.1, which is very recent

Type 'SecKeyAlgorithm' has no member 'kSecKeyAlgorithmECIESEncryptionCofactorVariableIVX963SHA256AESGCM

UPDATE I found the new link provided by @kelalaka very useful and practical, especially this part of it:

import Sodium

let sodium = Sodium()
let curve25519KeyPair = sodium.box.keyPair()
let privateKey = curve25519KeyPair!.secretKey
let publicKey = curve25519KeyPair!.publicKey


This is what everyone should use in EC domain, not the old and obscure Apple's CommonCrypto

• ANSI X9.63 and see the source opensource.apple.com/source/CommonCrypto/CommonCrypto-60027/… – kelalaka Oct 27 '20 at 17:51
• @kelalaka - thanks for the quick answer. I've checked X9.63. They've provided everything ... except ec domain parameters, nor could I find them in the quoted code. I still don't know what it is. Any pointers about type of curve (short Weierstrass form, Montgomery) and domain parameters (b, c, cofactor, etc.) would be very helpful – Oleg Gryb Oct 27 '20 at 18:09
• Is the curve perhaps part of the parameters of the key as opposed to the name of the algorithm? – xorhash Oct 27 '20 at 18:43
• The SecP256R1 is a standard and that can be found in the link. Well, sorry but the stupid Apple has tons of money and yet fail to write good documentation for the developers. ECC Curve25519 KeyChain – kelalaka Oct 29 '20 at 20:05
• There is no clear indication in any link that it's SecP256R1/V1. The blogger that you've been quoting didn't state it either. He simply said that he used some generator to generate P256R1 on SE. There is no any association between these two in his post, so we need to continue searching for the answer. – Oleg Gryb Oct 29 '20 at 23:04

Apple's CryptKit Suite

Since Apple's actual documentation is sparse we need to look for all available source;

There is apple/swift-crypto Github page that we can find the source code and cryptokit page also provides only a list.

Swift Crypto is an open-source implementation of a substantial portion of the API of Apple CryptoKit suitable for use on Linux platforms. It enables cross-platform or server applications with the advantages of CryptoKit.

The below from the iOS page SecKeySizes

• secp192r1: 192-bit ECC Keys for Suite-B from RFC 4492 section 5.1.1.
• secp256r1: 256-bit ECC Keys for Suite-B from RFC 4492 section 5.1.1.
• secp384r1: 384-bit ECC Keys for Suite-B from RFC 4492 section 5.1.1.
• secp521r1: 521-bit ECC Keys for Suite-B from RFC 4492 section 5.1.1.

There is also iOS-compatible ECIES implementation in Java

kSecKeyAlgorithmECIESEncryptionCofactorX963SHA256AESGCM

If we take a look at the corresponding constant kSecKeyAlgorithmECIESEncryptionCofactorX963SHA256AESGCM defined in SecKey.h (see here for example) then we can see that this algorithm is considered “legacy” and the recommended one is SecKeyAlgorithmECIESEncryptionCofactorVariableIVX963SHA256AESGCM instead (in Swift it’s eciesEncryptionCofactorVariableIVX963SHA256AESGCM).

and the below from darthnull.org/security

• ECIES: Elliptic Curve Integrated Encryption System - an open standard that defines exactly how to do what we’re about to do
• Cofactor: Include the elliptic curve’s “cofactor” when completing the Diffie-Hellman key agreement process
• X963SHA256: Use the ANSI x9.63* key derivation function (KDF), with SHA-256 as an underlying hash function
• AESGCM: For the final symmetric encryption, use AES in Galois Counter Mode (GCM), a form of authenticated encryption

The curve is SecP256R1 (This claim needs to be verified!!!)

The Secure Enclave

Apple describes the Secure Enclave as "a representation of a device’s hardware-based key manager. Secure Enclave only have

• NIST P-256 signatures and key agreement as of 2020.

*real ANSI X9.63 is here

• you are correct indeed! I haven't got an official paper to support this but I raised this with Apple engineering (I had reach into Apple to discuss), the enclave supports only P-256 atm. All of their secure boot/code signing is using P-256. – Woodstock Oct 30 '20 at 16:26
• @Woodstock thanks for checking. They have very bad documentation though they have the money! – kelalaka Oct 30 '20 at 16:29
• I know it's really bad. Also they use RSA with 1280-bit keys for iMessage, and only recently moved from Yarrow to Fortuna in the Kernel CSPRNG... strange choices... Also you can see here: developer.apple.com/documentation/cryptokit/secureenclave - only P-256 is listed, as close to official src as I can find, outside of me publishing emails. – Woodstock Oct 30 '20 at 16:30
• @Woodstock I'll modify the answer with that, too. thanks. – kelalaka Oct 30 '20 at 16:34
• Very welcome... – Woodstock Oct 30 '20 at 16:36