# Keys Generate, store, and use cryptographic keys. ## Discussion Cryptographic keys are strings of bytes that you combine with other data in specialized mathematical operations to enhance security. At the lowest level, this usually means participating in either encryption and decryption or digital signing and verification. You can use these basic operations directly, such as when you encrypt data before sending it through an insecure channel. You also use them implicitly, such as when you verify the digital signature on a certificate as a byproduct of a trust evaluation. Keys vary based on the operations they support. For example, you use public and private key pairs to perform asymmetric encryption, whereas you use symmetric keys to conduct symmetric encryption. Similarly, one key might work for a 1024-bit RSA algorithm, while another might be suitable for a 256-bit elliptic curve algorithm. Use the functions in this section when you need to handle cryptographic keys. ## Topics ### Essentials [Getting an Existing Key](/documentation/Security/getting-an-existing-key) Learn how to obtain an existing cryptographic key. [Storing Keys in the Keychain](/documentation/Security/storing-keys-in-the-keychain) Store and access cryptographic keys in the keychain. [`SecKey`](/documentation/Security/SecKey) An object that represents a cryptographic key. [`SecKeyGetTypeID()`](/documentation/Security/SecKeyGetTypeID()) Returns the unique identifier of the opaque type to which a key object belongs. ### Key Generation [Generating New Cryptographic Keys](/documentation/Security/generating-new-cryptographic-keys) Create both asymmetric and symmetric cryptographic keys. [Protecting keys with the Secure Enclave](/documentation/Security/protecting-keys-with-the-secure-enclave) Create an extra layer of security for your private keys. [`SecKeyCreateRandomKey(_:_:)`](/documentation/Security/SecKeyCreateRandomKey(_:_:)) Generates a new public-private key pair. [`SecKeyCopyPublicKey(_:)`](/documentation/Security/SecKeyCopyPublicKey(_:)) Gets the public key associated with the given private key. [Key Generation Attributes](/documentation/Security/key-generation-attributes) Use attribute dictionary keys during cryptographic key generation. ### Examining Keys [`SecKeyIsAlgorithmSupported(_:_:_:)`](/documentation/Security/SecKeyIsAlgorithmSupported(_:_:_:)) Returns a Boolean indicating whether a key is suitable for an operation using a certain algorithm. [`SecKeyGetBlockSize(_:)`](/documentation/Security/SecKeyGetBlockSize(_:)) Gets the block length associated with a cryptographic key. [`SecKeyCopyAttributes(_:)`](/documentation/Security/SecKeyCopyAttributes(_:)) Gets the attributes of a given key. [`SecKeyAlgorithm`](/documentation/Security/SecKeyAlgorithm) The algorithms that cryptographic keys enable. [`SecKeyOperationType`](/documentation/Security/SecKeyOperationType) The types of operations that you can use a cryptographic key to perform. ### Import and Export [Storing Keys as Data](/documentation/Security/storing-keys-as-data) Create an external representation of a key for transmission. [`SecKeyCopyExternalRepresentation(_:_:)`](/documentation/Security/SecKeyCopyExternalRepresentation(_:_:)) Returns an external representation of the given key suitable for the key’s type. [`SecKeyCreateWithData(_:_:_:)`](/documentation/Security/SecKeyCreateWithData(_:_:_:)) Restores a key from an external representation of that key. ### Key Exchange [`SecKeyCopyKeyExchangeResult(_:_:_:_:_:)`](/documentation/Security/SecKeyCopyKeyExchangeResult(_:_:_:_:_:)) Performs the Diffie-Hellman style of key exchange with optional key-derivation steps. [`SecKeyKeyExchangeParameter`](/documentation/Security/SecKeyKeyExchangeParameter) The dictionary keys used to specify Diffie-Hellman key exchange parameters. ### Encryption [Using Keys for Encryption](/documentation/Security/using-keys-for-encryption) Perform asymmetric and symmetric encryption and decryption using cryptographic keys. [`SecKeyCreateEncryptedData(_:_:_:_:)`](/documentation/Security/SecKeyCreateEncryptedData(_:_:_:_:)) Encrypts a block of data using a public key and specified algorithm. [`SecKeyCreateDecryptedData(_:_:_:_:)`](/documentation/Security/SecKeyCreateDecryptedData(_:_:_:_:)) Decrypts a block of data using a private key and specified algorithm. ### Digital Signatures [Signing and Verifying](/documentation/Security/signing-and-verifying) Create and evaluate digital signatures to establish the validity of code or data. [`SecKeyCreateSignature(_:_:_:_:)`](/documentation/Security/SecKeyCreateSignature(_:_:_:_:)) Creates the cryptographic signature for a block of data using a private key and specified algorithm. [`SecKeyVerifySignature(_:_:_:_:_:)`](/documentation/Security/SecKeyVerifySignature(_:_:_:_:_:)) Verifies the cryptographic signature of a block of data using a public key and specified algorithm. ### Legacy iOS Key Operations [`SecKeyGeneratePair(_:_:_:)`](/documentation/Security/SecKeyGeneratePair(_:_:_:)) Creates an asymmetric key pair. [`SecKeyEncrypt(_:_:_:_:_:_:)`](/documentation/Security/SecKeyEncrypt(_:_:_:_:_:_:)) Encrypts a block of plaintext. [`SecKeyDecrypt(_:_:_:_:_:_:)`](/documentation/Security/SecKeyDecrypt(_:_:_:_:_:_:)) Decrypts a block of ciphertext. [`SecKeyRawSign(_:_:_:_:_:_:)`](/documentation/Security/SecKeyRawSign(_:_:_:_:_:_:)) Generates a digital signature for a block of data. [`SecKeyRawVerify(_:_:_:_:_:_:)`](/documentation/Security/SecKeyRawVerify(_:_:_:_:_:_:)) Verifies a digital signature. [`SecPadding`](/documentation/Security/SecPadding) The types of padding to use when you create or verify a digital signature. ### Legacy macOS Key Operations [`SecKeyGeneratePairAsync(_:_:_:)`](/documentation/Security/SecKeyGeneratePairAsync(_:_:_:)) Generates a public/private key pair. [`SecKeyGenerateSymmetric(_:_:)`](/documentation/Security/SecKeyGenerateSymmetric(_:_:)) Generates a random symmetric key. [`SecKeyCreateFromData(_:_:_:)`](/documentation/Security/SecKeyCreateFromData(_:_:_:)) Constructs a SecKeyRef object for a symmetric key. [`SecKeyDeriveFromPassword(_:_:_:)`](/documentation/Security/SecKeyDeriveFromPassword(_:_:_:)) Returns a key object in which the key data is derived from a password. [`SecKeyWrapSymmetric(_:_:_:_:)`](/documentation/Security/SecKeyWrapSymmetric(_:_:_:_:)) Wraps a symmetric key with another key. [`SecKeyUnwrapSymmetric(_:_:_:_:)`](/documentation/Security/SecKeyUnwrapSymmetric(_:_:_:_:)) Unwraps a wrapped symmetric key. [`SecKeyGetCredentials`](/documentation/Security/SecKeyGetCredentials) Returns an access credential for a key. [`SecKeyGetCSPHandle`](/documentation/Security/SecKeyGetCSPHandle) Returns the CSSM CSP handle for a key. [`SecKeyGetCSSMKey`](/documentation/Security/SecKeyGetCSSMKey) Retrieves a pointer to the `CSSM_KEY` structure containing the key stored in a keychain item. [`SecKeySizes`](/documentation/Security/SecKeySizes) The supported sizes for keys of various common types. [`SecKeyUsage`](/documentation/Security/SecKeyUsage) The flags that indicate key usage in the `KeyUsage` extension of a certificate. [`SecPublicKeyHash`](/documentation/Security/SecPublicKeyHash) A container for a 20-byte public key hash. [`SecKeyCreatePair`](/documentation/Security/SecKeyCreatePair) Creates an asymmetric key pair and stores it in a keychain. [`SecKeyGenerate`](/documentation/Security/SecKeyGenerate) Creates a symmetric key and optionally stores it in a keychain. [`SecKeyGeneratePairBlock`](/documentation/Security/SecKeyGeneratePairBlock) A block called with the results of a call to [`SecKeyGeneratePairAsync(_:_:_:)`](/documentation/Security/SecKeyGeneratePairAsync(_:_:_:)). [`SecCredentialType`](/documentation/Security/SecCredentialType) The credential type to be returned by [`SecKeyGetCredentials`](/documentation/Security/SecKeyGetCredentials). [`OpaqueSecKeyRef`](/documentation/Security/OpaqueSecKeyRef) --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)