Apple CryptoKit

事实及其依据的检查

以下内容均非抄自文档。检查脚本 content/libraries/verify/apple-cryptokit/run.sh 于2026年10月20日在 macOS 27.0.1 (Swift 6.4) 上运行了 Apple CryptoKit macOS 27.0.1；本页内容必须与它的输出一致，每条事实都列出了对应的输出行。

• ECDSA 签名编码

  structured

  ECDSASignature 有 64 字节的 rawRepresentation 和 derRepresentation；它的字节（withUnsafeBytes）就是原始形式。

  检查记录

  fact ecdsa-signature-encoding = structured
  evidence ecdsa-signature-encoding: signature(for:) returns P256.Signing.ECDSASignature: rawRepresentation 64 bytes, derRepresentation starts with 0x30 and converts back: yes, withUnsafeBytes yields the raw form: yes

• ECDSA 的 nonce

  random

  同一条消息的两个签名不同；用 RFC 6979 A.2.5 中的密钥和消息签名，也没有得到 RFC 中的 r。

  检查记录

  fact ecdsa-nonce = random
  evidence ecdsa-nonce: two signatures of one message are different; r for the RFC 6979 A.2.5 key and message equals the RFC's r: no

• 签名时的 low-S

  either

  s 没有经过规范化：64 个签名中出现了 high-S 值。

  检查记录

  fact ecdsa-low-s-sign = either
  evidence ecdsa-low-s-sign: signatures with s > n/2 among 64: yes

• 验证时的 high-S

  accepts-high-s

  把 s 替换为 n − s 的签名验证通过。

  检查记录

  fact ecdsa-low-s-verify = accepts-high-s
  evidence ecdsa-low-s-verify: isValidSignature with s replaced by n - s: true

• 签名调用对哪些内容做哈希

  hashes-message-or-digest

  signature(for: data) 会先计算哈希；signature(for: SHA256.hash(data: message)) 生成的签名针对原消息验证通过。

  检查记录

  fact ecdsa-prehash = hashes-message-or-digest
  evidence ecdsa-prehash: signature(for: SHA256.hash(data: message)) verifies with isValidSignature(_:for: message): yes

• 对消息使用的哈希

  curve-matched

  对数据生成的签名可以作为对哈希值的签名验证通过：P-256 对应 SHA-256，P-384 对应 SHA-384，P-521 对应 SHA-512。

  检查记录

  fact ecdsa-message-hash = curve-matched
  evidence ecdsa-message-hash: signature(for: data) verifies as a signature over SHA-256 on P-256: yes, SHA-384 on P-384: yes, SHA-512 on P-521: yes

• 哈希与曲线绑定

  none

  P-384 密钥对 SHA-256 摘要签名，签名验证通过。

  检查记录

  fact ecdsa-hash-curve-binding = none
  evidence ecdsa-hash-curve-binding: a P-384 key signed a SHA-256 digest, and the signature verifies: yes

• 摘要长于曲线的阶

  truncated

  P-256 密钥对 SHA-512 摘要签名；Security.framework 把该签名作为对摘要前 32 字节的签名验证通过。

  检查记录

  fact ecdsa-long-input = truncated
  evidence ecdsa-long-input: a P-256 key signed a SHA-512 digest; Security.framework verifies the signature over the digest's first 32 bytes: yes

• 格式错误的 ECDSA 签名

  throws

  对于原始 r‖s 签名和 3 个字节的输入，init(derRepresentation:) 抛出 truncatedASN1Field；对于 DER 和 3 个字节的输入，init(rawRepresentation:) 抛出 incorrectParameterSize。

  检查记录

  fact ecdsa-malformed-signature = throws
  evidence ecdsa-malformed-signature: ECDSASignature(derRepresentation:) with the RFC 6979 A.2.5 signature as raw r||s: threw CryptoKitASN1Error.truncatedASN1Field; with 3 bytes: threw CryptoKitASN1Error.truncatedASN1Field
  evidence ecdsa-malformed-signature: ECDSASignature(rawRepresentation:) with DER: threw CryptoKitError.incorrectParameterSize; with 3 bytes: threw CryptoKitError.incorrectParameterSize
  evidence ecdsa-malformed-signature: isValidSignature for a valid signature over another message: false

• ECDSA 曲线

  P-256P-384P-521

  P-256、P-384 和 P-521 的签名与验证均成功；SDK 未声明其他 ECDSA 曲线。

  检查记录

  fact ecdsa-curves = P-256, P-384, P-521
  evidence ecdsa-curves: SDK 27.0 CryptoKit.swiftinterface top-level key types: Curve25519 MLDSA65 MLDSA87 MLKEM1024 MLKEM768 P256 P384 P521 XWingMLKEM768X25519

• EdDSA

  Ed25519

  Curve25519.Signing（Ed25519）；SDK 未声明 Ed448 类型。

  检查记录

  fact eddsa = Ed25519

• 确定性 Ed25519 签名

  no

  用同一个密钥对同一条消息生成的两个签名不同；两者都能验证通过，用 node:crypto 验证也一样。

  检查记录

  fact ed25519-deterministic = no
  evidence ed25519-deterministic: RFC 8032 test 1: the derived public key matches: yes, the RFC signature verifies: yes
  evidence ed25519-deterministic: CryptoKit's signature with the same key and message equals the RFC signature: no; two CryptoKit signatures are identical: no; both verify: yes
  evidence ed25519-deterministic: node:crypto (OpenSSL) verifies the CryptoKit signature: yes

• S 值非规范的 Ed25519 签名

  rejected

  把 RFC 8032 测试 1 的签名中的 S 替换为 S + L 后，该签名被拒绝。

  检查记录

  fact ed25519-non-canonical-s = rejected
  evidence ed25519-non-canonical-s: the RFC 8032 test 1 signature with S replaced by S + L

• Ed25519 小阶公钥

  accepted

  单位元可以作为公钥导入，R 为单位元且 S = 0 的签名验证通过。

  检查记录

  fact ed25519-small-order-key = accepted
  evidence ed25519-small-order-key: the identity point as public key: import accepted; signature R = identity, S = 0 verifies: yes

• 格式错误的 Ed25519 签名

  rejected

  由 64 个 0xab 字节构成的签名和 63 字节的签名都返回 false。

  检查记录

  fact ed25519-malformed-signature = rejected
  evidence ed25519-malformed-signature: 64 bytes of 0xab: false; 63 bytes of the RFC signature: false

• 后量子算法

  ML-KEMML-DSAX-Wing

  ML-KEM 和 X-Wing 封装后都能解封装出相同的密钥，ML-DSA 签名验证通过；X-Wing 经由 HPKE 也能正常工作。

  检查记录

  fact pqc = ML-KEM, ML-DSA, X-Wing
  evidence pqc: ML-KEM-768: public key 1184 bytes, ciphertext 1088 bytes, shared secrets match: yes
  evidence pqc: ML-KEM-1024: public key 1568 bytes, ciphertext 1568 bytes, shared secrets match: yes
  evidence pqc: ML-DSA-65: public key 1952 bytes, signature 3309 bytes, verifies: yes; ML-DSA-87: signature 4627 bytes, verifies: yes
  evidence pqc: X-Wing (XWingMLKEM768X25519): public key 1216 bytes, ciphertext 1120 bytes, shared secrets match: yes
  evidence pqc: HPKE with XWingMLKEM768X25519_SHA256_AES_GCM_256 opens its own message: yes

• ML-KEM 参数集

  ML-KEM-768ML-KEM-1024

  MLKEM768 和 MLKEM1024 封装后都能解封装出相同的密钥；SDK 未声明 ML-KEM-512 类型。

  检查记录

  fact ml-kem-parameter-sets = ML-KEM-768, ML-KEM-1024

• ML-DSA 参数集

  ML-DSA-65ML-DSA-87

  MLDSA65 和 MLDSA87 的签名与验证均成功；SDK 未声明 ML-DSA-44 类型。

  检查记录

  fact ml-dsa-parameter-sets = ML-DSA-65, ML-DSA-87

• ML-DSA 签名模式

  hedged

  同一条消息的两个 ML-DSA-65 签名不同（对冲签名）。

  检查记录

  fact ml-dsa-signing = hedged
  evidence ml-dsa-signing: two ML-DSA-65 signatures of one message are different

• ML-DSA 上下文字符串

  supported

  使用上下文 invoice-v1 生成的签名，用该上下文验证通过，用 invoice-v2 或不带上下文验证则失败。

  检查记录

  fact ml-dsa-context-string = supported
  evidence ml-dsa-context-string: signed with context "invoice-v1": verifies with it yes, with "invoice-v2" no, without a context no

• 格式错误的 ML-DSA 签名

  returns-false

  截断的签名、3 个字节的输入和错误的消息都返回 false。

  检查记录

  fact ml-dsa-malformed-signature = returns-false
  evidence ml-dsa-malformed-signature: isValidSignature: truncated signature false, 3 bytes false, wrong message false

• 被修改的 ML-KEM 密文

  implicit-rejection

  翻转密文中的一位后，decapsulate 返回的密钥与发送方的不同。

  检查记录

  fact ml-kem-modified-ciphertext = implicit-rejection
  evidence ml-kem-modified-ciphertext: ML-KEM-768 with one ciphertext bit flipped: decapsulate returned a key that differs from the sender's

• 后量子私钥

  seed-only

  seedRepresentation 对 ML-KEM-768 为 64 字节，对 ML-DSA-65 为 32 字节，由它重建的密钥与原密钥一致；唯一的另一个私钥初始化器接受带完整性校验的种子。

  检查记录

  fact pq-private-keys = seed-only
  evidence pq-private-keys: ML-KEM-768 seedRepresentation 64 bytes, integrityCheckedRepresentation 96 bytes; ML-DSA-65 seedRepresentation 32 bytes, integrityCheckedRepresentation 64 bytes
  evidence pq-private-keys: keys rebuilt from the seed alone have the same public key: ML-KEM-768 yes, ML-DSA-65 yes
  evidence pq-private-keys: MLKEM768.PrivateKey initializers in the SDK: init() init<D>(integrityCheckedRepresentation: init<D>(seedRepresentation:
  evidence pq-private-keys: MLDSA65.PrivateKey initializers in the SDK: init() init<D>(integrityCheckedRepresentation: init<D>(seedRepresentation:

• Secure Enclave 支持的算法

  P-256ML-KEM-768ML-KEM-1024ML-DSA-65ML-DSA-87

  在这台 Mac 上，每种类型的密钥都在 Secure Enclave 中生成，并完成了签名、验证或解封装。

  检查记录

  fact secure-enclave-algorithms = P-256, ML-KEM-768, ML-KEM-1024, ML-DSA-65, ML-DSA-87
  evidence secure-enclave-algorithms: SecureEnclave.isAvailable: true
  evidence secure-enclave-algorithms: P-256: signature verifies with the public key: yes, two signatures differ: yes, a key re-created from dataRepresentation signs for the same public key: yes
  evidence secure-enclave-algorithms: SecureEnclave key types in the SDK: MLDSA65 MLDSA87 MLKEM1024 MLKEM768 P256

• 公钥格式

  spki-pemspki-dersec1-uncompressedsec1-compressedraw-xyraw-32

  P-256 的 SPKI PEM 与 DER、SEC1 未压缩与压缩形式和原始 x‖y，以及 Ed25519 的 32 个原始字节，均能写出并读回。

  检查记录

  fact public-key-formats = spki-pem, spki-der, sec1-uncompressed, sec1-compressed, raw-xy, raw-32
  evidence public-key-formats: P-256 public key sizes: raw 64, x963 65, compressed 33, DER 91; PEM header -----BEGIN PUBLIC KEY-----; Ed25519 raw 32
  evidence public-key-formats: written and read back: spki-pem yes, spki-der yes, sec1-uncompressed yes, sec1-compressed yes, raw-xy yes, raw-32 yes
  evidence public-key-formats: key representations declared on the Curve25519 types: rawRepresentation; lines mentioning JWK in the SDK interface: 0

• 私钥格式

  pkcs8-pempkcs8-dersec1-pemsec1-derraw-scalarseed-32hardware-handle

  可读取 PEM 或 DER 格式的 PKCS#8 和 SEC1、原始 P-256 标量和 Ed25519 种子；写出 PKCS#8；Secure Enclave 密钥是句柄。

  检查记录

  fact private-key-formats = pkcs8-pem, pkcs8-der, sec1-pem, sec1-der, raw-scalar, seed-32, hardware-handle
  evidence private-key-formats: P-256 private key written as: derRepresentation PKCS#8 (138 bytes), pemRepresentation -----BEGIN PRIVATE KEY-----, rawRepresentation 32 bytes, x963Representation 97 bytes
  evidence private-key-formats: OpenSSL-written P-256 keys read: pkcs8-pem yes, pkcs8-der yes, encrypted-pkcs8 no, sec1-pem yes, sec1-der yes; encrypted PKCS#8: threw CryptoKitASN1Error.invalidPEMDocument
  evidence private-key-formats: key representations declared inside the SecureEnclave types: dataRepresentation

用法

import CryptoKit
import Foundation

let key = P256.Signing.PrivateKey()
let message = Data("order #1042 approved".utf8)
let signature = try key.signature(for: message) // SHA-256 for P-256, random nonce

// JWS (ES256) and WebCrypto use the 64-byte r||s form; X.509, OpenSSL and Java use DER.
let jose = signature.rawRepresentation
let der = signature.derRepresentation

// Rebuild the signature from the form that arrived, then verify it.
let received = try P256.Signing.ECDSASignature(derRepresentation: der)
let valid = key.publicKey.isValidSignature(received, for: message)
print("raw bytes: \(jose.count), DER tag: 0x\(String(der[0], radix: 16)), verified: \(valid)")
// Other platforms import the public key as SPKI PEM.
print(key.publicKey.pemRepresentation.split(separator: "\n")[0])

import CryptoKit
import Foundation

guard SecureEnclave.isAvailable else { fatalError("this device has no Secure Enclave") }
// The private key is generated inside the Secure Enclave; dataRepresentation is
// an opaque handle to store and reopen it, not the key itself.
let key = try SecureEnclave.P256.Signing.PrivateKey()
let reopened = try SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: key.dataRepresentation)

let message = Data("order #1042 approved".utf8)
let signature = try reopened.signature(for: message)
// Verifiers need only the ordinary P-256 public key.
let verifier = try P256.Signing.PublicKey(derRepresentation: key.publicKey.derRepresentation)
print("Secure Enclave signature verified: \(verifier.isValidSignature(signature, for: message))")

没有容器镜像提供此平台；这些示例于2026年10月20日在 macOS 27.0.1 (Swift 6.4) 上运行。