title: What is difference between Keychain and Secure Enclave
body: <p>I've been in searching where keychain stores either secure enclave or any other, I found many articles (one of this <a href="https://stackoverflow.com/questions/33235077/why-keychain-is-more-secure-than-encrypted-data-that-saved-in-file">stackoverflow answer</a>) which says following but I'm looking for some Authenticated like Apple statement </p>
  
  <blockquote>
    <p>The keychain stores the keys (and other small data) encrypted and restricts access to that data. Additionally in recent iPhones (5S and later) the keychain is in a separate processor, the Secure Enclave which additionally restricts access. There is no more secure way to store keys in iOS.</p>
  </blockquote>
  
  <p>So my queries on the basis of above statement.</p>
  
  <ul>
  <li>Is Keychain Items store in secure Enclave</li>
  <li>If yes then where Public key and Private key <code>CFTypeRef</code> Store </li>
  <li><p>Why we use this <code>kSecAttrTokenIDSecureEnclave</code> while creating key pair. (example following code).</p>
  
  <pre><code>-(bool) generateKeyPairWithAccessControlObject:(SecAccessControlRef)accessControlRef
  {
        CFMutableDictionaryRef accessControlDict = newCFDict;;
        CFDictionaryAddValue(accessControlDict, kSecAttrAccessControl, accessControlRef);
        CFDictionaryAddValue(accessControlDict, kSecAttrIsPermanent, kCFBooleanTrue);
        CFDictionaryAddValue(accessControlDict, kSecAttrLabel, kPrivateKeyName);
  
        // create dict which actually saves key into keychain
        CFMutableDictionaryRef generatePairRef = newCFDict;
        CFDictionaryAddValue(generatePairRef, kSecAttrTokenID, kSecAttrTokenIDSecureEnclave);
        CFDictionaryAddValue(generatePairRef, kSecAttrKeyType, kSecAttrKeyTypeEC);
        CFDictionaryAddValue(generatePairRef, kSecAttrKeySizeInBits, (__bridge const void *)([NSNumber numberWithInt:256]));
        CFDictionaryAddValue(generatePairRef, kSecPrivateKeyAttrs, accessControlDict);
  
        OSStatus status = SecKeyGeneratePair(generatePairRef, &amp;publicKeyRef, &amp;privateKeyRef);
  
        if (status != errSecSuccess)
            return NO;
  
        [self savePublicKeyFromRef:publicKeyRef];
        return YES;
  }
  </code></pre></li>
  </ul>
  
  <p>Looking for authenticated answer. Cheers</p>