---

Glossary

• access control list (ACL)  

  A structure that specifies the action required (for example, display a confirmation dialog, ask for a password) to permit a specific operation. An ACL may also contain a list of applications that are always trusted to perform that operation. Each keychain item has one or more associated ACLs, and each ACL applies to a single operation on that item, such as encrypting or decrypting it. See also access object.



• access object  

  An opaque data structure containing one or more access control lists. Each keychain item has one access object.



• ACL  

  See access control list (ACL).



• anchor certificate  

  A digital certificate trusted to be valid, which can then be used to verify other certificates. Anchor certificates can include root certificates, cross-certified certificates (that is, certificates signed with more than one certificate chain), and locally defined sources of trust.



• application programming interface (API)  

  The set of routines, data structures, constants, and other programming elements that allow developers to use some part of the system software.



• asymmetric keys  

  A pair of related but dissimilar keys, one used for encrypting, and the other used for decrypting, a message or other data. See also public key cryptography.



• attribute  

  One data item (other than the secret) for a keychain item. Examples are the name, type, date modified, and account number. The attributes associated with a keychain item depend on the class of the item.



• authentication  

  The act of verifying identity with something the user provides. For example, a user can provide information such as a name and password, a physical item such as a smart card, or a physical feature such as a fingerprint or retinal scan.



• authorization  

  The process by which an entity such as a user or a server gets the right to perform a privileged operation. (Authorization can also refer to the right itself, as in “Bob has the authorization to run that program.”) Authorization usually involves first authenticating the entity and then determining whether it has the appropriate permissions. Compare authentication.



• certificate  

  See digital certificate.



• certificate chain  

  A sequence of related digital certificates that are used to verify the validity of a digital certificate. Each certificate is digitally signed using the certificate of its certification authority. This process creates a chain of certificates ending in an anchor certificate.



• certificate extension  

  A data field in a digital certificate containing information such as allowable uses for the certificate.



• certification authority  

  The issuer of a digital certificate. In order for the digital certificate to be trusted, the certification authority must be a trusted organization that authenticates an applicant before issuing a certificate.



• CDSA  

  Abbreviation for Common Data Security Architecture. An open software standard for a security infrastructure that provides a wide array of security services, including fine-grained access permissions, authentication of users, encryption, and secure data storage. CDSA has a standard application programming interface, called CSSM. In addition, Mac OS X includes its own security APIs that call the CDSA API for you.



• CSSM  

  Abbreviation for Common Security Services Manager. A public application programming interface for CDSA. CSSM also defines an interface for plug-ins that implement security services for a particular operating system and hardware environment.



• default keychain  

  The keychain accessed by certain Keychain Services functions when no other keychain is specified in the function call. For example, newly created keychain items are stored in the default keychain unless a different keychain is specified in the function call. A default keychain is created for each new login account, but the user can use the Keychain Access utility to designate another keychain as the default.



• default keychain search list  

  The list of keychains searched by certain Keychain Services functions when no other keychain or list of keychains is specified in the function call. The default keychain search list contains the same keychains as the keychain list displayed in the Keychain Access utility.



• digital certificate  

  A collection of data used to verify the identity of the holder or sender of the certificate. A digital certificate must conform to some standard in order for the recipient to be able to interpret it. Mac OS X supports the X.509 standard for digital certificates. See also certificate chain.



• digital signature  

  A data structure associated with a document or other set of data that uniquely identifies the person or organization that is signing, or authorizing the contents of, the data and ensures the integrity of the signed data.



• encrypt  

  To secure data so that it cannot be read by unauthorized entities, in such a way that its original state can be restored later (decrypted). In most cryptographic systems, encryption and decryption are performed by manipulating the data with a string of bytes called a key.



• generic password  

  A password other than an Internet password.



• identity  

  A digital certificate together with an associated private key.



• Internet password  

  A password for an Internet server, such as a Web or FTP server. Internet password items on the keychain include attributes such as the security domain and IP address.



• key  

  A string of bytes used by an encryption algorithm to encrypt or decrypt data.



• keychain  

  A database used to store encrypted passwords, private keys, and other secrets. It is also used to store certificates and other non-secret information that is used in cryptography and authentication. The Keychain Manager and Keychain Services are public APIs that can be used to manipulate data in the keychain, and the Keychain Access utility is an application that can be used for the same purpose. See also keychain item.



• Keychain Access application  

  A utility that allows users to create, delete, and modify keychains and keychain items. In addition, adding or removing keychains in Keychain Access modifies the default keychain search list accordingly.



• keychain item  

  A secret that is encrypted and protected by the keychain, plus its associated attributes and access object. Each keychain item has a class that determines what attributes it has; for example Internet password items include an IP address attribute. The password or other secret stored as a keychain item is encrypted and is inaccessible when the keychain is locked. When the keychain is unlocked, the secret can be read by the trusted applications listed in the item’s access object and by the user (with the Keychain Access utility). The attributes are not currently encrypted.



• Keychain Manager  

  An API used to create, delete, and modify keychains and keychain items prior to Mac OS X v10.2. Keychain Services is preferred for use with Mac OS X v10.2 and later.



• Keychain Services  

  The API used to create, delete, and modify keychains and keychain items starting with Mac OS X v10.2.



• level of trust  

  The confidence you can have in the validity of a certificate, based on the certificates in its certificate chain and on the certificate extensions the certificate contains. The level of trust for a certificate is used together with the trust policy to answer the question “Should I trust this certificate for this action?”



• MIME  

  Acronym for Multipurpose Internet Mail Extensions. A standard for transmitting formatted text, hypertext, graphics, and audio in electronic mail messages over the Internet.



• password  

  Data, usually a character string, used to authenticate a user for a service or application.



• permissions  

  The type of access allowed to a file or directory (read, write, execute, traverse, and so forth). Which permissions are possible and which users or groups are granted specific permissions depend on the operating system. See also authorization.



• policy  

  See trust policy.



• private key  

  A cryptographic key that must be kept secret.



• privileged operation  

  An operation that requires special rights or permissions; for example, changing a locked system preference.



• public key  

  A cryptographic key that can be shared or made public without compromising the cryptographic method. See also public key cryptography.



• public key certificate  

  See digital certificate.



• public key cryptography  

  A cryptographic method using asymmetric keys in which one key is made public while the other (the private key) is kept secure. Data encrypted with one key must be decrypted with the other. If the public key is used to encrypt the data, only the holder of the private key can decrypt it; therefore the data is secure from unauthorized use. If the private key is used to encrypt the data, anyone with the public key can decrypt it. Because only the holder of the private key could have encrypted it, however, such data can be used for authentication. See also digital certificate; digital signature.



• public key infrastructure (PKI)  

  As defined by the X.509 standard, a PKI is the set of hardware, software, people, policies, and procedures needed to create, manage, store, distribute, and revoke digital certificates that are based on public key cryptography.



• root certificate  

  A certificate that can be verified without recourse to another certificate. Rather than being signed by a further certification authority (CA), a root certificate is verified using the widely available public key of the CA that issued the root certificate.



• secret  

  The encrypted data in a keychain item, such as a password. Only a trusted application can read the secret of a keychain item. Compare attribute.



• secret key  

  A cryptographic key that cannot be made public without compromising the security of the cryptographic method. In symmetric key cryptography, the secret key is used both to encrypt and decrypt the data. In asymmetric key cryptography, the secret key is paired with a public key. Whichever one is used to encrypt the data, the other is used to decrypt it. See also public key; public key cryptography.



• Secure Sockets Layer (SSL)  

  A protocol that provides secure communication over a TCP/IP connection such as the Internet. It uses digital certificates for authentication and digital signatures to ensure message integrity, and can use public key cryptography to ensure data privacy. An SSL service negotiates a secure session between two communicating endpoints. SSL is built into all major browsers and web servers.



• secure storage  

  Encrypted storage of data that requires a user or process to authenticate itself before the data is decrypted.



• Secure Transport  

  The Mac OS X implementation of Secure Sockets Layer (SSL) and Transport Layer Security (TLS), used to create secure connections over TCP/IP connections such as the Internet. Secure Transport includes an API that is independent of the underlying transport protocol.



• S-MIME  

  Acronym for Secure Multipurpose Internet Mail Extensions. A specification that adds digital signature authentication and encryption to electronic mail messages in MIME format.



• SSL  

  See Secure Sockets Layer (SSL).



• Transport Layer Security (TLS)  

  A protocol that provides secure communication over a TCP/IP connection such as the Internet. It uses digital certificates for authentication and digital signatures to ensure message integrity, and can use public key cryptography to ensure data privacy. A TLS service negotiates a secure session between two communicating endpoints. TLS is built into recent versions of all major browsers and web servers. TLS is the successor to SSL. Although the TLS and SSL protocols are not interoperable, Secure Transport can back down to SSL 3.0 if a TLS session cannot be negotiated.



• trust  

  See level of trust, trust policy.



• trusted application  

  An application that can read a keychain item’s secret when the keychain is unlocked. See also access control list (ACL).



• trust policy  

  A set of rules that specify the appropriate uses for a certificate that has a specific level of trust. For example, the trust policy for a browser might state that if a certificate has an SSL certificate extension but the certificate has expired, the user should be prompted for permission before a secure session is opened with a web server.



• X.509  

  A standard for digital certificates promulgated by the International Telecommunication Union (ITU). The X.509 ITU standard is widely used on the Internet and throughout the information technology industry for designing secure applications based on a public key infrastructure (PKI).

---