Purple Trust Classic string

[vincentpeyrouse]

String found in SEService.framework, it may stand for PTC.

[kormax]

Interesting.
Thanks for reporting!

Also, it it exactly "Classic" in there? I had a theory it could have meant "Contactless". PurpleTrustAir -> PurpleTrustContactless, but I didn't find anything like it in there, so I would believe as an alternative "Classic".

I still wonder, what does the "Purple Trust" part mean exactly. Some protocol/data storage/or related to cryptography?

[rednblkx]

I think that’s the PTClassicKey structure within SEService
https://developer.limneos.net/index.php?ios=15.2.1&framework=SEService.framework&header=PTClassicKey.h
SEService seems to be related to the Secure Element so I think it is safe to assume that PT might stand for Purple Trust.

Given that Apple likes to use the word Purple in relation to security and the presence of PurpleTrust primarily on Passkit and the NFC daemon, I’d say Purple Trust might be their protocol for exchanging data with the SE and ensure data safety for the Wallet when exchanging with an external party hence the Trust part.
But that’s just my two cents.

[kormax]

Thanks for chiming in!
Didn't even have a thought of searching in headers for more info.

Looking at those headers, it strikes me as being related to key sharing functionality. Especially because of variables with attestation, wrappedKey in their names, and of course key in file name.

[rednblkx]

Honestly, i only know about them because I was trying to figure out the Access Codes thing until i discovered dyld_shared_cache has all the code, found out they have a “demo” thing and with a little bit of injection I was able to enable it and look at what was going on 😅.

Getting back on topic, I agree that It could serve for some key sharing but the question is, how is PTClassicKey used within the Wallet or Home if at all. Couldn’t really find any references though I didn’t look that hard.

[kormax]

We have:

• ptc
• ptaCar
• ptaHome
• ptaAccess

Now consider this info:

Car keys:

• Launched with IOS13 (after WWDC), full launch in IOS14)
• Doesn't use ISO18013 attestation packages;
• Store attestation packages on the SE.

Home/Access keys:

• Launched with IOS15;
• Use ISO18013 attestation packages;
• Store packages in the plain memory;
• "Sharing" introduced in IOS16.

Digital Documents:

• Launched with IOS15;
• Document data is stored on the file system or on TEE (in encrypted form);
• Key for proof is imported into or generated on the secure element.
• Has a separate (from keys) ISO18013 credential storage location according to passkit.

PurpleTrust:

• References seem to appear starting with IOS14.
• Has something to do with key wrapping (used for exporting or importing private keys).
• Has something to do with attestation.
• Has entries related to Car/Home/Access keys with "a"/"air" prefix.
• There are less pta references to car keys than other keys.
• PTC has a separate applet.

Frankly, there's no direct overlap between any of those categories, so there's no definite answer about the purpose of that feature.

Anyway, I don't think we would have anything to gain from that information, apart from general knowledge.

Thanks everyone for sharing your info.

[kormax]

@rednblkx @vincentpeyrouse
If that's of any interest to you, IOS18 headers contain references to Aliro, and there are symbols with purpleTrustAir affixes:

• purpleTrustAirAccess
• purpleTrustAirHome
• purpleTrustAirAliro

There's not such affix for Car keys, so I'm starting to think that purpleTrustAir is related HCE-based attestation payload storage and transfer, while purpleTrustClassic is for CarKeys.

[vincentpeyrouse]

Yes, I saw the additions, haven't had time to look at everything yet ^^'

I agree with the principle that PTA = HCE-based attestations / over the air.

On the other hand, PTC / Purple Trust Classic is for Apple Cash only (according to localization files)

 "SE_STORAGE_APPLET_CATEGORY_APLET_TYPE_PTA_ACCESS": "Access"
 "SE_STORAGE_APPLET_CATEGORY_APLET_TYPE_PTA_CAR": "Car key"
 "SE_STORAGE_APPLET_CATEGORY_APLET_TYPE_PTA_HOME": "Home key"
 "SE_STORAGE_APPLET_CATEGORY_APLET_TYPE_PTC" : "Apple Cash"

(What will Tap-to-Cash in iOS 18 change for Apple Cash? No idea at the moment)

The fact that there are fewer references to the car variant can be explained by the fact that car keys also use UWB, delegated to the "sunsprite" applet.

BTW : DigitalAccess.framework may be a trail to follow.

BTW2 : It is confirmed that Aliro will offer the same support to Home and MultiResidential (Hydra) as UnifiedAccess.

[kormax]

Uh oh

"WalletKeyUncertified": "This accessory has not been certified to work with HomeKit so some features may not be available such as Approach to Unlock or Tap to Unlock."

[rednblkx]

That’s a bummer but realistically I think this was expected, at least it’s just the “express mode”, blocking home key entirely would’ve been pretty shitty from Apple.
This move is somewhat justified since ECP is already under lock and key.

[kormax]

If this message is only about the "express" mode capabilities - that's unfortunate but fine by me.

I've read it as they won't generate an Aliro credential for you if no authorized accessory has been found in your home.

[kormax]

This_is_a_really_long_label._You_should_really_not_be_reading_this__Feel_free_to_not_read_this_in_the_future._Also__here_is_some_more_text_for_some_more_fun

😜

BTW. I've decided to collect all of the Aliro-related information found in IOS18 firmware and add it to Aliro repo. If you find anything else, would be grateful if you can chime in on that info or even expand it.

Frankly, I think it's not particularly useful ATM apart from giving us an ability to speculate on how the feature could/would work, but could be helpful if things get rolling.

I think the actual entry point into getting research rolling would be to create a fake matter accessory with the needed endpoints and parameters (@kupa22 might be looking into it when they're free), and look how IOS reacts to that (It's also a possibility that GMS on Android has Aliro activated already in the same case). Also, we might need to wait for a beta release with "Guest" feature, as it seems to be tightly related to Aliro, and it could be just disabled at this moment.

[rednblkx]

Nice, great work! Been meaning to look into how Homekey works with Matter ever since Apple added support for it in iOS 17 but if this is also somewhat present in Android 15 it will be even more interesting. I’ll be sure to be on the lookout for gems.
Seems the future is all in on Matter and I like it.