security

executablemacOS647.0 KBx86_64, arm64

Authentication daemon — manages system identity, certificates, and biometric authentication

Authenticates users through multiple methods including Keychain credentials, certificate-based authentication, and biometric verification via Touch ID or Face ID. Manages system identity, digital certificates, and cryptographic keys through the Security framework. Communicates with remote authentication endpoints and collects telemetry on authentication events. Exposes an XPC service for system components to request authentication and access stored credentials. Integrates directly with hardware for biometric operations.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 647.0 KB
UUID: 7AC51362-AF2D-3A28-BC06-3429577E9911
Analyzed: 2026-04-07T05:21:10Z
CDHash: d294f6ed5ba796b2ed79b21e19f7c10d015122326502a085946de11ca9308483

Capabilities

NetworkModern networking framework (NWConnection)

/System/Library/Frameworks/Network.framework/Versions/A/Network

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SecuritySecurity framework extensions

/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation

SecurityTouch ID / Face ID / password auth

/System/Library/Frameworks/LocalAuthentication.framework/Versions/A/LocalAuthentication

Frameworks12

PlatformSSOCore(weak)Security IOKit CoreFoundation SecurityFoundation Foundation Network LocalAuthentication StorageKit libobjc.A.dylib libc++.1.dylib libSystem.B.dylib

Entitlements3

com.apple.authorization.smartcard.overridetrue

com.apple.private.CoreAuthentication.SPItrue

com.apple.private.platformsso.securitytrue

Interesting Strings

Bundle IDs(10)

&com.apple.private.platformsso.security (com.apple.private.CoreAuthentication.SPI *com.apple.authorization.smartcard.override <key>com.apple.authorization.smartcard.override</key><key>com.apple.private.CoreAuthentication.SPI</key>

File Paths(20)

%@/Volumes/Preboot/%s/var/db/.authdbreset .plist /Library/Preferences /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

telemetry(12)

-t Type of key to find: one of "symmetric", "public", or "private"CSSM_CSP_CreateSymmetricContext: refKeyToRaw context err: %s CSSM_TP_SubmitCredRequest: %s Create a symmetric key and destroy it, in a loop.Create an asymmetric key pair.

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation Network SecurityFoundation

Endpoints(14)

HostnameSecurity-61901.40.77

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

Methods

-[TLSConnection initWithURLString:verbose:]

DNA Capability Vector

Location

0

Keychain

0

Network

1

Storage

0

Hardware

1

IPC

0

Analytics

0

Security

3

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

12

File Paths

20

Bundle IDs

10

IOKit Constants

0

Library Functions

4

Structural HashesSHA-256

Codef5e55aeae94abd439b571c8f3f00614c3eadc3c3fb0465b6c17b8cdb56c11f8c

Importsc393ccebef407b5fd0aaf5e7020f280cda52277e6114764446c4a18719f0fedb

Frameworks346498280c5adf58f5728d688aa30e785740533b91b3a9dfc4827d3680207abd

Classes1e16c49064965568b00e43e069fac4ba3ed3261bb3c33957cf65c03c30a2e59c

Entitlements29ed39df058c3465f1e0ad67918f424c2da6c5105d278c39ac5983ef57662dc1

Symbols026a41499cd620ee7efa123d419f5a5138d2eb91fa96c1d8ff9ba05905930c8c

Static Libraries0 / 420 functions identified

Function Matches(4)

PEM_read_bioopenssl 3.2High

PEM_read_bioopenssl 3.2High

PEM_read_bioopenssl 3.2High

PEM_read_bioopenssl 3.2High

Functions(420)

0x1000010a0sub_1000010a0

0x1000010acsub_1000010ac

0x1000010b0sub_1000010b0

0x1000010bcsub_1000010bc

0x1000010ccsub_1000010cc

0x100001150sub_100001150

0x1000011d4sub_1000011d4

0x100001450sub_100001450

0x1000020c4sub_1000020c4

0x1000021e0sub_1000021e0

0x1000021f4sub_1000021f4

0x100002354sub_100002354

0x10000344csub_10000344c

0x10000351csub_10000351c

0x1000035c8sub_1000035c8

0x100003ba4sub_100003ba4

0x100003d30sub_100003d30

0x100004494sub_100004494

0x1000046ecsub_1000046ec

0x1000049a0sub_1000049a0

Imports653 symbols from 12 dylibs

Security339 libSystem.B.dylib126 CoreFoundation108 libc++.1.dylib28 libobjc.A.dylib23

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

mobileactivationd

endpointsecurityd