nfcd

executablemacOS5.7 MBx86_64, arm64

Cryptographic key management service — handles keychain operations and secure enclave access

Manages cryptographic keys and certificates stored in the macOS keychain, including read access to encryption keys and sealed keys from the Secure Enclave. Exposes 23 XPC services to other system components and applications for keychain queries and certificate operations. Communicates with 7 network endpoints and collects diagnostic telemetry through the Symptom framework. Interacts directly with hardware and drivers, enforces hardened runtime protections, and accesses extended file system paths for key material storage and management.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 5.7 MB
UUID: DD47837B-72C4-33E4-B3BB-E16ED3728AF0
Analyzed: 2026-04-09T09:57:55Z
CDHash: 85f30b5f3fc42775208b7887f41685634d6635cf164962a312feac77d4ff2a86

Capabilities

KeychainRead and use keychain encryption keys

com.apple.keystore.access-keychain-keys [object Object]

KeychainAccess Secure Enclave sealed keys (SIK)

com.apple.keystore.sik.access [object Object]

KeychainKeychain access group membership

keychain-access-groups

com.apple.applesse

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

/private/var/hardware/FactoryData/System/Library/Caches/

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsSymptom/diagnostic reporting framework

/System/Library/PrivateFrameworks/SymptomDiagnosticReporter.framework/Versions/A/SymptomDiagnosticReporter

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks18

libMobileGestalt.dylib libnfshared.dylib libAppleSSE.dylib libFDR.dylib libicucore.A.dylib NearFieldPrivateServices IOKit Foundation Security SoftLinking STSXPCHelperClient(weak)SymptomDiagnosticReporter(weak)libAppletTranslationLibrary.dylib(weak)libbsm.0.dylib libPN548_API.dylib libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements24

com.apple.developer.hardened-processtrue

com.apple.keystore.access-keychain-keystrue

com.apple.keystore.sik.accesstrue

com.apple.mobileactivationd.bridgetrue

com.apple.mobileactivationd.device-identifierstrue

com.apple.mobileactivationd.spitrue

com.apple.nfcd.event.notificationtrue

com.apple.nfrestoretrue

com.apple.nfstoragetrue

com.apple.private.MobileGestalt.AllowedProtectedKeys

UniqueChipID SerialNumber UniqueDeviceID

com.apple.private.applecredentialmanager.allowtrue

com.apple.private.applesse.allowtrue

com.apple.private.launchservices.allowedtolaunchinothersessionstrue

com.apple.private.network.intcoproc.restrictedtrue

com.apple.private.power.notifications-temptrue

com.apple.private.stockholm.allowtrue

com.apple.private.stockholm.remoteservicetrue

com.apple.security.attestation.accesstrue

com.apple.security.exception.files.absolute-path.read-only

/private/var/hardware/FactoryData/System/Library/Caches/

com.apple.security.system-groups

systemgroup.com.apple.osanalytics

com.apple.stockholm.kext.entitlementtrue

com.apple.sts.xpcservice.clienttrue

keychain-access-groups

com.apple.applesse

seatbelt-profiles

Interesting Strings

Bundle IDs(141)

com.apple.private.applesse.allow com.apple.security.system-groups0#!com.apple.nfcd.event.notification !com.apple.private.stockholm.allow !systemgroup.com.apple.osanalytics0)

File Paths(16)

%@/Library/Logs/nfcd_lpcd_false-detect.plist /AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/ACMLib/ACMLib.c /AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/CommonUtil.c /AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCall.c /Library/Logs/nfcd_lpem.bin

telemetry(27)

!systemgroup.com.apple.osanalytics0)%c[%{public}s %{public}s]:%i ABC Request submitted successfully <string>systemgroup.com.apple.osanalytics</string>_os_variant_has_internal_diagnostics _scheduleDailyAnalytics

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(7)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

3

Network

0

Storage

1

Hardware

1

IPC

0

Analytics

1

Security

2

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

27

File Paths

16

Bundle IDs

141

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codee95c1667c80bcc32ea7de8daefd427b8d0cc0f7a694d1b74d02c90815335d2fb

Importse213998b327a0c406e0052b776fb29f30e4c0be0e44960773ea008cf5a1c2966

Frameworks35e3d8725292a683e4234afb95d59568a732f30b5e16048b7d1fec41ea293e59

Classesae4eba4887147841c92c7c8812ca961fbc58aa309c205d9fbda79ec7c59e41f2

Entitlements2360d2c2f9af1d34a7a43900b5198ec53cb5c7d4afa472a226b0e173b4a142dd

Symbolsca67d3e91901517d392b831e77d3dcd5d4a276c07c760f8970c559543a840d1b

Static Libraries0 / 3011 functions identified

Functions(3011)

0x1000012f8sub_1000012f8

0x1000013ecsub_1000013ec

0x1000014d8sub_1000014d8

0x1000018a0sub_1000018a0

0x1000019f8sub_1000019f8

0x100001a28sub_100001a28

0x100001b0csub_100001b0c

0x100001b8csub_100001b8c

0x100001c3csub_100001c3c

0x100001cf0sub_100001cf0

0x100001d10sub_100001d10

0x100001d4csub_100001d4c

0x100001d70sub_100001d70

0x100001d94sub_100001d94

0x100001dacsub_100001dac

0x100001dc4sub_100001dc4

0x100001dd0sub_100001dd0

0x100001ddcsub_100001ddc

0x100001df4sub_100001df4

0x100001e0csub_100001e0c

Imports440 symbols from 15 dylibs

libSystem.B.dylib122 libPN548_API.dylib72 libnfshared.dylib56 CoreFoundation53 libobjc.A.dylib43

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

securityd_system

networkserviceproxy

mobileactivationd