axiom-cryptokit-ref

CryptoKit API Reference

Complete API reference for Apple CryptoKit: hashing, HMAC, symmetric encryption, key agreement, digital signatures, post-quantum cryptography, HPKE, Secure Enclave, key derivation, and Swift Crypto cross-platform parity.

Quick Reference

import CryptoKit

// Generate a symmetric key
let key = SymmetricKey(size: .bits256)

// AES-GCM encrypt
let sealed = try AES.GCM.seal(plaintext, using: key)
let combined = sealed.combined!  // nonce + ciphertext + tag

// AES-GCM decrypt
let sealedBox = try AES.GCM.SealedBox(combined: combined)
let decrypted = try AES.GCM.open(sealedBox, using: key)

// ECDSA sign (P256)
let signingKey = P256.Signing.PrivateKey()
let signature = try signingKey.signature(for: data)
let valid = signingKey.publicKey.isValidSignature(signature, for: data)

// Secure Enclave key
let seKey = try SecureEnclave.P256.Signing.PrivateKey()
let seSignature = try seKey.signature(for: data)

---

Hashing

Hash Functions

Algorithm	Type	Output Size	Use
SHA256	SHA256	32 bytes	General purpose, most common
SHA384	SHA384	48 bytes	TLS, certificate chains
SHA512	SHA512	64 bytes	High-security contexts
SHA3_256	SHA3_256	32 bytes	NIST post-quantum companion
SHA3_384	SHA3_384	48 bytes	Post-quantum companion
SHA3_512	SHA3_512	64 bytes	Post-quantum companion
Insecure.MD5	Insecure.MD5	16 bytes	Legacy interop only
Insecure.SHA1	Insecure.SHA1	20 bytes	Legacy interop only

Single-Call Hashing

let digest = SHA256.hash(data: data)
// digest conforms to Sequence of UInt8
let hex = digest.map { String(format: "%02x", $0) }.joined()

Streaming (Incremental) Hashing

var hasher = SHA256()
hasher.update(data: chunk1)
hasher.update(data: chunk2)
hasher.update(bufferPointer: unsafePointer)
let digest = hasher.finalize()  // SHA256Digest

HashFunction Protocol

All hash types conform to HashFunction with: byteCount, blockByteCount, init(), update(data:), update(bufferPointer:), finalize(), and hash(data:).