security of using digital signature as key derivation material I want all keys in my iOS application to rely on the Secure Enclave for security as the iOS keychain becomes insecure on jailbroken devices. Currently, the Secure Enclave currently only supports generation/storage of EC and RSA keys. I'm considering the following design for indirectly using the Secure Enclave to store symmetric encryption keys, but want to validate its security:


On application initialization, generate an asymmetric EC key K in the Secure Enclave.
Use it to sign the device UUID (or some other constant), yielding signature S.
Derive encryption key E = KDF(S)
Use encryption key E to encrypt items in the local database. (E itself is not stored anywhere.)
On any subsequent application start, re-derive S and E and use E to decrypt the local database.


Edit: as @zaph pointed out, the Secure Enclave protects the entire Keychain. The distinction lies in that some keys can be generated in the Secure Enclave (curve p256 EC keys and RSA keys) and some can't. Those that can, enjoy a higher level of security as their private keys cannot be exported from the Secure Enclave. It is those keys that I'm interested in exploiting to indirectly protect other keys/data.
I'm sorry, but chances are this doesn't work.

The reason is of course that ECDSA signatures are usually fully randomized, meaning that there's randomness introduced in between the private key and the final signature. If you're looking at an ECDSA specification, the relevant value usually is called $k$.

What you'd rather need would be an RSA encryption / decryption keypair or an ECDH keypair. In this case you'd just store an encrypted key as a file or something and let the secure enclave decrypt it at each startup and keep the key in RAM. The downside being of course if an attacker can extract it from memory this application's security is screwed. If you have a static ECDH key pair you'd just store a public ECDH share and statically derive the key each time and use it as suggested.

If you have to use signatures though, you need to find a deterministic one that is offered by the enclave and use it as proposed in your question.
This can include ECDSA if it follows any standard for deterministic ECDSA (like RFC 6979) and this can also include deterministic RSA signatures (e.g. usually the older signature standards).

Bottom line: As long as you use some (intermediate) value in the key derivation which directly relies on a hardware-backed key (in a deterministic way), chances are this will be secure.
An example of how not to do such a derivation is given in Android's FDE setup (with the counter-example for a good derivation would be iOS actually)