Agent skill · software engineering · dpearson2699
cryptokit
Use Apple CryptoKit for Swift cryptographic primitives. Use when hashing with SHA-2 or SHA-3, generating HMACs, encrypting with AES-GCM or ChaChaPoly, signing with P256/P384/P521/Curve25519 or ML-DSA keys, performing ECDH, HPKE, ML-KEM, or X-Wing key exchange, using Secure Enclave CryptoKit keys, or migrating CommonCrypto code to CryptoKit.
Why this skill is useful
Provides specific implementation patterns and best practices for using Apple CryptoKit that the AI wouldn't reliably generate on its own.
What it needs
About 7k tokens when loaded. Last updated 2026-07-31. 973 stars on the source repository.
What this skill does
CryptoKit Apple CryptoKit provides a Swift-native API for cryptographic operations: hashing, message authentication, symmetric encryption, public-key signing, key agreement, HPKE, quantum-secure key encapsulation/signing, and Secure Enclave-backed keys. Most core primitives are available on iOS 13+; check availability for HPKE (iOS 17+) and SHA-3 / post-quantum APIs (iOS 26+). Prefer CryptoKit over CommonCrypto or raw Security framework APIs for new cryptographic primitive code targeting Swift 6.3+. Contents Hashing HMAC Symmetric Encryption Public-Key Signing Key Agreement HPKE Post-Quantum CryptoKit Secure Enclave Common Mistakes Review Checklist References Hashing Use SHA256/SHA384/SHA512 on iOS 13+; SHA3256/SHA3384/SHA3512 require iOS 26+. All conform to HashFunction. One-shot hashing SHA-3 availability Use SHA-3 only behind an availability check unless the deployment target is iOS 26+: Incremental hashing For large data or streaming input, hash incrementally: Digest comparison Compare CryptoKit digest values directly. Do not convert digests to strings or arrays for security-sensitive equality checks. HMAC Use HMAC when a protocol requires keyed message authentication; verify with isValidAuthenticationCode rather than comparing serialized values yourself. Computing an authentication code Verifying an authentication code Incremental HMAC Symmetric Encryption CryptoKit provides two authenticated encryption ciphers: AES-GCM and ChaChaPoly. Both produce a sealed box containing the nonce, ciphertext, and authentication tag. AES-GCM The default choice for symmetric encryption. Hardware-accelerated on Apple silicon. ChaChaPoly Use ChaChaPoly when AES hardware acceleration is unavailable or when interoperating with protocols that require ChaCha20-Poly1305 (e.g., TLS, WireGuard). Authenticated data Both ciphers support additional authenticated data (AAD). The AAD is authenticated but not encrypted -- useful for metadata that must remain in the clear but be tamper-proof. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills dpearson2699/cryptokit