SharePlay security

SharePlay is built on top of the end-to-end encrypted infrastructure of FaceTime, so the data exchanged between participants during a SharePlay activity is protected such that no one but the participants can access it. Apple can’t decrypt the data.

SharePlay uses the Apple Push Notification service (APNs) for signaling, reusing the same push channel FaceTime establishes between registered devices, and traffic is carried over the same end-to-end encrypted data channel used by FaceTime. The key material protecting SharePlay activity traffic is re-established when the call’s membership changes, so that newly added members can’t decrypt earlier traffic and removed members and unable to decrypt subsequent traffic. Unlike the session keys protecting Group FaceTime media, SharePlay keys aren’t rotated temporally and persist for the duration of the activity.

To keep concurrent or sequential activities on the same call cryptographically isolated, SharePlay never uses this key material directly. Each activity instead derives its own key by diversifying the shared key material with the activity’s unique identifier, so apps using SharePlay can’t decrypt one another’s traffic. Starting a new activity produces a new identifier and therefore a different key. Participant identifiers are similarly diversified per activity, so one activity can’t correlate its participants with those of another app, even when the underlying FaceTime membership is identical.

Download this guide as a PDF

Χρήσιμο;

Apple Platform Security

SharePlay security