Verifying accessories for Apple devices and services

The MFi licensing program provides vetted accessory manufacturers access to the iPod Accessories Protocol (iAP) and the necessary supporting hardware components.

When an MFi accessory communicates with an iPad, iPhone or Apple Watch, the accessory must prove to Apple that it’s been vetted. (The accessory-device connection is with Thunderbolt, Lightning, Bluetooth or—for specific devices—USB-C.) As proof of authorization, the accessory sends an Apple-provided certificate to the device, which the device then verifies. The device then sends a challenge, which the accessory must answer with a signed response. This process is entirely handled by a custom integrated circuit (IC) that Apple provides to approved accessory manufacturers and is transparent to the accessory itself.

Verified MFi accessories can request access to different transport methods and functionality—for example, access to digital audio streams over the Thunderbolt cable or location information provided over Bluetooth. An authentication IC is designed to help ensure that only approved MFi accessories are granted full access to the device. If an accessory doesn’t support authentication, its access is limited to analogue audio and a small subset of serial (UART) audio playback controls.

AirPlay also uses the authentication IC to verify that receivers have been approved by Apple. AirPlay audio and CarPlay video streams use the MFi-SAP (Secure Association Protocol), which encrypts communication between the accessory and device using AES-128 in counter (CTR) mode. Ephemeral keys are exchanged using ECDH key exchange (Curve25519) and signed using the authentication IC’s 1024-bit RSA key as part of the Station-to-Station (STS) protocol.

Helpful?

Apple Platform Security

Verifying accessories for Apple devices and services