Protecting Security Information

Due to the sensitive nature of security information, Apple provides a method for you to:

• Verify the authenticity of security notifications

• Encrypt messages to send to Apple via [email protected]

1. Obtain PGP software

You can obtain a version of GPG Suite from GPGTools. Additionally, GnuPG is available as freeware.

2. Apple Product Security key

This is our PGP key which is valid until August 13, 2027.

Key ID: 3D68E087E2ABC0C7ECF5

Key Type: RSA

Expires: 8/13/27

Key Size: 4096/4096

Fingerprint: 8639 25FB 330B 3701 6209 3D68 E087 E2AB C0C7 ECF5

UserID: Apple Product Security <[email protected]>

When we generate a new key, it will be available from this web page. Our previous PGP keys are archived to facilitate the validation of previously-signed messages.

3. Check our PGP signature on mail messages and documents

Documents developed by the Apple Product Security team are signed with the Apple PGP key. We encourage you to check the signature to ensure that the document was indeed written by our staff and has not been changed.

Note for users of the security-announce mailing list:

Some mail programs cause changes to messages, resulting in an indication that the PGP signature is not good. Critical information will also be posted to our web site along with a PGP signature, providing you with a confirmation of authenticity.

4. Encrypting sensitive information

When sending sensitive security information by email, please encrypt it.