Can I update kSecAttrApplicationTag using SecItemUpdate? - ios

Here is my code:
var query: [String: Any] = [
kSecClass as String: kSecClassKey,
kSecAttrApplicationTag as String: currentTag
]
var attributesToUpdate: [String: Any] = [
kSecClass as String: kSecClassKey,
kSecAttrApplicationTag as String: archiveTag
]
osStatus = SecItemUpdate(query as CFDictionary, attributesToUpdate as CFDictionary)
The error that I got back was One or more parameters passed to a function were not valid.

I removed kSecClass as String: kSecClassKey in attributesToUpdate and it worked

Related

iOS Swift: SecureEnclave encryption app crash on SecKeyGeneratePair

I am facing an issue with SecureEnclave encryption in SecKeyGeneratePair method.
App crash on SecKeyGeneratePair method, I don't know what's missing or something wrong. I am referring https://github.com/trailofbits/SecureEnclaveCrypto
See the following code snippet.
func generateKeyPair(accessControl: SecAccessControl) throws -> (`public`: SecureEnclaveKeyReference, `private`: SecureEnclaveKeyReference) {
let privateKeyParams: [String: Any] = [
kSecAttrLabel as String: privateLabel,
kSecAttrIsPermanent as String: true,
kSecAttrAccessControl as String: accessControl,
]
let params: [String: Any] = [
kSecAttrKeyType as String: attrKeyTypeEllipticCurve,
kSecAttrKeySizeInBits as String: 256,
kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
kSecPrivateKeyAttrs as String: privateKeyParams
]
var publicKey, privateKey: SecKey?
let status = SecKeyGeneratePair(params as CFDictionary, &publicKey, &privateKey)
guard status == errSecSuccess else {
throw SecureEnclaveHelperError(message: "Could not generate keypair", osStatus: status)
}
return (public: SecureEnclaveKeyReference(publicKey!), private: SecureEnclaveKeyReference(privateKey!))
}

iOS swift : SecKeyCreateWithData returns nil

Trying to generate a SecKey from SecKeyCreateWithData function of swift as below. The SecKeyCreateWithData is always returning nil with below error log. Can anyone please help.
Note : Both cekKeyData as CFData and attributes as CFDictionary are not nil and have values in it.
log :
Thread 1: Fatal error: Unexpectedly found nil while unwrapping an Optional value
code
let keydatalen = 256
let algorithmID = ""
let partyUInfo = ""
let cekKeyData = DHSecretGenerator.createDeriveKey(
Z: sharedKey,
KeyLenght: keydatalen,
AlgorithmID: KDFConcateWithLenght(text: algorithmID, encoding: .ascii),
PartyUInfo: KDFConcateWithLenght(text: partyUInfo, encoding: .utf8),
PartyVInfo: KDFConcateWithLenght(text: reference, encoding: .ascii),
SuppPubInfo: numberToData(number: UInt32(keydatalen)),
SuppPrivInfo: Data())
let attributes: [String: Any] = [
kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
kSecAttrKeyClass as String: kSecAttrKeyClassSymmetric
]
var error: Unmanaged<CFError>?
var test: SecKey =
let privKey : SecKey = SecKeyCreateWithData(cekKeyData as CFData,
attributes as CFDictionary, &error)!
print(privKey)
Specify length and type of key
Lengths for example 256 and all
Type is public or private
I guess Symmetric is which public and private is same but not pretty sure abt that.
let attributes: [String: Any] = [
kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
kSecAttrKeySizeInBits as String: 256
]

How to check if Key was store in KeyChain in Swift

I was trying to store two keys private and public in KeyChain and when I try to do so my result valuable return 0 which I am assuming that mean it was store ,but when I try to get back to decrypt a message I am getting it back as nil so if there is a way to check if the keys were store based SecItemCopyMatching? but I am not getting any error while creating them
let tagName = "PrivateKeyTag"
let privkey = "key"
let privkeyData = Data(privkey!.utf8)
let privateFilter: [String : Any] = [
(kSecClass as String) : kSecClassKey,
(kSecAttrKeyType as String) : kSecAttrKeyTypeRSA,
(kSecAttrApplicationTag as String) : tagName,
(kSecValueData as String) : privkeyData,
(kSecAttrKeyClass as String) : kSecAttrKeyClassPrivate,
// kSecAttrKeySizeInBits as String: 2048,
(kSecReturnPersistentRef as String): true,
] as [String : Any]
let result = SecItemAdd(privateFilter as CFDictionary, nil)
if ((result != noErr) && (result != errSecDuplicateItem)) {
NSLog("Cannot add key to keychain, status \(result).")
}
let getquery: [String: Any] = [kSecClass as String: kSecClassKey,
kSecAttrApplicationTag as String: tag,
kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
]
var item: CFTypeRef?
let status = SecItemCopyMatching(getquery as CFDictionary, &item)
guard status == errSecSuccess else {
print("key not found")
return
}
let key = item as! SecKey
When you create a cryptographic key, you can set the parameter kSecAttrIsPermanent to true which will automatically store the key in the default keychain. This will clean your code a bit so you no longer have to deal with the SecItemAdd() and all the error handling with that. So here is a simpler way to do what you're trying to do.
To create a key and query a key
let tag = "com.example.keys.mykey".data(using: .utf8)!
let attributes: [String: Any] =
[kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
kSecAttrKeySizeInBits as String: 2048,
kSecPrivateKeyAttrs as String:
[kSecAttrIsPermanent as String: true,
kSecAttrApplicationTag as String: tag]
]
let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, nil)
let query: [String: Any] = [kSecClass as String: kSecClassKey,
kSecAttrApplicationTag as String: tag,
kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
kSecReturnRef as String: true]
var item: CFTypeRef?
let status2 = SecItemCopyMatching(query as CFDictionary, &item)
guard status2 == errSecSuccess else { print("error1"); return }
let key = item as! SecKey
Running this code I believe will accomplish what you are trying to do in the code you provided in the question. I tried running the code you gave and the version of Xcode and swift I am using gives compiler errors.
If you run the code in this answer you will notice that no errors are printed to the console, indicating that the key was successfully found in the default keychain.

How to store public and private keys of kSecAttrKeyTypeRSA type with size 4096 in coredata instead of keychain

I have generated Public and Private keys using RSA4096 and not stored into keychain by setting kSecAttrIsPermanent to false.
Now I am trying to store SecKey into core data and I am not able to convert SecKey to NSData. Please suggest
let privateKeyParams: [String: AnyObject] = [
kSecAttrIsPermanent as String: false as AnyObject,
kSecAttrApplicationTag as String:"com.RSAKey.MyApp" as AnyObject
]
// public key parameters
let publicKeyParams: [String: AnyObject] = [
kSecAttrIsPermanent as String: false as AnyObject,
kSecAttrApplicationTag as String:"com.RSAKey.MyApp" as AnyObject
]
// global parameters for our key generation
let parameters: [String: AnyObject] = [
kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
kSecAttrKeySizeInBits as String: 4096 as AnyObject,
kSecPublicKeyAttrs as String: publicKeyParams as AnyObject,
kSecPrivateKeyAttrs as String: privateKeyParams as AnyObject,
]
var pubKey, privKey: SecKey?
let status = SecKeyGeneratePair(parameters as CFDictionary, &pubKey, &privKey)
You can use SecKeyCopyExternalRepresentation() to convert SecKey into Data.

iOS - share key from keychain with service extension

I need to share the private key that was generated by the main iOS app with the push notification service extension. Getting the key works fine within the app with SecItemCopyMatching(). But if I try to get the private key from within the service extension I get a "errSecItemNotFound".
Here is what I'm doing:
In the main app I generate a key pair and store it on the keychain with SecItemAdd(). I don't use the "kSecAttrIsPermanent: true" attribute while generating the key pair, because it doesn't allow to specify an "kSecAttrAccessGroup". As far as I understand the keychain sharing I need to specify an access group to share keys between apps, or between an extension and an app.
kSecAttrAccessGroup is a string that I specify which looks something like this: "MyAppIdentifierPrefix" + "com.example.app.my-keychain"
keyTag is also a string that i specify which looks something like this: "com.example.app.my-key"
// private key parameters
let privateKeyParams: [String: AnyObject] = [
kSecAttrApplicationTag as String: keyTag as AnyObject
]
// public key parameters
let publicKeyParams: [String: AnyObject] = [
kSecAttrApplicationTag as String: keyTag as AnyObject
]
// global parameters for key generation
let parameters: [String: AnyObject] = [
kSecAttrKeyType as String: myKeyType,
kSecAttrKeySizeInBits as String: myKeySize as AnyObject,
kSecPublicKeyAttrs as String: publicKeyParams as AnyObject,
kSecPrivateKeyAttrs as String: privateKeyParams as AnyObject
]
// generate the key pair
var pubKey, privKey: SecKey?
let status = SecKeyGeneratePair(parameters as CFDictionary, &pubKey, &privKey)
if status == errSecSuccess {
// parameters for public key
let pubKeyParameters: [String: AnyObject] = [
kSecClass as String: kSecClassKey,
kSecAttrAccessible as String: kSecAttrAccessibleAlways,
kSecAttrAccessGroup as String: keychainGroupName as AnyObject,
kSecAttrIsPermanent as String: true as AnyObject,
kSecAttrApplicationTag as String: keyTag as AnyObject,
kSecAttrKeyType as String: myKeyType,
kSecAttrKeySizeInBits as String: myKeySize as AnyObject,
kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
kSecValueRef as String: pubKey!
]
// add public key to keychain
let statusPubKey = SecItemAdd(pubKeyParameters as CFDictionary, nil)
// parameters for private key
let privKeyParameters: [String: AnyObject] = [
kSecClass as String: kSecClassKey,
kSecAttrAccessible as String: kSecAttrAccessibleAlways,
kSecAttrAccessGroup as String: keychainGroupName as AnyObject,
kSecAttrIsPermanent as String: true as AnyObject,
kSecAttrApplicationTag as String: keyTag as AnyObject,
kSecAttrKeyType as String: myKeyType,
kSecAttrKeySizeInBits as String: myKeySize as AnyObject,
kSecAttrKeyClass as String: kSecAttrKeyClassPrivate,
kSecValueRef as String: privKey!
]
// add private key to keychain
let statusPrivKey = SecItemAdd(privKeyParameters as CFDictionary, nil)
}
I enabled keychain sharing in the capabilities tab and specified the same identifier "com.example.app.my-keychain" for both the app and the push notification service extension.
My function to get the key bytes is as following:
func getPrivateKeyData(keyTag: String) -> Data? {
let parameters = [
kSecClass as String: kSecClassKey,
kSecAttrApplicationTag as String: keyTag,
kSecAttrKeyClass as String: kSecAttrKeyClassPrivate,
kSecAttrAccessGroup as String: keychainGroupName as AnyObject,
kSecReturnData as String: true
] as [String : Any]
var data: AnyObject?
let status = SecItemCopyMatching(parameters as CFDictionary, &data)
if status == errSecSuccess {
return data as? Data
} else { return nil }
}
This does not work so far...

Resources