I am writing some keychain code on iOS. When I try to insert an item in keychain I get error -50.
What does OSStatus error -50 mean?
It's errSecParam, indicating one or more of your parameters is wrong.
Here:
https://developer.apple.com/library/ios/documentation/Security/Reference/keychainservices/index.html#//apple_ref/c/econst/errSecParam
If you are adding a password to the keychain make sure you pass it as Data and not String, otherwise you will get an OSStatus error -50.
static func savePassword(password: Data, account: String) throws -> OSStatus {
let query = [
kSecClass as String: kSecClassGenericPassword as String,
kSecAttrAccount as String: account,
kSecValueData as String: password
] as [String: Any]
SecItemDelete(query as CFDictionary)
return SecItemAdd(query as CFDictionary, nil)
}
Error -50 is a errSecParam, and means that at least one of the parameters you passed in a function was/are not valid.
This can be due to type differences, or perhaps an invalid value.
See this page on the Apple site to read the official documentation from Apple on errSecParam.
Related
I have been trying to delete keys from Secure Enclave on iOS in Swift. I continuously get OSStatus response -50. From what I can tell from the link there are 22 errors associated with OSStatus -50 for SecBasePrivate.h. How can I get more detailed error info or a specific error name?
var query : [String: Any] = [
kSecAttrKeySizeInBits as String: 256,
kSecAttrKeyType as String: kSecAttrKeyTypeEC,
kSecAttrLabel as String: keychainTagPublic,
]
var status = SecItemDelete(query as CFDictionary)
For SecItemDelete status results, we should probably be looking in the SecBase.h header:
errSecParam = -50, /* One or more parameters passed to a function were not valid. */
I have the following code following this storing_keys_in_the_keychain.
func generateInitialKey() -> Data {
let key = AES256.randomKey()
let addQuery: Dictionary<String, Any> = [
kSecClass as String: kSecClassKey,
kSecAttrApplicationTag as String: applicationTag,
kSecValueRef as String: key
]
let status = SecItemAdd(addQuery as CFDictionary, nil)
print(errSecParam, status)
guard status == errSecSuccess else { fatalError("Can't save Key") }
return key
}
The function AES256.randomKey() generates Data of 64 bytes. The applicationTag is Data too:
let applicationTag = "example".data(using: .utf8)!
However, I do end up receiving the errSecParam(-50) error. Can someone help me out?
Read the documentation carefully. errSecParam(-50) means one or more parameters passed to the function were not valid. The link leads you to the site where you can see the description of the status.
At a minimum, you specify the type and size of keys to create using the kSecAttrKeyType and kSecAttrKeySizeInBits parameters, respectively.
This will result in you having the next problem: there is no kSecAttrKeyTypeAES. This is already discussed and answered on the Apple developer forums. The advice there is to use kSecClassGenericPassword.
I am wondering if anyone knows whether its possible to update the flags after the key creation inside the Secure Enclave or not?
Here's how I am creating the key:
let access = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
[SecAccessControlCreateFlags.userPresence,
SecAccessControlCreateFlags.privateKeyUsage],
nil)!
let attributes: [String: Any] = [
kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
kSecAttrKeySizeInBits as String: 256,
kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
kSecPrivateKeyAttrs as String: [
kSecAttrIsPermanent as String: true,
kSecAttrApplicationTag as String: "stacksometimesoverflow",
kSecAttrAccessControl as String: access
]
]
var error: Unmanaged<CFError>?
guard SecKeyCreateRandomKey(attributes as CFDictionary, &error) != nil else {
throw error!.takeRetainedValue() as Error
}
As you can see, the key is created with
SecAccessControlCreateFlags.userPresence, SecAccessControlCreateFlags.privateKeyUsage
My question is, is it possible to update the access flag of the key (same key), say I want to remove SecAccessControlCreateFlags.userPresence
All the best!
Johnny
I don't think that's possible. According to Apple's documentation:
... because its backing storage is physically part of the Secure Enclave, you can never inspect the key’s data.
I think the best way is to delete your key with SecItemDelete(_:) and then create new key without the .userPresence flag.
For the past few days, I have been working on trying to delete a generated private key from the keychain. I have been doing my best to follow the documentation Apple provides to delete keys, which you can find here, but I haven't been able to figure out where I am going wrong. Below is my current code for it:
func deleteKey() {
var secret: AnyObject?
// Retrieve Private Key
let tag = "tag".data(using: .utf8)!
print(secret)
let getQuery: [String: Any] = [kSecClass as String: kSecClassKey, // This is a query we make to find the Private key in the key chain based of the input we put inside of it
kSecAttrApplicationTag as String: tag, // We use the tag to search for our saved Private key in the KeyChain as it is unique
kSecAttrKeyType as String: kSecAttrKeyTypeRSA, // This says the keychain will be of type RSA
kSecReturnRef as String: kCFBooleanTrue,// This says to return a reference to the key, and not the key data itself
]
let status = SecItemCopyMatching(getQuery as CFDictionary, &secret)
print(secret!)
let delQuery: [String: Any] = [
kSecMatchItemList as String: secret,// Key to delete
]
let delStatus = SecItemDelete(delQuery as CFDictionary)
guard delStatus == errSecSuccess || delStatus == errSecItemNotFound else {
print(delStatus)
print("Error")
return
}
print ("success")
My delStatus variable keeps on returning "-50", which I know means there is something wrong with my search parameters in the query, but I honestly can not figure it out. While I wait for an answer, I will keep trying to figure it out, but any help would be greatly appreciated. Thanks in advance.
I have the following code which creates a key pair in the secure enclave.
let access = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
.privateKeyUsage,
nil)!
var attributes: [String: Any] = [
kSecAttrKeyType as String: encryptionType,
kSecAttrKeySizeInBits as String: encryptionBits,
kSecPrivateKeyAttrs as String: [
kSecAttrIsPermanent as String: true,
kSecAttrApplicationTag as String: "abc".data(using: .utf8) as Any,
kSecAttrAccessControl as String: access,
],
]
if Device.hasSecureEnclave {
attributes[kSecAttrTokenID as String] = kSecAttrTokenIDSecureEnclave
}
var error: Unmanaged<CFError>?
SecKeyCreateRandomKey(attributes as CFDictionary, &error)
When running in a simulator or on the device it works just fine. But when I run it in a unit test, an error is returned from the SecKeyCreateRandomKey call:
Error Domain=NSOSStatusErrorDomain Code=-50
"Key generation failed, error -50" UserInfo={NSDescription=Key generation failed, error -50}
After trying a few things I found that the problem was the kSecAttrIsPermanent key in the attributes dictionary. If I remove it, the unit tests run fine.
All the doco I've read indicates it should be ok, but it's failing every time.
Anyone know why?
You may have already seen this:
http://www.openradar.me/36809637
I have the exact same issue and there was nothing in the Xcode 9.3 (beta) release notes to suggest it's been fixed.