无法从钥匙串中获取对称密钥

Question

尝试从钥匙串中创建和检索对称密钥：

添加密钥

let key  = Data(repeating: 0xee, count: 32)
let name = "test"
let attributes = [
    kSecAttrKeyType: kSecAttrKeyTypeAES,
    kSecAttrKeySizeInBits: NSNumber(value: 256)
] as CFDictionary

var error: Unmanaged<CFError>?
let secKey = SecKeyCreateFromData(attributes, key as CFData, &error)

let addquery = [
    kSecClass: kSecClassKey,
    kSecAttrKeyClass: kSecAttrKeyClassSymmetric,
    kSecAttrLabel: name,
    kSecValueRef: secKey!
] as CFDictionary

let status = SecItemAdd(addquery as CFDictionary, nil)

if status != errSecSuccess {
    print(SecCopyErrorMessageString(status, nil)!)
}

钥匙串项已创建

拿到钥匙

let name = "test"
let getquery = [
    kSecClass: kSecClassKey,
    kSecAttrKeyClass: kSecAttrKeyClassSymmetric,
    kSecAttrLabel: name
] as [CFString : Any]

var secKey: CFTypeRef?

let status = SecItemCopyMatching(getquery as CFDictionary, &secKey)

if status == errSecSuccess {
    if let dic = SecKeyCopyAttributes(secKey as! SecKey) as? [CFString: Any] {
        if let key = dic[kSecValueData] {
            print("Ok")
        } else {
            print("Cannot get the key")
        }
    } else {
        print("Error retrieving dictionnary")
    }
} else {
    print(SecCopyErrorMessageString(status, nil)!)
}

如果在同一次运行中添加和检索密钥，它就可以工作。 dic中的元素个数是21。

但如果我只尝试获取存储在钥匙串中的密钥，我会得到字典而不是密钥。 dic中的元素个数为20（缺少kSecValueData）。

获取密钥缺少哪些参数？

谢谢

Answer 1

为了从 KeyChain 中检索您的密钥，您还应该指定 kSecAttrAccessible 选项：

let attributes = [
    kSecAttrKeyType: kSecAttrKeyTypeAES,
    kSecAttrKeySizeInBits: NSNumber(value: 256),
    kSecAttrAccessible: kSecAttrAccessibleWhenUnlocked
] as CFDictionary

这个可以在Mac解锁时查询和检索。

然后你就可以使用你已经提供的代码了

let getquery = [
    kSecClass: kSecClassKey,
    kSecAttrKeyClass: kSecAttrKeyClassSymmetric,
    kSecAttrLabel: name,
    kSecMatchLimit: kSecMatchLimitAll
] as [CFString : Any]

var secKeys: CFTypeRef?
let status = SecItemCopyMatching(getquery as CFDictionary, &secKeys)

if status == errSecSuccess {
    for symmetricKey in (secKeys as! [SecKey]) {
        guard let keyAttributes = SecKeyCopyAttributes(symmetricKey) as? [CFString: Any] else {
            fatalError("No key attributes for symmetric key")
        }
        
        guard let keyData = keyAttributes[kSecValueData] as? Data else {
            fatalError("No key data for symmetric key")
        }
        print("Key data retrieved: \(keyData.base64EncodedString())")
    }
}

现在，您可能会遇到已添加的旧键，它们仍然不会返回任何数据（因为它们的可访问性标志设置不正确）。使用 Mac 上的 Keychain Access 应用程序删除那些。之后，您应该能够添加 AES 密钥并检索 AES 密钥。