<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/keychain-item-attribute-constants-for-keys",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Keychain Item Attribute Constants For Keys"
}
-->

# Keychain Item Attribute Constants For Keys

Specifies the attributes for a key item in a keychain.

## Discussion

For attributes for items other than keys, see [`SecItemAttr`](/documentation/Security/SecItemAttr).

## Topics

### Constants

[`var kSecKeyKeyClass: Int32`](/documentation/Security/kSecKeyKeyClass)

Type uint32 (`CSSM_KEYCLASS`); value is one of `CSSM_KEYCLASS_PUBLIC_KEY`, `CSSM_KEYCLASS_PRIVATE_KEY` or `CSSM_KEYCLASS_SESSION_KEY`.

[`var kSecKeyPrintName: Int32`](/documentation/Security/kSecKeyPrintName)

Type blob; human readable name of the key. Same as `kSecLabelItemAttr` for typical keychain items.

[`var kSecKeyAlias: Int32`](/documentation/Security/kSecKeyAlias)

Type blob; currently unused.

[`var kSecKeyPermanent: Int32`](/documentation/Security/kSecKeyPermanent)

Type uint32; value is nonzero. This key is permanent (stored in some keychain) and is always `1`.

[`var kSecKeyPrivate: Int32`](/documentation/Security/kSecKeyPrivate)

Type uint32; value is nonzero. This key is protected by a user login, a password, or both.

[`var kSecKeyModifiable: Int32`](/documentation/Security/kSecKeyModifiable)

Type uint32; value is nonzero. Attributes of this key can be modified.

[`var kSecKeyLabel: Int32`](/documentation/Security/kSecKeyLabel)

[`var kSecKeyApplicationTag: Int32`](/documentation/Security/kSecKeyApplicationTag)

Type blob; currently unused.

[`var kSecKeyKeyCreator: Int32`](/documentation/Security/kSecKeyKeyCreator)

Type data. The data points to a `CSSM_GUID` structure representing the module ID of the CSP owning this key.

[`var kSecKeyKeyType: Int32`](/documentation/Security/kSecKeyKeyType)

Type uint32; value is a CSSM algorithm (`CSSM_ALGORITHMS`) representing the algorithm associated with this key.

[`var kSecKeyKeySizeInBits: Int32`](/documentation/Security/kSecKeyKeySizeInBits)

Type uint32; value is the number of bits in this key.

[`var kSecKeyEffectiveKeySize: Int32`](/documentation/Security/kSecKeyEffectiveKeySize)

Type uint32; value is the effective number of bits in this key.  For example, a DES key has a key size in bits (`kSecKeyKeySizeInBits`) of 64 but a value for `kSecKeyEffectiveKeySize` of 56.

[`var kSecKeyStartDate: Int32`](/documentation/Security/kSecKeyStartDate)

Type `CSSM_DATE`.  Earliest date at which this key may be used.  If the value is all zeros or not present, no restriction applies.

[`var kSecKeyEndDate: Int32`](/documentation/Security/kSecKeyEndDate)

Type `CSSM_DATE`.  Latest date at which this key may be used.  If the value is all zeros or not present, no restriction applies.

[`var kSecKeySensitive: Int32`](/documentation/Security/kSecKeySensitive)

Type uint32; value is nonzero. This key cannot be wrapped with `CSSM_ALGID_NONE`.

[`var kSecKeyAlwaysSensitive: Int32`](/documentation/Security/kSecKeyAlwaysSensitive)

Type uint32; value is nonzero. This key has always been marked sensitive.

[`var kSecKeyExtractable: Int32`](/documentation/Security/kSecKeyExtractable)

Type uint32; value is nonzero. This key can be wrapped.

[`var kSecKeyNeverExtractable: Int32`](/documentation/Security/kSecKeyNeverExtractable)

Type uint32; value is nonzero. This key was never marked extractable.

[`var kSecKeyEncrypt: Int32`](/documentation/Security/kSecKeyEncrypt)

Type uint32; value is nonzero. This key can be used in an encrypt operation.

[`var kSecKeyDecrypt: Int32`](/documentation/Security/kSecKeyDecrypt)

Type uint32; value is nonzero. This key can be used in a decrypt operation.

[`var kSecKeyDerive: Int32`](/documentation/Security/kSecKeyDerive)

Type uint32; value is nonzero. This key can be used in a key derivation operation.

[`var kSecKeySign: Int32`](/documentation/Security/kSecKeySign)

Type uint32, value is nonzero. This key can be used in a sign operation.

[`var kSecKeyVerify: Int32`](/documentation/Security/kSecKeyVerify)

Type uint32, value is nonzero. This key can be used in a verify operation.

[`var kSecKeySignRecover: Int32`](/documentation/Security/kSecKeySignRecover)

Type uint32.

[`var kSecKeyVerifyRecover: Int32`](/documentation/Security/kSecKeyVerifyRecover)

Type uint32. This key can unwrap other keys.

[`var kSecKeyWrap: Int32`](/documentation/Security/kSecKeyWrap)

Type uint32; value is nonzero. This key can wrap other keys.

[`var kSecKeyUnwrap: Int32`](/documentation/Security/kSecKeyUnwrap)

Type uint32; value is nonzero. This key can unwrap other keys.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)