Hi there TL;DR : I have a Data object which contains data that is already hashed. I need a Digest object, how should I proceed ? I am developing an OSX Smart Card Token Extension to handle certificates linked to private keys in the Secure Enclave (using CryptoKit). So far my first tests are pretty successful as my extension already answered to various signature requests successfully... until now. So far I was receiving signature requests for ecdsaSignatureMessageX962SHA256 algorithm. All I had to do with was something like this: func tokenSession(_ session: TKTokenSession, sign dataToSign: Data, keyObjectID: Any, algorithm: TKTokenKeyAlgorithm) throws -> Data { if let privateKey = try? SecureEnclave.P256.Signing.PrivateKey.init(dataRepresentation: keyObjectID as! Data) {       let rawsignature = try? privateKey.signature(for: dataToSign)       return rawsignature!.derRepresentation     } } Now I receive requests for ecdsaSignatureDigestX962SHA256 signatures. I noticed that there is a public func signature<D>(for digest: D) throws -> P256.Signing.ECDSASignature where D : Digest function that can be called but in the tokenSession i am only given Data... Looking at SHA256Digest documentation I can't find anything to create the digest from bytes. It seems that it can only be the result of a SHA256.hash operation. I thought of using older API like SecKeyCreateSignature but I don't think I can retrieve a SecKey from a private key generated with CryptoKit SecureEnclave.P256.Signing.PrivateKey.init I feel like I may be missing something really simple...

I tried to run the following command: sudo -u _securityagent pluginkit -a /Applications/SmartCardApp.app/Contents/PlugIns/CssToken.appex But I am getting connection interrupted error. Do you know what that error means and how I can run that command successfully?

Under CryptoTokenKit framework in macOS Big Sur which command I should use to make a smartcard "Persistent Token" always available? I tried the following command but I am getting connection interrupted error sudo -u _securityagent pluginkit -a /Applications/SmartCardApp.app/Contents/PlugIns/CssToken.appex If there other way to do it?

Curious if anyone has any insight into the caching behavior or Smart Card PINs, and if there are options available to set to always prompt for PIN. Example of the current challenge is that users can authenticate to an application using their smart card and entering their PIN, however it appears the PIN is cached until the user logs out of their laptop or restarts. Any insight into modifying this behavior or suggested solutions is greatly appreciated. Thank you. CD

We are a company that produces SmartCard readers and cryptographic tokens. When we started testing our devices on macOS, we realized that it is necessary to add our products to the macOS ICCD driver, so that the operating system will recognize our devices natively. We believe there is a list with information about manufacturers (name, VendorID, ProductID) and we would like to add data from our company so that our devices are recognized as trusted by the macOS operating system. If anyone knows the correct process for this, please let us know.

Hello, I'm investigating the use of persistent extension to expose certificates and keys to applications. I am investigating on macOS and iOS but I am currently testing on macOS. I'm able to list the exposed certificate. I thought I could restrict the search to my particular token with kSecAttrTokenID (and the ID I provided to addTokenConfiguration(for: ), e.g. the string "COMPANY-macOS-pext"), but it doesn't work. So I tried to list all the tokens available from my app, using the following code adapted from SecurityTool: static func listAllKeychains() {     listKeychains (ofType: SecPreferencesDomain.user)     listKeychains (ofType: SecPreferencesDomain.system)     listKeychains (ofType: SecPreferencesDomain.common)     listKeychains (ofType: SecPreferencesDomain.dynamic)   }     static func listKeychains (ofType type: SecPreferencesDomain) {     var searchList: CFArray?           let status = SecKeychainCopyDomainSearchList(type, &searchList)     if ( status != errSecSuccess) {       logger.debug("error getting Keychains list : \(status).")       return     }     guard let keychains = searchList as? [SecKeychain] else {       logger.debug("Error on retrieved keychains")       return     }           for keychain in keychains {       var pName = Array(repeating: 0 as Int8, count: 1024)       var pLength = UInt32(pName.count)       let oStatus = SecKeychainGetPath(keychain, &pLength, &pName)       if oStatus == errSecSuccess {         let buffer = [UInt8](unsafeBitCast(pName, to: [UInt8].self))         let name: String = String(bytes: buffer, encoding: .ascii) ?? "Unable to get string"         logger.debug("Keychain \(keychain.hashValue) : \(name)")       } else {         logger.debug("Error getting pathname of keychain \(keychain.hashValue)")       }     }   } I just get the user keychain and the system keychain. Am I missing something here ? How can I list the keychain provided by the extension ? Is it possible to restrict a search for the items provided by my extension ? Regards, ++dom

I am trying to use the HMAC function in a swift package but it does not work it only works in standard view controller style packages. let hash = HMAC<Insecure.SHA1>.authenticationCode(for: counterData, using: SymmetricKey(data: secret))

Hi, I was reading Storing Keys in the Secure Enclave and was thinking, "that's great if you're writing new code from scratch, or updating an iOS-only code base...", but how do people integrate this functionality into well-worn packages, such as Openssl? What's the best practice for representing the Secure Enclave keystore in software? Is it closest to an HSM (hardware security module)? Or to a PKCS11 crypto-token like a smart card? Or maybe it's sufficiently unlike anything else. We have some management scripting that uses Openssl and I'd like to be able to make it "just work" with Secure Enclave keystore, but don't see any guidance on how best to do that. What is the developer community's collective experience and wisdom here? Thanks, -Philip