Hello, this might not belong to dev forums, but rather support, the reason I'm posting here I seem to have localized problem via Apple logging, partially, and can't believe I can get any prompt answer if asked on discussions.apple.com... ckks data inaccessible and potential data loss what happend I was stupid enough to delete a few key records from iCloud Keychain ("Local Items"), using official /Applications/Utilities/Keychain Access.app ( seems like ephemeral keys / identifiers, ckks, idms and stuff). What was different this time: because the account uses ADP, I might have deleted some end-to-end encryption related material. I was not initially too much upset, as normally "trust" can be reestablished via fresh login. Prerequisite: my account is ADP-enabled. ckks state is waitfortrust which corresponds to what I get from Octagon CLI, later on in the post. is@airstation ~ % /usr/sbin/ckksctl status | head -15 ================================================================================ Global state: CKKS state machine: waitfortrust Active account: (null) CloudKit account: logged in Account tracker: <CKKSAccountStateTracker: <CKAccountInfo: accountStatus=Available, accountPartition=Prod, deviceToDeviceEncryptionAvailability=(account), hasValidCredentials=true, walrus=Could Not Determine>, hsa2: available> Syncing Policy: <TPSyncingPolicy: <TPPolicyVersion: 16, SHA256:/4gt8WFEXCVLYI+C+8/2MiMz6Srv0vpcvlkJ4gkepHQ=>, MacBookAir10,1, userViews: UNKNOWN> Views from policy: yes Reachability: network Retry: <CKKSNearFutureScheduler(zonemodifier-ckretryafter): no pending attempts CK DeviceID: 0B643F9E-AD74-4916-84A4-D3589F0B2061 CK DeviceID Error: (null) Lock state: <CKKSLockStateTracker: unlocked last:now> Attempt to recover using trusted phone number Obviously I just tried to login and waiting for the challenge to be sent to my trusted phone number. This didn't happen and System Settings GUI cannot handle it, doing just nothing. Inspired by prior success: attempt using Octagon Trust CLI Kudos to Apple for opening https://opensource.apple.com/source/Security/Security-59754.80.3/keychain/ which helped me tremendously to make sense of how it works, roughly :) So: previously I used bottled peers data and/or escrow records and recall success in the past with this approach (using recover commands), on the other occasion, had success in a much more simple way, by is@airstation ~ % /usr/sbin/otctl resetoctagon While worked great before Apple introduced ADP, attempt to reset Octagon quite recently for one of my accounts resulted in banning me from reenabling ADP on the account for some 3 months, damn, I understand why you have this feature in place, but srsly, it came hard on me (didn't find workaround for it :) ... and how it failed in a way resembling actual CloudKit bug is@airstation ~ % /usr/sbin/otctl allBottles returns nothing, but this is probably due to I don't have any trusted devices now. Well, this should not be fatal yet, right? Only not this is@airstation ~ % /usr/sbin/otctl fetchAllEscrowRecords fetching escrow records failed: Error Domain=CKErrorDomain Code=15 "CKInternalErrorDomain: 2000" UserInfo={ContainerID=com.apple.security.keychain, NSUnderlyingError=0x6000019e40f0 {Error Domain=CKInternalErrorDomain Code=2000 "(null)" UserInfo={ContainerID=com.apple.security.keychain, CKHTTPStatus=500, RequestUUID=4130264A-AD5A-4970-88EF-622667C6553B, OperationID=682A09E938434541}}, CKHTTPStatus=500, NSDebugDescription=CKInternalErrorDomain: 2000, RequestUUID=4130264A-AD5A-4970-88EF-622667C6553B, OperationID=682A09E938434541} My reversing didn't go that far to judge if it's related to absense of trusted peers or actual bug with CloudKit. Log messages from trustedpeershelperd: fetchViableBottles failed with error: <CKError 0x125636640: "Server Rejected Request" (15/2000); op = 3958A36F3B166393; uuid = 9C6FB698-E677-4B7C-A323-14121908371A; container ID = "com.apple.security.keychain"> fetchEscrowRecords failed with error: <CKError 0x125636640: "Server Rejected Request" (15/2000); op = 3958A36F3B166393; uuid = 9C6FB698-E677-4B7C-A323-14121908371A; container ID = "com.apple.security.keychain"> Is it CloudKit bug? Can I hope for rescuing my data? The sad thing about it, that due to lack of knowledge, I anticipate this can be fatal data loss. E.g. if some part of secret chain was discarded by HSM which I presume is irrecoverable.... I have only partial backup of Cloud Drive. There are Photos which are really important to me, so it would be so nice to get it back. At least if you can answer: if I can safely try resetoctagon this occasion as well, or if disabling ADP might help. @eskimo if there is any chance you could comment, I'd appreciate a lot. Kind regards, Peter

The call stack is followed: Incident Identifier: 5DBD18B5-29DD-48E1-8BE5-A648BD4E8CE3 CrashReporter Key: 4006fd6d63831c08be5068429b9892f633d41735 Hardware Model: iPhone12,5 Process: XXX Path: /private/var/containers/Bundle/Application/FD114B6F-9C45-4546-9924-082A2CF546B8/XXX.app/XXX Identifier: com.xxx.xxx Version: 2.0.0 (2.0.0.3) AppStoreTools: 13A227 AppVariant: 1:iPhone12,5:13 Code Type: ARM-64 (Native) Role: Unspecified Parent Process: launchd [1] Coalition: com.xxx.xxx [2761] Date/Time: 2021-09-28 14:24:03.8329 +0800 Launch Time: 2021-09-28 14:24:03.5890 +0800 OS Version: iPhone OS 15.0 (19A346) Release Type: User Baseband Version: 3.00.00 Report Version: 104 Exception Type: EXC_GUARD Exception Subtype: GUARD_TYPE_USER Exception Message: namespc 18 reason_code 0x0000000000000002 Exception Codes: 0x6000000000000012, 0x0000000000000002 Exception Note: SIMULATED (this is NOT a crash) Termination Reason: LIBSYSTEM; [2] Thread 3: Crashed 0 libsystem_kernel.dylib 0x1b80a2ae8 os_fault_with_payload + 7382641384 ((null)) 1 libsystem_trace.dylib 0x000000019bd941b4 _os_log_impl_flatten_and_send + 6909673908 ((null)) 2 libsystem_trace.dylib 0x000000019bd90b70 _os_log + 6909660016 ((null)) 3 libsystem_trace.dylib 0x000000019bd98cac _os_log_fault_impl + 6909693100 ((null)) 4 SyncedDefaults 0x1ad034c90 -[SYDRemotePreferencesSource initWithApplicationID:storeID:shared:additionalSource:containerPath:storeType:].cold.1 + 52 5 SyncedDefaults 0x1ad027210 -[SYDRemotePreferencesSource initWithApplicationID:storeID:shared:additionalSource:containerPath:storeType:] + 1400 6 Foundation 0x182ff5d58 -[NSUbiquitousKeyValueStore initWithBundleIdentifier:storeIdentifier:additionalStore:storeType:] + 348 7 Foundation 0x182fd8e84 __41+[NSUbiquitousKeyValueStore defaultStore]_block_invoke + 24 8 libdispatch.dylib 0x000000018140194c _dispatch_client_callout + 6463428940 ((null)) 9 libdispatch.dylib 0x00000001814031d4 _dispatch_once_callout + 6463435220 ((null)) 10 Foundation 0x182fe0668 +[NSUbiquitousKeyValueStore defaultStore] + 64 ... // omit insignificant call stack of the app 14 libdispatch.dylib 0x00000001813ffc00 _dispatch_call_block_and_release + 6463421440 ((null)) 15 libdispatch.dylib 0x000000018140194c _dispatch_client_callout + 6463428940 ((null)) 16 libdispatch.dylib 0x0000000181413064 _dispatch_root_queue_drain + 6463500388 ((null)) 17 libdispatch.dylib 0x0000000181413764 _dispatch_worker_thread2 + 6463502180 ((null)) 18 libsystem_pthread.dylib 0x00000001f12c5170 _pthread_wqthread + 8341180784 ((null)) 19 libsystem_pthread.dylib 0x00000001f12c4f4c start_wqthread + 8341180236 ((null)) What's mean the Exception Note: SIMULATED (this is NOT a crash)? It's not a crash? And then, is it possible a bug in iOS 15？because no crash reports before iOS 15. Thanks.

I am using AWS Cloud Services, when I create an EC2 instance Amazon automatically generates a Security Certificate in .pem file extension, it downloads to my computer, when I click it or try and import it to Keychain, there is an error. Terminal commands cannot locate the file. I used Homebrew to try and convert the file to .12, that will not work given the file cannot be located. Any thoughts?

I find myself in the keychain a series of accounts and related pw, normally created at the time, transformed into very long character strings like MEIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAw**************** The particular feature is that account and relative pw are almost the same, just one character varies (I think) but they are not, of course, the ones I chose. And, just as obviously, they don't work when requested by the sites... The phenomenon is recent, although I remember noticing something like this looking at the pw in my Mac keychains several macOSs ago - I then thought of some form of coding. But seeing these very long strings being proposed automatically when requested by the site, instead of original accounts and pw, worries me ... does anyone have experience of such a thing?

When I use Keychain Access to access .pem files, I receive an error, "An error has occurred. Unable to import an item. The contents of this item cannot be retrieved". I have used every method suggested such as change access the open only function. This it is not an available option to me. I have cleared all keys/certificates and rebooted my computer an innumerable amount of times. Utilized various method under "import items," saved to system, system roots, and local items and nothing works. The solution seems to involve removing and reinstalling the app, however, I am not able to perform this action. No matter the method used to access this app, via spotlight, go app, go utilities, or app search using finder, there is no option to delete the app. When I drag it to trash, it bounces back. I have two plus one guest users. I have repeated each of these actions under each user login believing one could be a master account. I ran the following command code to remove the app: sudo rm -rf / Applications/Utilities/Keychain\Access.app. After prompting me for my password, which seemed like a good sign, I receive the following message: rm: "/" may not be removed. I am crippled in AWS because I am unable to decrypt and access Key Pairs. I do not understand why I cannot delete the app. I do not understand why "keychain" may not be removed. Does anyone have any suggestions, thoughts, ideas, or considerations? I am grateful for any advice.

Hello guys, please how can i create my imei verification website for all Apple products?

After the MacOS version is updated to 12.6.1, the personal VPN cannot be connected. After troubleshooting, the sharedSecretReference may be invalid.(The sharedSecretReference is obtained from the keychain) os update before: security default-kechain-> "/Users/admin/Library/Keychains/login.keychain-db" os update after: security default-kechain-> security: SecKeychainCopyDefault: A default keychain could not be found. Although it can be corrected by this command :security default-keychain -s "/Library/Keychains/System.keychain" then,VPN can connect. I wonder if it is possible to fix this problem through code? Or is the code OK? This is a bug in the Apple system?

I found a crash by chance. It doesn't come up often. I upload the crash log. it seems the SecItemCopyMatching crashes. but I don not find the reason.          static LMNetwork * aInstance = nil;     static dispatch_once_t onceToken;     dispatch_once(&onceToken, ^{         aInstance = [[LMNetwork alloc] init];         //检测网络连接状态         [aInstance checkNetWorkStatus];     });          return aInstance; } - (instancetype)init{   if (self = [super init]){         self.networkQueue = dispatch_queue_create("com.aqara.network.queue", DISPATCH_QUEUE_CONCURRENT);     self.backQueueManager.completionQueue = self.networkQueue;     self.ioQueue = dispatch_queue_create("com.aqara.read.country.file", DISPATCH_QUEUE_CONCURRENT);       dispatch_sync(self.ioQueue, ^{           NSString* countryCode = [LMKeyChain objectForKey:@"loginCountryCode"];           [LMKeyChain removeObjectForKey:@"loginCountryCode"]; }); } LMKeyChain.m + (NSString*)objectForKey:(NSString*)key { [crash8.txt](https://developer.apple.com/forums/content/attachment/22a65c6b-fa57-4f15-97cc-70640330cfa9)  NSMutableDictionary *keychainQuery = [NSMutableDictionary dictionaryWithObjectsAndKeys:                                               (__bridge id)kSecClassGenericPassword,(__bridge id)kSecClass,                                               key, (__bridge id)kSecAttrService,                                               key, (__bridge id)kSecAttrAccount,                                               (__bridge id)kSecAttrAccessibleAfterFirstUnlock,(__bridge id)kSecAttrAccessible,                                               nil];         [keychainQuery setObject:(__bridge id)kCFBooleanTrue forKey:(__bridge id)kSecReturnData];         [keychainQuery setObject:(__bridge id)kSecMatchLimitOne forKey:(__bridge id)kSecMatchLimit];         CFDataRef keyData = NULL;         if (SecItemCopyMatching((__bridge CFDictionaryRef)keychainQuery, (CFTypeRef *)&keyData) == noErr) {             @try {                 ret = [NSKeyedUnarchiver unarchiveObjectWithData:(__bridge NSData *)keyData];             } @catch (NSException *e) {                 NSLog(@"Keychain Unarchive of %@ failed: %@", key, e);             }         }

I'm trying to build functionality into a custom browser, for personal use ATM, to emulate how Safari handles autofill for logging onto different sites. I'm unsure where to start. Any ideas/suggestions? I poked around and can't find a good place to start. Any examples of creating the connection to the iCloud Keychain and retrieving a credential set, would be beyond incredible, but just a pointer or to of where to start looking would help a lot as well. Thank you!

I found that this app allows users to log in directly with the last account password. I would like to know what interface is this provided by the system. This is not Apple Login！

I tried to store ID and password into iCloud Keychain, I have already done with all functionality and coding parts, I can easily store them when I test into Simulator but am unable to work with a real device. I have also gone through all the useful articles, but still facing the same issue. SecAddSharedWebCredential("domainName" as CFString, self.strEmailId as CFString, self.strPassword as CFString) { error in if error != nil { print(error?.localizedDescription) return } I have implemented the above code for storing ID and password, It works in Simulator but does not work on a real device. I faced the below error. ("The operation couldn’t be completed. (OSStatus error -25293 - "doaminName" failed to approve "TeamID.BundleIdentifier")") Can you please help me out?

I have a problem is we have some clients. And each client have difference Apple Development Id. But we want to share data between apps like Keychain Sharing or App Group but it require same Apple Development Id. So have any other ways for apps can share data with difference Apple Id?

{"message":{"Count":8,"bundleID":"org.whispersystems.signal","position":"background","sum_of_duration":91},"name":"embeddedOSAppUsageSessions","sampling":10,"uuid":"} {"message":{"Count":6,"bundleID":"org.whispersystems.signal","position":"foreground","sum_of_duration":410},"name":"embeddedOSAppUsageSessions","sampling":10,"uuid":"l"} {"message":{"Count":2,"bundleID":"org.whispersystems.signal.SignalNSE","position":"background","sum_of_duration":20},"name":"embeddedOSAppUsageSessions","sampling":10,"uuid":""} {"message":{"Count":3,"bundleID":"org.whispersystems.signal.shareextension","position":"background","sum_of_duration":3},"name":"embeddedOSAppUsageSessions","sampling":10,"uuid":"} {"message":{"Count":3,"bundleID":"org.whispersystems.signal.shareextension","position":"foreground","sum_of_duration":26},"name":"embeddedOSAppUsageSessions","sampling":10,"uuid":2"} {"message":{"Count":3685,"sum_of_initParameterCurve":null,"sum_of_initParameterCurve_SPI":null,"sum_of_initPatternPlayer":1,"sum_of_initPatternPlayer_SPI":550,"sum_of_startHapticEngine":3,"sum_of_startHapticEngine_SPI":1200},"name":"CH_Metrics_ProductUsage","sampling":10,"uuid":""}

The Keychain API SecItemAdd() returns -61 status code. Programming Language: objective-c OS: Mac BigSur 11.6.3 Default keychain: /Users/user_name/Library/Keychains/login.keychain-db Ownership: UID and GID of logged in user match those of the keychain Status of keychain as reported by SecKeychainGetStatus(): 7 (unlocked + read-permission + write-permission) Test runs fine in local environment but fails in CI environment

Please tell me the link of source code and project of this shiny app.

We got my grandmother a new phone and cannot sign into her icloud on the new phone as the number connected to the account is incorrect. We do not receive the codes and cannot recover the account as it asks us for the phone number, which ends in 72, and we do not know the number. This number does not belong to any of us, nor has it ever belonged to us, therefore it must be an error on the system as you can't even set up the two factor verification without initially receiving a code on that number. Thus, this is an apple error. It is not an old number of my grandmother or any other family member, and is therefore an error on Apple's side as we could not physically have set up the authentication without access to that number. How can we recover the account without this number (we have the email address and password) I have phoned support and they have been as useless as a sunroof in a submarine.

I saved my customized identifier into the KeyChain on iOS.It will be shared in devices that using the same appleid? I've tryed with three iPhones, they are diffrent device type.I use my appleid to Login in iCloud.First step, I save one customized identifer by objective-c codes.Then debug on the other iPhones,but i can't get the identifer that saved in the first iPhone. But my some users found that they use a new iOS device,their new devices can use the old customized identifier directly while they use thire appleid to active new device.I need to know why?