Is there a "System" Data Protection Keychain on Mac?

Since file-backed keychains are being deprecated in favor of the iOS-style / data protection keychains, is there an equivalent to storing device-wide credentials/keys in the System Keychain with this new model?

In my specific use-case, I ideally would want to make use of a signing key pair generated in Secure Enclave throughout all OS users (for device identity attestation purposes). However, based on my limited research, it doesn't look like the Secure Enclave key reference stored in the new keychain would be accessible by other users.

In case it can help, here's the dictionary of attributes that I pass to SecKeyCreateRandomKey when creating that key:

{
  kSecAttrAccessGroup: "<team identifier>.<bundle identifier>.signingkey",
  kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
  kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
  kSecAttrKeySizeInBits: @256,
  kSecAttrLabel: "CustomAppSigningKey",
  kSecPrivateKeyAttrs: {
    kSecAttrIsPermanent: @YES,
    kSecAttrAccessControl:
      SecAccessControlCreateWithFlags(
              kCFAllocatorDefault,
              kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
              kSecAccessControlPrivateKeyUsage, nullptr)
  }
}
Answered by DTS Engineer in 734183022

is there an equivalent to storing device-wide credentials/keys in the System Keychain with this new model?

No. To quote On Mac Keychains:

The data protection keychain is only available in a user login context. You cannot use it, for example, from a launchd daemon.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Accepted Answer

is there an equivalent to storing device-wide credentials/keys in the System Keychain with this new model?

No. To quote On Mac Keychains:

The data protection keychain is only available in a user login context. You cannot use it, for example, from a launchd daemon.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Is there a "System" Data Protection Keychain on Mac?
 
 
Q