I'm trying to modify Chromium to generate a key pair in the Secure Enclave on MacOS, but I'm always getting the following error
OSStatus error -34018 - failed to generate asymmetric keypair
from the following code.
CFErrorRef access_error = NULL;
SecAccessControlRef access_control = SecAccessControlCreateWithFlags(
kCFAllocatorDefault,
kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
kSecAccessControlPrivateKeyUsage,
&access_error
);
NSDictionary *attributes = @{
(__bridge id)kSecAttrKeyType: (__bridge id)kSecAttrKeyTypeECSECPrimeRandom,
(__bridge id)kSecAttrKeySizeInBits: @256,
(__bridge id)kSecAttrTokenID: (__bridge id)kSecAttrTokenIDSecureEnclave,
(__bridge id)kSecPrivateKeyAttrs: @{
(__bridge id)kSecAttrIsPermanent: @YES,
(__bridge id)kSecAttrAccessControl: (__bridge id)access_control
}
};
CFErrorRef creation_error = NULL;
SecKeyRef key_ref = SecKeyCreateRandomKey((__bridge CFDictionaryRef)attributes, &creation_error);
if (creation_error != NULL)
LOG(ERROR) << "Failed to create key: " << CFErrorCopyDescription(creation_error);
-34018 seems to map to errSecMissingEntitlement, but I'm not sure what the missing entitlement is. Chromium comes with several entitlements configured, and I've signed and notarized the app, but it still does not work with the installed app from the notarized .dmg file.
Running
codesign -d --entitlements - Chromium.app
returns
[Dict]
[Key] com.apple.application-identifier
[Value]
[String] <redacted-teamid>.<redacted-bundleid>
[Key] keychain-access-groups
[Value]
[Array]
[String] <redacted-teamid>.<redacted-bundleid>.devicetrust
[String] <redacted-teamid>.<redacted-bundleid>.webauthn
Checking the embedded .provisionprofile (and the DER encoded profile) per these instructions also shows these entitlements in the notarized .app.
The same code works in a local Xcode project, so I figure it must be how I've configured Chromium, but I can't figure out what the missing piece is.
I am able to create keys in the keychain, in Chromium, if I remove the kSecAttrAccessControl and kSecAttrTokenID attributes. It's only when I'm trying to access the secure enclave, it seems.
I've tried multiple things to find the issue:
- I've read the docs * Protecting keys with the Secure Enclave | Apple Developer Documentation
- I've tried setting different keychain-access-groups, using the default, and other suggestions, described here
- I've searched online and found similar issues, but none of the solutions helped
- I've read through Apple's OSS Distribution to see the implementation of SecCreateRandomKey
- I've reviewed the two existing implementations in Chromium, and tried to directly call them instead of rolling my own
- https://source.chromium.org/chromium/chromium/src/+/main:device/fido/mac/credential_store.mm
- https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/enterprise/connectors/device_trust/key_management/core/mac/secure_enclave_helper_impl.mm
Does anyone see what the issue could be? This is all running on my M2 MacBook Pro on Ventura 13.3, if it matters.
