I'm trying to generate an asymmetric key pair on a Mac without the default ACLs, but it doesn't look like there are recognized dictionary keys that can be passed in to SecKeyGeneratePair() to do this automatiically. When removing the ACLs from the private key immediately afterwards, the user is prompted, which is not at all the experience I want, especially since I'm just trying to modify the key I just generated and ostensibly belongs to me. Below I have my current implementation.
var public:SecKey?, private:SecKey?
let options:CFDictionary = [kSecAttrKeyType as String:kSecAttrKeyTypeEC as String, kSecAttrKeySizeInBits as String: SecKeySizes.secp521r1.rawValue] as CFDictionary
guard SecKeyGeneratePair(options, &public, &private) == errSecSuccess,
let publicKey = public else {
return nil
}
var acc:SecAccess?
if let privateKey = private, let item = privateKey.keychainItem, SecKeychainItemCopyAccess(item, &acc) == errSecSuccess, let access = acc {
(SecAccessCopyMatchingACLList(access, kSecACLAuthorizationSign) as? [SecACL])?.forEach {
var apps:CFArray?, desc:CFString?, selec = SecKeychainPromptSelector()
if SecACLCopyContents($0, &apps, &desc, &selec) == errSecSuccess, let description = desc {
SecACLSetContents($0, [] as CFArray, description, .requirePassphase)
}
}
SecKeychainItemSetAccess(item, access)
}