We are using Keychain Services and saving password using SecItemAdd() with kSecClassGenericPassword in our App. We know using the Keychain Access on Mac, we can see Keychain Items for MacOS Apps by the admin of Mac PC. Is there a way exist to view keychain items for iOS(iPhone/iPad).? My use case is, iPad(company device, not MDM) is shared between two or more persons.Each time app-user logs in to the same app using their own respective passwords(stored in keychain) . Security Concern is, such keychain items(passwords) will be able to see by others(including the owner of iPad/iPhone)? Ex: connecting to another Mac PC or some tool exist like Keychain Access present in MacOS or case when current local keychain is sync'd to iCloud Keychain. We don't want users of iPad/iPhone to see other users password. Is there any other solution exists other than Keychain?

Can password less authentication to mac desktop be configured using third party authenticator that manages private and public key lefecycle ? https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication

Is there a way to automate Biometric Authentication on real devices? I already automated Touch ID & Face ID on the simulator, but I'm not able to provide proper authentication on a real device. Any tips?

Hi, I'm trying to retrieve trusted certificates from the Apple's Keychain using plain C API. From reading some articles, my understanding is that Apple has C API to access Apple's Keychain Apple provides Objective-C and Swift wrappers for the C API I see that the documentation for Objective C and Swift: https://developer.apple.com/documentation/security/keychain_services?language=objc Could somebody help me figure out the followings? Q1. Is there a C API available? Q2. Where can I find the header files? Q3. Which libraries do I need to link my program to? Thanks in advance!

Hi, I am developing an app that requires manually checking if a certificate has been revoked via a CRL (certificate revocation list). However, I'm running into an issue where my revocation check fails due to my root certificate "not meeting pinning requirements". After some searching I found this article: https://support.apple.com/en-us/HT210176 That article indicates that iOS requires certificates to have certain key sizes, etc. which my root certificate seemingly does not. Is there any way to get around that when you are performing a trust evaluation manually? (i.e. via SecTrustEvaluateWithError). Note that the certificates I am working with are NOT used for TLS connections, which is why I was hoping there was a workaround for this. For reference, I am using code similar to the following: // Create policies let basicPolicy = SecPolicyCreateBasicX509() let crlPolicy = SecPolicyCreateRevocation(kSecRevocationOCSPMethod | kSecRevocationCRLMethod | kSecRevocationRequirePositiveResponse) // Create trust var trust: SecTrust? SecTrustCreateWithCertificates(cert, [basicPolicy, crlPolicy] as CFArray, &trust) SecTrustSetAnchorCertificates(trust, [rootCert] as CFArray) SecTrustSetNetworkFetchAllowed(trust, true) // Evaluate trust var error: CFError? guard SecTrustEvaluateWithError(trust, &error) else {   // Handle error } In the above code cert is the certificate I'm checking and rootCert is the root certificate that contains the CRL distribution points. The error I am getting is: Error Domain=NSOSStatusErrorDomain Code=-67635 ""<redacted>","<redacted>" certificates do not meet pinning requirements" Thanks!

In older MacOS versions, below API would create access ref object of the app running the code and store it into SectrustedApplicationRef mySelf object. SecTrustedApplicationRef mySelf = NULL; SecTrustedApplicationCreateFromPath(NULL, &amp;mySelf); Then I can store mySelf in an array - allTrustedApps, and create SecAccessRef object    SecAccessRef accessRef = NULL;   status = SecAccessCreate((CFStringRef)accessLabel, (__bridge CFArrayRef)allTrustedApps, &amp;accessRef); Finally, I would then add this access ref object into kSecAttrAccess field of the query dictionary before feeding it into SecItemAdd. However, on MacOS 10.15+ SecTrustedApplicationCreateFromPath is deprecated. As I was playing around with ACL, and when I tried to add a kSecClassGenericPassword object into login keychain using SecItemAdd, without 'KSecAttrAccess' in the write query dictionary. (nothing but kSecAttrAccount and kSecAttrService) - I've noticed that the final object in the login keychain still has ACL containing the hosting app that ran the keychain add op. Is this by design? Thanks, Peter

Let's say I have a login keychain with ACL that contains trusted application list. Now I want to add a new SecTrustedApplicationRef to this existing list, and hence update the ACL of this object. Here's the steps I took, but doesn't seem to be working retrieve keychain item reference of kSecClassGenericPassword object OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)queryDictionary,(CFTypeRef *)&amp;attributeDictionary); Then get existing access ref  SecKeychainItemRef itemRef = (SecKeychainItemRef) CFBridgingRetain([bridgedDict objectForKey:(__bridge id)kSecValueRef]);       SecAccessRef accessRef = NULL;       status = SecKeychainItemCopyAccess(itemRef,&amp;accessRef); Update this existing Access Ref by appending a new ACL that contains new trusted apps info      status = SecACLCreateWithSimpleContents(accessRef, (__bridge CFArrayRef)microsoftTrustedApps, (__bridge CFStringRef)tenantIdentifier, kSecKeychainPromptRequirePassphase, &amp;newAcl); Finally, update access ref using SecItemUpdate      NSMutableDictionary *origQuery = [NSMutableDictionary new];     [origQuery setObject:tenantIdentifier forKey:(__bridge id)kSecAttrService];     [origQuery setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id)kSecClass];     NSMutableDictionary *updateQuery = [NSMutableDictionary new];     [updateQuery setObject:(__bridge id)accessRef forKey:(__bridge id)kSecAttrAccess];     status = SecItemUpdate((CFDictionaryRef)origQuery, (CFDictionaryRef)updateQuery); It does return errSecSuccess, and I get prompted for passphrase during SecItemUpdate, but the resultant login keychain object in keychain access still doesn't show the new app under "always allow access by these applications" under "Access Control" tab. Any help would be appreciated. Thanks!

I am working on implementing the local authentication on my app so I have to test both Face Id and Touch Id from the simulator. Face Id is visible like below but unable to find out Touch Id option. I have checked on both iOS 13.00 simulator and iOS 14.00 simulator but Touch ID option is hidden in both simulator.

When calling SecKeyIsAlgorithmSupported (https://developer.apple.com/documentation/security/1644057-seckeyisalgorithmsupported?language=objc) with private key from secure enclave and parameters for algorithms and operations commonly not used for private keys causes crash on macOS. Same call with same parameters work on iOS. I'm unit testing a utility with private key stored in secure enclave. When I call SecKeyIsAlgorithmSupported(:::) as below causes crash on macOS but not on iOS SecKeyIsAlgorithmSupported(self.eccPrivateKey, kSecKeyOperationTypeVerify, kSecKeyAlgorithmECDSASignatureDigestX962SHA256); //where self.eccPrivateKey is key in secure enclave on my mac book pro. Also crashes for these parameters : SecKeyIsAlgorithmSupported(self.eccPrivateKey, kSecKeyOperationTypeEncrypt, kSecKeyAlgorithmECIESEncryptionCofactorX963SHA256AESGCM); Crash `2021-09-29 22:36:28.949061-0700 MSIDTestHostAppMac[98643:1430360] *** Assertion failure in CFTypeRef TKTokenCopyOperationResult(TKTokenRef, CFDataRef, CFIndex, CFArrayRef, CFIndex, CFTypeRef, CFTypeRef, CFErrorRef *)(), ctkclient.m:519 2021-09-29 22:36:28.955505-0700 MSIDTestHostAppMac[98643:1430360] [General] An uncaught exception was raised 2021-09-29 22:36:28.955662-0700 MSIDTestHostAppMac[98643:1430360] [General] Invalid keyOperation 1 requested 2021-09-29 22:36:28.955802-0700 MSIDTestHostAppMac[98643:1430360] [General] ( 0 CoreFoundation 0x00007fff206641db __exceptionPreprocess + 242 1 libobjc.A.dylib 0x00007fff2039dd92 objc_exception_throw + 48 2 CoreFoundation 0x00007fff2068d352 +[NSException raise:format:arguments:] + 88 3 Foundation 0x00007fff214892ec -[NSAssertionHandler handleFailureInFunction:file:lineNumber:description:] + 166 4 Security 0x00007fff223fc7bd TKTokenCopyOperationResult + 381 5 Security 0x00007fff2245abcf __SecCTKKeyCopyOperationResult_block_invoke + 453 6 Security 0x00007fff224522b8 SecItemAuthDo + 103 7 Security 0x00007fff2245a6d2 SecCTKKeyCopyOperationResult + 480 8 Security 0x00007fff2245f13a SecKeyRunAlgorithmAndCopyResult + 251 9 Security 0x00007fff22460db5 SecKeyIsAlgorithmSupported + 100 10 IdentityCoreTests 0x0000000110130445 +[MSIDKeyOperationUtil isOperationSupportedByKey:algorithm:key:context:error:] + 325 11 IdentityCoreTests 0x000000010fe3cde7 -[MSIDKeyOperationUtilTest testIfOperationIsSupportedByKey] + 7287 12 CoreFoundation 0x00007fff205cd6fc __invoking___ + 140 13 CoreFoundation 0x00007fff205cd59d -[NSInvocation invoke] + 305 14 XCTest 0x000000010edc61f7 +[XCTFailableInvocation invokeStandardConventionInvocation:completion:] + 64 15 XCTest 0x000000010edc61b5 __65+[XCTFailableInvocation invokeInvocation:lastObservedErrorIssue:]_block_invoke_3 + 23 16 XCTest 0x000000010edc5c5b __81+[XCTFailableInvocation invokeWithAsynchronousWait:lastObservedErrorIssue:block:]_block_invoke.11 + 71 17 XCTest 0x000000010ee8ab0d +[XCTSwiftErrorObservation observeErrorsInBlock:] + 113` The same calls do not crash on iOS and correctly return NO Have opened a feedback : 9665871 as well

After upgrading to iOS 15, when I open the app after a couple of hours, we are not able to retrieve keychain data in didFinishLaunchingWithOptions delegate method. For each new launch we are facing the same issue of of not retrieving keychain data. We need to relogin to process further in the application. But for iOS 14 and below we are not facing this issue, we are able to retrieve the keychain data in didFinishLaunchingWithOptions delegate. Is anyone facing the same issue in their application?

Can we rely on an order of precedence for muting and unmute paths? For example, if I mute "/", then unmute "/tmp/testdir", can I reliably believe I'll get events for "/tmp/testdir"? I can test this, obviously, but it'd be great to be able to rely on a certain behavior here.

Hi, As per the documentation (https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens), "after creating the JWT, sign it using the Elliptic Curve Digital Signature Algorithm (ECDSA) with the P-256 curve and the SHA-256 hash algorithm". OpenSSL seems to list 2 types for this kind of curve: secp256k1 and prime256v1. What is the one matching Apple specs? Thank you

I am currently monitoring ES_EVENT_TYPE_AUTH_CLONE events in my Endpoint Security client, but it seems to only respond to file, not folder, copies from finder. Is there any existing event to allow notification of a copy of a folder in finder? If not, are there any future plans to include such an event in the ES event list? Thank you.

It seems that the SecTrustSettingsSetTrustSettings API requires an alert panel asking for authentication on MacOS Big Sur even when the calling process is running as root. This would mean the process calling this API must be in a GUI environment. Is there any way for our users to avoid this prompt and have the certificate we generated be inserted and trusted into the System Keychain running as a background daemon? What are some options / alternatives we have to address this issue? It would be ideal if we could set trust settings without requiring a prompt.

I would like to clarify the scope of section 5.1.1 (ix) of the app privacy policy, related to account sign-in.              "If your app supports account creation, you must also offer account deletion within the app." I understand that this will take effect from January 2022 https://developer.apple.com/news/?id=mdkbobfo Is there an exception for financial apps that include account creation / registration (e.g. banking apps)? The objective of the policy change seems to be to offer users a convenient and transparent option of unregistering from a service and deleting any related data. However, deleting a login for a banking app has more implications than just de-registering from the service (e.g. what to do with account balance, regulatory requirements may apply). Therefore direct interaction between the app user and the financial institution is likely to occur irrespective of any in-app options. Would either of these options be sufficient to comply with the iOS App Privacy Policy? Option 1 - include within the app a link to, or summary of, the bank's policy on how to close an account (e.g. contact bank directly over telephone, email, or in person). Option 2 - deactivation of login access via the mobile app (vs full closure of account).  If so, does the deactivation have to be performed within the app itself or could it be performed on a similar basis to account closure? (e.g. over telephone/email).

Hi, I developed an application to validate if a device has jailbroken or cydia app. I would like to know how can I test such a jailbreak detection application? Does Apple has a way or method to test this? If You don't have an official method, how would you suggest I test it? Do I need a jailbreak device for testing? My need is to ensure that my application will block the use of devices that have Jailbreak. However according to Apple's terms of use jailbreak is illegal and its use violates the terms of use and warranty of the device, so I need some way to do these tests without having to jailbreak a device. Are there any recommendation from Apple on how can I do these tests?

Hi, I am developing an Endpoint Security extension and I would like to get the full list of processes that ended up calling the process I receive in an event. For example if I receive a es_process_t I have this process audit token, I would like to get the parents audit token and then the parent's parent token and so on till I get the full list of processes. I hope i made myself clear :)

Hi, Starting from a .p8 file which contains both a private and a public key, I'm looking for the required steps to create a certificate, then create a JKS KeyStore, and finally import the certificate into the KeyStore. I've searching on the Net without success. Maybe someone could help on this one? Thank you

Hi Developers, I am wondering how is it possible for other smartphone-based FIDO authenticators to use the same iCloud Keychain storage as Passkey does so those credentials can be used on non-apple devices too, and also on the smartphone at the same time. There are some other iOS authenticators that have implemented BLE and are working on all devices including Windows, but the problem is that those apps cannot support signing in to the website on the smartphone itself (neither in apps nor inside the browser) using the previously registered credential of 'cross-platform' type.

Hello, I am experiencing an issue with the SecItemDelete() function using iPhone 13Pro with iOS 15.1. A call to SecItemDelete() crashes with EXC_BREAKPOINT under certain conditions outlined below: Make sure Iphone has a passcode set. Call SecKeyGeneratePair() to create an EC key pair with kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly and kSecAttrTokenIDSecureEnclave. Remove passcode from iPhone Set a new passcode for iPhone. Call SecItemDelete() to delete private key from SecureEnclave. This call fails with -26275 (errSecInvalidKey) which is expected as the key is destroyed already Call SecItemDelete() to delete public key from KeyChain. SecItemDelete causes a trace trap and app crashes. I can not see any obvious problems in the code that should generate this behaviour. I am in urgent need to fix this problem and would really appreciate some help or pointers. The backtrace for the crashing thread below. More info can be provided if necessary. To me it seems to be related to situations where SecItemDelete() has returned an error (where secure enclave is involved) and that the next call generates the trap. Kind regards, Steffen * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=1, subcode=0x18067911c)   frame #0: 0x000000018067911c CoreFoundation`CFRelease + 88   frame #1: 0x00000001894420f0 Security`SetLastError + 76   frame #2: 0x000000018943ee18 Security`SecOSStatusWith + 140   frame #3: 0x00000001894436d4 Security`SecItemDelete + 524  * frame #4: 0x000000010076d3bc TheApp`-[TheAppCrypto deleteKey:isRSA:useSecureEnclave:keychainGroup:error:](self=0x00000002833ec160