Hello! The documentation says that the SE stores only 256-bit elliptic curve private keys at: https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave However I'm a bit baffled because if I generate keys with kSecAttrKeyType kSecAttrKeyTypeEC, kSecAttrKeySizeInBits 384 and kSecAttrTokenID kSecAttrTokenIDSecureEnclave the call is successful. I get a private key that I also can query with SecItemCopyMatching. I can also sign data with SecKeyCreateSignature with SecKeyAlgorithm.ecdsaSignatureMessageX962SHA384 algorithm and verify the signature with SecKeyVerifySignature. SecKeyIsAlgorithmSupported also returns ok. So my question is this: What really happens? Are 384 bit keys supported by secure enclave? Does the key generation fail silently and use regular keychain? Does it somehow still use 256 bit keys in secure enclave even though 384 is specified?

Hi, in my ES application I am trying to ignore execution events of apple processes. I think the way to do this is to check for the is_platform_binary attribute of es_message_t but i found that when executing Xcode this attribute is false, is it because I downloaded it from the app store? Also would checking for the "com.apple" prefix of the signing id be a good way to identify apple signed processes?

Hey there, I'm trying to employ the same pattern as demonstrated in the EvenBetterAuthorizationSample: an unsandboxed XPC service calls SMJobBless to install a privileged helper service on behalf a sandboxed main app (which isn't allowed to call SMJobBless). It then starts an XPC connection to the Mach service hosted by the privileged service, and hands over the connection back to the main app, along with the XPC service's connection to the security server (AuthorizationRef). When I try to do call SMJobBless from my XPC service, I get these messages: info authd Process /usr/libexec/smd (PID 28881) evaluates 1 rights with flags 00000003 (engine 629): ( "com.apple.ServiceManagement.blesshelper" ) error authd Fatal: interaction not allowed (session has no ui access) (engine 629) default authd Failed to authorize right 'com.apple.ServiceManagement.blesshelper' by client '/usr/libexec/smd' [28881] for authorization created by '/MyApp.app/Contents/XPCServices/IntermediatorXPCService.xpc' [29325] (3,0) (-60007) (engine 629) error authd copy_rights: authorization failed This seems reasonable to me, because I wouldn't expect an XPC service to be capable of running graphics. However, this works just fine in the "App-Sandboxed" app in the EvenBetterAuthorizationSample project. I poked around the available open source code, and found out that this message is logged when the processes' audit session doesn't have AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS set. if (!(session_get_attributes(auth_token_get_session(engine->auth)) & AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS)) { os_log_error(AUTHD_LOG, "Fatal: interaction not allowed (session has no ui access) (engine %lld)", engine->engine_index); return errAuthorizationInteractionNotAllowed; } Out of curiosity, I compared the audit sessions of my XPC service to the one in EBAS using this code: auditinfo_addr_t auditInfo; int result = getaudit_addr(&auditInfo, sizeof(auditInfo)); assert(result == 0 ); if (auditInfo.ai_flags & AU_SESSION_FLAG_IS_INITIAL) { NSLog(@"AU_SESSION_FLAG_IS_INITIAL"); } if (auditInfo.ai_flags & AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS) { NSLog(@"AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS"); } if (auditInfo.ai_flags & AU_SESSION_FLAG_HAS_TTY) { NSLog(@"AU_SESSION_FLAG_HAS_TTY"); } if (auditInfo.ai_flags & AU_SESSION_FLAG_IS_REMOTE) { NSLog(@"AU_SESSION_FLAG_IS_REMOTE"); } if (auditInfo.ai_flags & AU_SESSION_FLAG_HAS_CONSOLE_ACCESS) { NSLog(@"AU_SESSION_FLAG_HAS_CONSOLE_ACCESS"); } if (auditInfo.ai_flags & AU_SESSION_FLAG_HAS_AUTHENTICATED) { NSLog(@"AU_SESSION_FLAG_HAS_AUTHENTICATED"); } Sure enough, I got different results. EBAS: 2021-11-20 18:45:52.792512-0500 com.example.apple-samplecode.EBAS.XPCService[25296:592874] result: 0 2021-11-20 18:45:52.792527-0500 com.example.apple-samplecode.EBAS.XPCService[25296:592874] AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS 2021-11-20 18:45:52.792539-0500 com.example.apple-samplecode.EBAS.XPCService[25296:592874] AU_SESSION_FLAG_HAS_TTY 2021-11-20 18:45:52.792549-0500 com.example.apple-samplecode.EBAS.XPCService[25296:592874] AU_SESSION_FLAG_HAS_CONSOLE_ACCESS (lldb) p auditInfo (auditinfo_addr_t) $0 = { ai_auid = 501 ai_mask = (am_success = 4294967295, am_failure = 4294967295) ai_termid = { at_port = 50331650 at_type = 4 at_addr = ([0] = 0, [1] = 0, [2] = 0, [3] = 0) } ai_asid = 100019 ai_flags = 8240 } My XPC service: 2021-11-20 21:33:44.355007-0500 IntermediatorXPCService[29325:698278] result: 0 (lldb) p auditInfo ▿ __C.auditinfo_addr - ai_auid: 4294967295 ▿ ai_mask: __C.au_mask - am_success: 4294967295 - am_failure: 4294967295 ▿ ai_termid: __C.au_tid_addr - at_port: 0 - at_type: 4 ▿ at_addr: (4 elements) - .0: 0 - .1: 0 - .2: 0 - .3: 0 - ai_asid: 102293 - ai_flags: 0 It looks like ai_flags is all 0. Any ideas why that might be? What is making EBAS special? And also, how can AU_SESSION_FLAG_HAS_TTY and AU_SESSION_FLAG_HAS_CONSOLE_ACCESS be false? I'm reading these logs from the console?! (Another curious observation: audit_session_flags is imported into Swift as RawRepresentable, but not as an OptionSet)

Hi, I’ve recently had questions regarding GDPR and privacy on Apple products and spoke to numerous sources regarding it, but some of my queries remain unanswered. I was then directed to this forum so I’m hoping someone on here may be able to help please! In Apple’s development program information, In article 3.3.12 it states: “You and Your Applications (and any third party with whom You have contracted to serve advertising) may use the Advertising Identifier, and any information obtained through the use of the Advertising Identifier, only for the purpose of serving advertising. If a user resets the Advertising Identifier, then You agree not to combine, correlate, link or otherwise associate, either directly or indirectly, the prior Advertising Identifier and any derived information with the reset Advertising Identifier.” Following seeing the aforementioned article I asked if this meant that iOS apps are only allowed to associate one IDFA with one user? I.e. if an app user got a new iPhone, would this mean that the application developers would have to remove the previous IDFA, and now associate the one from the new device with the user?  Hope that makes sense and that you may be able to help.  Thanks

Does any have anyone have documentation on the usage related to the forMessageContext and messageContext parameters and for the methods below? This is undocumented while public making it an unusable API. func extensionViewController(messageContext: Data) -> MEExtensionViewController? func primaryActionClicked(forMessageContext context: Data) async -> MEExtensionViewController? The APIs are located here but lack any kind of proper documentation and examples https://developer.apple.com/documentation/mailkit/memessagesecurityhandler/3882908-extensionviewcontroller

In our macOS Application I am trying to generate a keypair in the system keychain using SecKeyCreatePair for legacy reasons, but keep receive an error -61 (Write permission error). What is the best approach to making this work or is this simply not possible (anymore)? The End User running this Application is typically an Admin and we would normally use the SFAuthorization to grab sudo for this type of issue. This is not possible using Apple Security Framework functions as far as I can see, not even the latest function SecKeyCreateRandomKey.

Hi, I'm adding certificate to keychain as describe Here I add the certificate to keychain successfully but when I try to fetch it, it always return error item not found (25300) I'm running on macOS Big Sur (ver 11.6) Below is the code. What am I missing ? Thanks, Tal // code that insert the certificate NSDictionary* addquery = @{ (id)kSecValueRef: (__bridge id)cert, (id)kSecClass: (id)kSecClassCertificate, (id)kSecAttrLabel: @"ClientCert"}; OSStatus status = SecItemAdd((__bridge CFDictionaryRef)addquery, nullptr); // code that fetch the certificate NSDictionary *queryDict = @{ (id) kSecClass : (id) kSecClassCertificate, (id) kSecAttrLabel : @"ClientCert", (id) kSecReturnRef : @YES}; auto sanityCheck = SecItemCopyMatching((__bridge CFDictionaryRef) queryDict, (CFTypeRef *) &m_client_cert);

I created public/private key with SecKeyCreateRandomKey. I then use openssl to create csr and a client certificate using the private key. The private key and certificate exist together in the keychain. I then query for the certificate with SecItemCopyMatching and use that certificate to create the identity: SecIdentityCreateWithCertificate( nullptr, client_cert, &identity) I get error result of errSecItemNotFound. Any idea what is wrong here ? I'm running on macOS version 11.6 Thanks, Tal

Hi, I work for an italian company that provides services for financial institutions. We're developing an iOS App that needs to access the following information (last 3 months): calls: type (in, out, missed), date and duration text messages: type (inbox, sent, draft), date and raw text list of bundle identifiers of each installed app internet provider name we read here https://developer.apple.com/app-store/app-privacy-details/ that regulated financial services has special treatment, and our app (published by an italian bank) surely fits the description. Can we receive technical specifications of how to read this information?

Is there a replacement for "SecKeychainItemGetUniqueRecordID"? I'm getting certificates from two different places and I would like a safe way to confirm if these two item are referencing the exact same object in the entire keychain. p.s. Why is "Keychain" or "SecKeychainItem" not a tag?

Hi I was wondering how I could get the code directory hash string of an app given its audit token. I would like to do this in Swift. Thanks.

I saved my customized identifier into the KeyChain on iOS.It will be shared in devices that using the same appleid? I've tryed with three iPhones, they are diffrent device type.I use my appleid to Login in iCloud.First step, I save one customized identifer by objective-c codes.Then debug on the other iPhones,but i can't get the identifer that saved in the first iPhone. But my some users found that they use a new iOS device,their new devices can use the old customized identifier directly while they use thire appleid to active new device.I need to know why?

We used ecb mode before, but now we need to change to aes-gcm algorithm to encrypt and decrypt messages and verify signatures. I know that there is “/AES/GCM/NoPadding” in java to achieve gcm. Does Apple provide corresponding function libraries?

Hello! I have X.509 certificates for code signing in my application that have non-standard X.509 critical extensions. On Android, the trust evaluation APIs allow for a callback with unrecognised crit exts so that the app code can validate them. Is there something similar on iOS? Right now all calls to SecTrustEvaluateWithError fail with “Microsoft Corporation” has errors: Found unknown critical extensions

Hi, I'm creating private/public key and try to export the public key to pkcs8 format with no success. I'm only able to get it in pkcs1 format. Creation of keys are done with SecKeyCreateRandomKey. I then use SecKeyCopyPublicKey to get the public key. Finally I use SecItemExport to get it to the desired format. When using it with parameter kSecFormatWrappedPKCS8, it failed with error errSecParam. I'm able to get it successful only like that: SecItemExport(m_public_key, kSecFormatOpenSSL, kSecItemPemArmour, nullptr, &data); Any idea why using kSecFormatWrappedPKCS8 failed ? Also, how can I convert it from PKCS1 to PKCS8 ? Thanks, Tal

I am integrating with Sign In with Apple, but I've got confused by the doc. It says here and here that the user identifier is team-scoped and is the same across all the apps in the development team associated with my Apple Developer account. Now my questions are as follow: What if I leave the team? Will my app still get the old user identifier? Likewise, what if I joined a team? Does it mean that apps developed by different developers get the same user identifier as long as these developers are in the same team? How does it work if I join multiple teams?

Hi all, I'm wondering if anyone has built apps specifically using FaceID, does apple allow developers to access FaceID source to develop app for features other than authentication? For example: Apple uses FaceID for attention awareness when diming the screen... I'd like to know if there are any apps out there that take advantage of the FaceID hardware in other ways?

In the user interface, Apple says: iCloud Private Relay keeps your internet activity private Private Relay hides your IP address and browsing activity in Safari and protects your unencrypted internet traffic so that no one-including Apple-can see both who you are and what sites you're visiting BUT when I look at the Apple IT support documentation the above is contradicted. Based on it, what would be true is: iCloud Private Relay keeps your WEB activity private Private Relay hides your IP address and browsing activity in Safari and protects your unencrypted WEB and UNENCRYPTED APP traffic. In addition to the corrections I made above, the rest of it (below) is just…terribly problematic! I’m not even sure how to correct it but it’s wrong. Agreed? I mean any aware user is (likely) going to know that if you tell a website like your bank) who you are, while using iCloud private relay (IPR), it will know who and where you are. But they’ll also know your IP, since Apple is saying only to us that encrypted internet traffic doesn’t go through IPR. This would include HTTPS, SMTPS, IMAPS, GOPHERS, … And even a fairly savvy user reading the following isn’t going to realize that Apple is not fixing the Panopticon problem, meaning that as is, the following part is generally false and de deceiving: …so that no one-including Apple-can see both who you are and what sites you're visiting. What’s a customer going to think when they realize that our apps aren’t delivering what Apple‘s promising because it’s inconsistent about what is promising to who? Is there already discussion going on about this? seems like a big issue… Fortunately, Apple is saying the product is in beta, so they will likely be extra open to and relatively responsive to feedback. But I wanted to talk with other developers about it so that’s why am bringing it up here. Maybe I’m misunderstanding stuff.

First of all I know MD5 is "broken" and we shouldn't be using it but it's not my choice and there is legacy code I need to work with so for now at least I need to sign some data using MD5 and a RSA signing Key. I think this is enough to explain the problem but I can share more code if needed. I'm using this to sign: let result = SecKeyRawSign(privateKey, SecPadding.PKCS1MD5, digestData.arrayOfBytes(), digestData.count, &signatureBytes, &signatureDataLength) But that throws the error OSStatusCode -50 (parameter error from the Security framework) If I change the padding to SecPadding.PKCS1SHA256 it works and after testing all the SecPadding options: Fails with OSStatus -50: OAEP sigRaw PKCS1MD2 PKCS1MD5 Works: PKCS1 PKCS1SHA1 PKCS1SHA224 PKCS1SHA256 PKCS1SHA384 PKCS1SHA512 The digestData is created using CC_MD5 no matter which padding I've used so its stranger that it works with the SHA padding but not with MD5. I'm getting a similar error when attempting to do this using the SwCrypt library, when using MD5 & PKCS1 padding I get the OSStatus -4300 which is a parameter error from CommonCrypto. let result = try CC.RSA.sign(paramString.data(using: .utf8)!, derKey: der, padding: .pkcs15, digest: .md5, saltLen: 0) However I don't get an error if using the pss padding option. So my question/s then, why am I getting this parameter error when using MD5 and PKCS1? Is it because use of MD5 is deprecated or could there be some problem with another parameter? Any pointers would be greatly appreciated, I've been stuck trying to implement this all week.

I am working on a small PoC on iCloud Key Chain Secure Login with Verification code after going through this video. WWDC 2021 video, Secure Login with iCloud KeyChain I am using my github account credentials to generate 2 facor authentication : Otpauth url which I am using is : "apple-otpauth://totp/Github:MyGithubUserName?"+"secret=IssuerSecretKey&digits=6&period=30&issuer=github.com" Steps which I am following : Deleted 2 factor from my GitHub account on browser and deleted google authenticator app fro, iphone device. Added my GitHub credentials in device settings - password app In demo project, I have added one textfield and one button, textfield content type is .oneTimeCode and keyboard type as number pad. Added above mentioned hardcoded GitHub otpauth url on button tap which navigates to password app and generate verification code. Issue which I am facing is, Verification code is generated in device >> settings >> password section, but that verification code is not automatically get pasted in app textfield. Quickbar is not enabled for the Textfield for verification code. My UITextfield code is : securityCodeTextField.textContentType = .oneTimeCode securityCodeTextField.autocorrectionType = .no If I change textField to .userName then userName gets automatically filled in UITextfield. Kindly help me what I am missing.