The ES_EVENT_TYPE_AUTH_CREATE event can be fired either for a regular file or for a directory. Currently there is no such kind of information in the event structure. Is there any way to find out what exactly the kind of the object is being created right in the ES_EVENT_TYPE_AUTH_CREATE handler? Thanks in advance, Aleksandr Skobelev

Hello, We are attempting to use the SecTrust APIs to extract the public key from a certificate and evaluate a certificate chain. However, we are running into an issue where this is failing due to a "weak key size". For example, once we have created a SecTrust object for our certificate and attempt to extract the public key using SecTrustCopyKey we get this error in the console: [seckey] SecKeyCreate init(ECPublicKey) failed: -26275 Additionally when we attempt to run SecTrustEvaluateWithError we get: Optional<CFDictionaryRef>  ▿ some : 3 elements   ▿ 0 : 2 elements    - key : TrustResultDetails    ▿ value : 1 element     ▿ 0 : 2 elements      ▿ 0 : 2 elements       - key : WeakKeySize       - value : 0      ▿ 1 : 2 elements       - key : MissingIntermediate       - value : 0   ▿ 1 : 2 elements    - key : TrustResultValue    - value : 6   ▿ 2 : 2 elements    - key : TrustEvaluationDate    - value : 2021-12-06 23:10:09 +0000 For reference the certificate we are using has the following attributes: Signature algorithm: sha384ECDSA Public key: ECC (384 bits) We have done some research and found this notice regarding key sizes here: https://support.apple.com/en-au/HT210176 However as far we can tell that should only apply to RSA keys and not ECC. We're also not using these certificates for TLS connections. We have done some further testing using OpenSSL and didn't run into any issues using these certificates, so we suspect this issue is specific to Apple's APIs. Any advice would be appreciated. Thanks!

My app got rejected as bluetooth usage description not given in info.plist. We are not using any bluetooth feature inside the application. We have one third party SDK integrated in main app which will trigger the bluetooth api based on some configuration. We have not enabled sdk configuration which will trigger the bluetooth api. Is it required to provide bluetooth usage description in info.plist even though main app does not use this feature. Is there any other way by which apple will approve the app without giving this description.

IMPORTANT This post is now retired in favour of TN3137 On Mac keychain APIs and implementations. I’m leaving the original post here just for the record, but you should consider the official documentation authoritative. Greetings All I regularly talk to folks who are confused by keychains on the Mac. This is understandable as the Mac has three keychain APIs and two keychain implementations! This post is my attempt to describe how those fit together. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com" On Mac Keychains macOS has three keychain APIs: Keychain (<KeychainCore.h>) — This originated on traditional Mac OS but was supported on Mac OS X (now macOS) as a compatibility measure. SecKeychain (<Security/SecKeychain.h>, <Security/SecKeychainItem.h>, <Security/SecKeychainSearch.h>) — This was introduced with Mac OS X [1] and was the standard macOS keychain API until recently. SecItem (<Security/SecItem.h>) — This was part of the original iOS SDK. It debuted on the Mac with macOS 10.6. The first API is now irrelevant. macOS has two keychain implementations: The file-based keychain The data protection keychain The file-based keychain has its origins on traditional Mac OS. The data protection keychain originated on iOS and came to macOS with the advent of iCloud Keychain on macOS 10.9. Note iOS and its child platforms only support the SecItem API with the data protection keychain implementation. The Keychain and SecKeychain APIs only talk to the file-based keychain. The SecItem API talks to either implementation. Specifically, it talks to the data protection keychain if you supply either the kSecUseDataProtectionKeychain or the kSecAttrSynchronizable attribute. If not, it talks to the file-based keychain. The file-based keychain is on the road to deprecation. It is not officially deprecated, but some of the APIs surrounding it are. For example, SecKeychainCreate was deprecated in macOS 12. Moreover, new features, like iCloud Keychain, are only supported by the data protection keychain. [1] Actually, I’m not 100% sure it was part of 10.0. The earliest macOS SDK that I have easy access to is the macOS 10.2 SDK, circa 2002, and it definitely has this API. API Differences The SecItem API is well aligned with the data protection keychain. When you use it to talk to the file-based keychain the API has to work through a shim. That shim has limitations. Some of those limitations are inherent to the keychain implementation. For example, the access control model of the file-based keychain is very different from that of the data protection keychain, and the shim can’t make up for that. However, some limitations are just bugs. If you’re porting iOS keychain code to the Mac, it’s best to target the data protection keychain. Mac Catalyst apps only have access to the data protection keychain. iOS Apps on Mac only have access to the data protection keychain. Implementation Differences Each keychain implementation uses its own access control model: The file-based keychain uses access control lists (SecAccess). The data protection keychain uses keychain access control groups, supplemented by an access control object (SecAccessControl). The keychain access control groups available to you in the data protection keychain are determined by code signing entitlements. See Sharing Access to Keychain Items Among a Collection of Apps. This means that the data protection keychain is only available to code that can carry an entitlement, that is, main executables like an app or an app extension. If you’re building library code then your data protection keychain access is determined by the app that loads your library. The data protection keychain is only available in a user login context. You cannot use it, for example, from a launchd daemon. The data protection keychain can hold all keychain item classes (Internet password, generic password, certificate, key). Only the password items are synchronised via iCloud Keychain. Modern keychain features are only supported by the data protection keychain, including: iCloud Keychain Protecting an item with biometrics (Touch ID and Face ID) Protecting a key with the Secure Enclave User Interface The Keychain Access application lets you manage both file-based keychains and the data protection keychain. The keychain list includes at least two file-based keychainS (login and System) and the data protection keychain (iCloud Keychain, if that’s enabled, otherwise Local Items). You can create, add, and remove keychains using commands on the File menu (New Keychain, Add Keychain, Delete Keychain). Keychain Access displays all keychain items in file-based keychains but only password items in the data protection keychain. The keychain support in the security command-line tool is primarily focused on the file-base keychain.

Currently, we are exploring ways to disable the "Save Password" prompt on Keychain. We want to manipulate the keychain access from our Password Autofill Extension using any kind of API or access to know the following: Know if Keychain is currently enabled. Retrieve passwords from Keychain. Edit passwords from Keychain Delete passwords from Keychain. Do any of this steps is possible?

If our app doesn't allow in-app account creation, as such we won't be required to offer in app account deletion. Do we have to publish that we don't allow account creation? Is there a button to check to declare that we don't allow account creation in our app?

My Safari Extension on iOS needs access to a Keychain item (password) that is secured by the userPresence and devicePasscode flag. In other words, FaceID/TouchID or the device PIN is necessary to access the password. Is there a way for the extension to access the password? SafariWebExtensionHandler.swift has access to the Keychain, but can't present FaceID/TouchID/device PIN interface to the user. Popup.js has UI access, but can't access the iOS Keychain. One hack is to set touchIDAuthenticationAllowableReuseDuration of the Keychain item to an arbitrary time and have the user authenticate in the containing app. However, in case of a time-out, the containing app has be opened by the extension with a custom URL scheme. openURL is not accessible in SafariWebExtensionHandler.swift either (I assume it can be handled by popup.js). This is a user-unfriendly solution. What is the best way to give the Safari extension access to a Keychain item?

Curious if anyone has any insight into the caching behavior or Smart Card PINs, and if there are options available to set to always prompt for PIN. Example of the current challenge is that users can authenticate to an application using their smart card and entering their PIN, however it appears the PIN is cached until the user logs out of their laptop or restarts. Any insight into modifying this behavior or suggested solutions is greatly appreciated. Thank you. CD

Hi there TL;DR : I have a Data object which contains data that is already hashed. I need a Digest object, how should I proceed ? I am developing an OSX Smart Card Token Extension to handle certificates linked to private keys in the Secure Enclave (using CryptoKit). So far my first tests are pretty successful as my extension already answered to various signature requests successfully... until now. So far I was receiving signature requests for ecdsaSignatureMessageX962SHA256 algorithm. All I had to do with was something like this: func tokenSession(_ session: TKTokenSession, sign dataToSign: Data, keyObjectID: Any, algorithm: TKTokenKeyAlgorithm) throws -> Data { if let privateKey = try? SecureEnclave.P256.Signing.PrivateKey.init(dataRepresentation: keyObjectID as! Data) {       let rawsignature = try? privateKey.signature(for: dataToSign)       return rawsignature!.derRepresentation     } } Now I receive requests for ecdsaSignatureDigestX962SHA256 signatures. I noticed that there is a public func signature<D>(for digest: D) throws -> P256.Signing.ECDSASignature where D : Digest function that can be called but in the tokenSession i am only given Data... Looking at SHA256Digest documentation I can't find anything to create the digest from bytes. It seems that it can only be the result of a SHA256.hash operation. I thought of using older API like SecKeyCreateSignature but I don't think I can retrieve a SecKey from a private key generated with CryptoKit SecureEnclave.P256.Signing.PrivateKey.init I feel like I may be missing something really simple...

I've been researching a new strain of MacOS malware for about a year and am trying to zero in on changes that are made to the OS as well as capturing files that the malware is self-deleting. I was wondering if there is a way to modify GC behaviors and: a. Modify/prevent cache deletion b. Modifying the Recycle Bin/GC to save a copy of every file marked for deletion to a separate folder c. Hiding the real Recycle Bin similar to the method of creating a chroot jail? I understand that modifying these behaviors can have negative affects on the overall performance but I will only need to use the mentioned adjustments for a limited period of time that will probably not exceed 24 hours. Curious if even that short of a time span would cause unintended consequences or if there are any other methods for accomplishing the aforementioned tactics.

Under CryptoTokenKit framework in macOS Big Sur which command I should use to make a smartcard "Persistent Token" always available? I tried the following command but I am getting connection interrupted error sudo -u _securityagent pluginkit -a /Applications/SmartCardApp.app/Contents/PlugIns/CssToken.appex If there other way to do it?

I tried to run the following command: sudo -u _securityagent pluginkit -a /Applications/SmartCardApp.app/Contents/PlugIns/CssToken.appex But I am getting connection interrupted error. Do you know what that error means and how I can run that command successfully?

I add Webauthn authentication for the website. Faced the fact that TouchId on MacOS does not work cross-browser. If the authenticator was registered in Chrome, then I can only log in to Chrome. When I try to log in with TouchId in Safari, I get an error (found no credentials on this device). Conversely, if the authenticator is registered in Safari, then I can only log in to Safari, but I get an error in Chrome. To register the authenticator, I call navigator.credential.create (), with the parameters: { "rp": { "name": "localhost", "id": "localhost" }, "user": { "id": Unit8Array, "name": "alex", "displayName": "alex" }, "attestation": "none", "pubKeyCredParams": [ { "type": "public-key", "alg": -7 } ], "timeout": 60000, "authenticatorSelection": { "userVerification": "preferred", "requireResidentKey": false, "authenticatorAttachment": "platform" }, "challenge": Unit8Array, "excludeCredentials": [ { "type": "public-key", "id": Unit8Array } ], "status": "ok", "errorMessage": "" }

Hello all I am currently working on a app, which have to access the keychain during the Bluetooth Connection setup to load a public key, which will be exchanged later. What I observed is that I get the OSError -25308 if I try to access the data, even if I have the Keychain Access set to kSecAttrAccessibleAfterFirstUnlock This actually happens on my iPhone 8 with iOS 15.1 I enabled already background processing, background scanning and connection for the app. But yeah without any success. I am not sure if this is a bug on iOS at all. The problem happens if the app will be put to background from the OS.

Hi, I have an existing Mac app and when I build and install via the new Mac TestFlight, the user is prompted to enter in their system password in order for the app to have access to it's own keychain items. If I export the very same archive using a Developer ID or using the Developer option, it doesn't require the user to re-enter their password. Is it possible that there's something wrong with the way TestFlight signs the app or am I doing something wrong? I've looked at the DR for each of the builds and they are all different in some way so not sure what that tells me. For example, the DRs for each are: /existing Mac App Store designated => (anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists / or anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = ZL5FFY3M32) and identifier "X.X.X" /TestFlight build designated => anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.25.1] /* exists */ and identifier "X.X.X" /Developer ID designated => anchor apple generic and identifier "X.X.X" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists / or certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = ZL5FFY3M32) X.X.X is the correct and same bundle ID of my app. Clearly the TestFlight DR is "more" different but not sure what is the problem and how I would fix it. Any help would be greatly appreciated and Merry Christmas! //Ray

The new account deletion requirements stated in the app review guidelines (5.1.1(v)) state that: If your app supports account creation, you must also offer account deletion within the app. But what about if the account is owned by a different entity than the user itself, such as for someone using a work account that is owned by their employer? Are we still obligated to offer the employee a way to delete their account within the app?

Several times over the last week, I've noticed a green dot when unlocking my phone. It goes away shortly after the unlock completes. I understand this means an app is using my camera while the device is locked. I've enabled app activity recording and inspected the logs following these instructions: https://developer.apple.com/documentation/network/privacy_management/inspecting_app_activity_data Upon inspection, I'd expect to see an entry with "type": "access" somewhere but there are none. Everything recorded has the type networkAccess only. Why am I seeing the green dot without any related access logs?

Hi, I created a connected app on Salesforce, which basically opens Salesforce to the outside world. Then I performed an Apple Social Login to Salesforce, using my Apple ID account. When doing so, I used the "Hide My Email" feature. The Apple authentication succeeded. On the appleid.apple.com website, in the "Sign-In and Security > Sign in with Apple" section, the Salesforce connected app appears. So far, so good. When I click on this app, under the "Hide My Email" section, I can see an address in form of xyz[at]privaterelay.appleid.com. On every forum or blog I visited, I read that the redirection from this alias email to the email associated to my Apple ID is activated by default. Here comes my issue. I tried to send emails to this alias from various email boxes, and never received any of them (of course I checked into the junked/spam folders as well). Is there something that I'm missing here? Any help would be much more appreciated. Thank you

Has anyone found a solution to this problem, knows what is the matter? Grigoriy1960

Hello everyone, I want to submit my app, however I am stuck. Indeed, I have an issue with the App Privacy Policy URL: I do not know how to draft this. Would you have examples or links I could use (which are not Apple provided links) ? Thanks !