Random delay in Keychain Sync

Question

vmvinoth OP

Created Mar ’23

Replies 3

Boosts 0

Participants 2

Hello All,

We are working on an app that involves storing sensitive data in cloud keychain.

We took two devices made a change to keychain value in one device. After some random delay the iCloud sync happens and the changes comes to the second device. We see this delay in iCloud sync to be very random. Sometimes the sync happens in less than 1 min and sometimes it takes more than 1 hour.

Is this delay in keychain sync expected. Is there any way to call synchronize() like we have for NSUbiquitousKeyValueStore to speed up the sync

Thanks Vinoth

Boost

Answer 1

DTS Engineer OP

Apple

Mar ’23

Is this delay in keychain sync expected.

Well, yes and no. In most cases keychain syncing should happen promptly but it can take an arbitrary amount of time based on network and service conditions.

Is there any way to call synchronize() like we have for NSUbiquitousKeyValueStore to speed up the sync

No.

iCloud keychain, like the iCloud key-value store, is an abstraction, and, as with all abstractions, you lose control. If you want more control — for example, you want visibility into syncing progress, or you want to implement a merge policy — you have to use lower-level abstractions.

A good option here is CloudKit but there’s nothing stoping you from going even lower. And if these lower-level abstractions don’t provide the security you need, you can use iCloud keychain to distribute a key that you then use to encrypt the data you store via the lower-level abstraction.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

vmvinoth OP

Mar ’23

If we store sensitive data in Cloudkit encrypted fields are they as secure as storing in keychain?

0

Answer 3

DTS Engineer OP

Apple

Mar ’23

I’m not really the right person to answer CloudKit questions. Two suggestions:

Read the Apple Platform Security document to see if it says anything about this.
If not, definitely file a bug about that because this is the sort of thing that doc is supposed to cover.
You can then start a new thread with the CloudKit tag to see if any CloudKit experts care to wade into this.

Oh, wait, that’s three suggestions (-:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0