Hi, team. I am exploring and learning about CryptoTokenKit's capabilities. I would like to understand better what it means when the documentation says hardware tokens can be accessible through a network.
How would that work? Is there an example? Is there more documentation about it available?
What is the flow? Do we make a regular network request to fetch the keys, then create a Certificate or Password object, then store it with the regular persistence extension of CTK? So, it would be like using CryptoKit and the keychain but using hardware's security layer?
A typical workflow runs like this:
-
The container app for your CTK appex (CryptoTokenKit app extension) creates credentials (certificates and private key stubs, which together form a digital identity) for the virtual token.
-
These appear in the keychain, in a special keychain access group (
kSecAttrAccessGroupToken). -
All apps have access to that keychain access group, subject to user approval.
-
An app on the system, like Safari, looks in the keychain for appropriate digital identities. It finds the identities from step 1.
-
When it goes to use the identity — in this case, let’s imagine it tries to sign a digest — the system launches your CTK appex.
-
And passes it a signing request.
-
Your appex in then responsible for that signature operation. It can use internal resources for this, or talk to a directly connected hardware accessory, or reach across the network. It’s up to you.
-
Once it’s done, it returns the signature to the system, which returns it to the signing app.
If you want to build an app that using a token-based credential, that’s something I’ve discussed a bunch here on DevForums. See this post and this post. You can test this code with, say, a YubiKey.
If you want to build a CTK appex, reply back here and I’ll try to dig up some references.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"