Re: iOS 10 crypto not working on simulator

-34018 is errSecMissingEntitlement, indicating an entitlements problem.  However, the simulator doesn’t support entitlements, so this is clearly a bug and I’ve filed it as such (r. 28297379).

ps Here’s the code I was testing with.

func SecKeyGeneratePair(_ parameters: [String:AnyObject]) throws -> (publicKey: SecKey, privateKey: SecKey) {
    var publicKey: SecKey? = nil
    var privateKey: SecKey? = nil
    let err = Security.SecKeyGeneratePair(parameters as CFDictionary, &publicKey, &privateKey)
    guard err == errSecSuccess else {
        print(err)
        throw NSError(domain: NSOSStatusErrorDomain, code: Int(err), userInfo: nil)
    }
    return (publicKey!, privateKey!)
}

let keyID = UUID().uuidString
let keyPair = try? SecKeyGeneratePair([
    kSecAttrKeyType as String:      kSecAttrKeyTypeRSA,
    kSecAttrKeySizeInBits as String: 2048 as NSNumber,
    kSecAttrIsPermanent as String:  true as NSNumber,
    kSecAttrLabel as String:        keyID as NSString
])
print(keyPair)

Built with Xcode 8, it works on the iOS 9 simulator but fails on the iOS 10 simulator.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"

For those still struggling with this, particularly those who have required adding keychain sharing to workaround, here is what has been working for me.

The issue seems to be that there must be at least one entitlement in order for Xcode to properly add the "application-identifier" enttilement to the built application.  This is why keychain sharing seems to be a solution but it is only indirectly so:  any other entitlement seems to work fine.

Take a vanilla application and do a build.  During the "Process Product Packaging" build step it will not show any entitlements.  Any attempt to use the keychain in the simulator with that application will fail with the -34018 error.

You could add keychain sharing to work around this, as this adds an entitlement, and the final application will contain the keychain-access-group and the application-identifier entitelments.  If you do not want to enable keychain sharing you can simply add another entitlement.

For example, I created an entitlements.plist and configured by project to use it for CODE_SIGN_ENTITLEMENTS for a simulator build.  This enttilements plist simply adds the get-task-allow (allow a debugger to be attached)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-/
<plist version="1.0">
    <dict>
        <key>get-task-allow</key>
        <true/>
    </dict>
</plist>

By adding this entitlement, which is a bit unnecessary for a simulator build, the keychain access will work correctly.  During the "Process Product Packaging" step you will see output that contains the get-task-allow and application-identifier entitlements now.  Abbreviated output from this step show below..

...

Entitlements:
{
    "application-identifier" = "AAABBBCCDDD.com.company.MyBundleID";
    "get-task-allow" = 1;
}

...

You can now successfully run your application in the simualtor and you did not have to configure any unwanted entitlements such as keychain sharing.

This strikes me as a bug in Xcode 8 whereby it should always be adding the application-identifier entitlement for simulator builds.