SecKeyCreateRandomKey not honouring "permanent" attribute

Note: this has only begun to manifest with Xcode 11 GM (Seed 1 + 2) - it has not certainly not been a problem any of the later betas.

App and tests continue to succeed as expected on physical iOS 13 GM devices and on older simulators (12.2) through Xcode11. Problem seems to be localized to the iOS 13 simulators.


`SecKeyCreateRandomKey` returns the key, without error but the Key is not stored as expected.


Console immediately outputs the following:


default item 14:03:11.835391+1000 com.apple.securityd insert failed for item <keys,rowid=null,cdat=2019-09-17 04:03:11 +0000,mdat=2019-09-17 04:03:11 +0000,kcls=1,labl=null,alis=null,perm=1,priv=1,modi=1,klbl=71BBCB041C9C39754ADACF6A79F8440AB96A866C,atag=636F6D2E61746C61737369616E2E6D6F62696C656B69742E73656375726974792E44656661756C744B6579416C696173,crtr=0,type=73,bsiz=256,esiz=256,sdat=2001-01-01 00:00:00 +0000,edat=2001-01-01 00:00:00 +0000,sens=0,asen=0,extr=1,next=0,encr=0,decr=1,drve=1,sign=1,vrfy=0,snrc=0,vyrc=0,wrap=0,unwp=1,agrp=AAAAAAA.com.foo.bar,pdmn=dku,sync=0,tomb=0,sha1=947C7C477EE39951793FCF497D5E585A5D497363,vwht=null,tkid=null,v_Data=<?>,v_pk=B32B2325BBB584B0D1D3BA8D8EAA54465DB2FCCC,accc=3137300B0C0470726F740C03646B7530280C0A6B414B534B657941636C311A30180C136B414B534B65794F7044656661756C7441636C010101,u_Tomb=null,musr=,UUID=02207EB8-1A49-4FAB-9D2D-264C67FFC5FB,sysb=null,pcss=null,pcsk=null,pcsi=null,persistref=> with Error Domain=NSOSStatusErrorDomain Code=-25330 "(null)" UserInfo={-25330=(({length = 57, bytes = 0x313 securityddefault SecWarning 14:03:11.835606+1000 com.apple.securityd


and


Authentication is needed AppNameButTruncated[16208]/1#9 LF=0 add Error Domain=NSOSStatusErrorDomain Code=-25330 "(null)" UserInfo={-25330=(({length = 57, bytes = 0x3137300b 0c047072 6f740c03 646b7530 ... 6c744163 6c010101 },""))} securityd


Key is not returned in subsequent get querires.


As a workaround, If I manually store the key, immediately after creation, using `SecItemAdd` it's behaves as expected.


It'd be great to get some guidance on this, thanks

Replies

App and tests continue to succeed as expected on physical iOS 13 GM devices … Problem seems to be localized to the iOS 13 simulators.

You should definitely file a bug about this. Getting the Security framework to run in the simulator is a tricky business — this is especially true for the keychain, where the simulator is missing the hardware features that guarantee security on a real device — and sometimes the ducks don’t quite line up correctly.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thanks Eskimo.
Bug: FB7293797
I'll continue to check with subsequent Xcode and SDK releases.

Hi,


For information, we experience the exact same issue in our code. It works on iOS 12.x, but fails on iOS 13.1 with the simulator.

Filed FB7380780


Is there any good workaround? Is it safe to use SecItemAdd on older iOS versions, or does it have unexpected consequences?


Cheers

fails on iOS 13.1 with the simulator. Filed FB7380780

Thanks for that. Thanks also to marc-2 for their work on FB7293797.

Is it safe to use

SecItemAdd
on older iOS versions … ?

I expect it’d be fine. However, my recommendation is that you only apply this workaround on the simulator.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

"However, my recommendation is that you only apply this workaround on the simulator."

Agreed, this is the approach I've taken - iOS 13.x simulator only.