markdown 使用iOS / macOS Keychain API的有用资源

Posted 2021-05-05

# Keychain API

## kSecAttrAccessible Mapping

| Protection Domain (pdmn)  | Keychain Accessibility Values                     |
| ------------------------- | ------------------------------------------------- |
| `ck`                      | `kSecAttrAccessibleAfterFirstUnlock`              |
| `cku`                     | `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`|
| `dk`                      | `kSecAttrAccessibleAlways`                        |
| `akpu`                    | `kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly` |
| `dku`                     | `kSecAttrAccessibleAlwaysThisDeviceOnly`          |
| `ak`                      | `kSecAttrAccessibleWhenUnlocked`                  |
| `aku`                     | `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`    |

Source(s): 
* [`SecItemConstants.c`](https://opensource.apple.com/source/Security/Security-55471/sec/Security/SecItemConstants.c.auto.html)
* [`SecItem.h`](https://opensource.apple.com/source/Security/Security-57740.51.3/keychain/SecItem.h.auto.html)

## Database (keychain-2.db) Structure

In the iOS keychain, all the keychain items are stored in 4 tables

| Table   | kSecClass |
| -----   | --------- |
| `genp`  | `kSecClassGenericPassword`  |
| `inet`  | `kSecClassInternetPassword` |
| `cert`  | `kSecClassCertificate`      |
| `key`   | `kSecClassKey`              |

`kSecClassIdentity` = `kSecClassCertificate` + `kSecClassKey`

Keychain tables column names mapped to the corresponding keychain item class attributes

| Column	    | Attribute	                      | Description |
| -------     | ---------                       | ----------- |
| `cdat`	    | `kSecAttrCreationDate`	        | Item creation date in Unix epoch time format
| `mdat`	    | `kSecAttrModificationDate`	    | Item modification date in Unix epoch time format
| `desc`	    | `kSecAttrDescription`	          | User visible string that describes the item
| `icmt`	    | `kSecAttrComment`	              | User editable comment for the item
| `crtr`	    | `kSecAttrCreator`	              | Application created (4 char) code
| `type`	    | `kSecAttrType`	                | Item type
| `scrp`	    | `kSecAttrScriptCode`	          | String script code (such as encoding type)
| `labl`	    | `kSecAttrLabel`                 | Label to be displayed to the user (print name)
| `alis`	    | `kSecAttrAlias`	                | Item alias
| `invi`	    | `kSecAttrIsInvisible`	          | Invisible
| `nega`	    | `kSecAttrIsNegative`	          | Invalid item
| `cusi`	    | `kSecAttrHasCustomIcon`	        | Existence of application specific icon (Boolean)
| `prot`	    | `kSecProtectedDataItemAttr`     | ?	Item’s data is protected (Boolean)
| `acct`	    | `kSecAttrAccount`	              | Account key (such as user id)
| `svce`	    | `kSecAttrService`	              | Service name (such as Application identifier)
| `gena`	    | `kSecAttrGeneric`	              | User defined attribute
| `data`	    | `kSecValueData`                 | Actual data (such as password, crypto key…)
| `agrp`	    | `kSecAttrAccessGroup`	          | Keychain access group
| `pdmn`	    | `kSecAttrAccessible`	          | Access restrictions (Data protection classes)

Source(s): 
* [InfoSec Institute: iPhone Penetration Testing Part 3](https://web.archive.org/web/20120910055555/http://resources.infosecinstitute.com/iphone-penetration-testing-3/)
* [`SecItemConstants.c`](https://opensource.apple.com/source/Security/Security-55471/sec/Security/SecItemConstants.c.auto.html)

## Apple Material
* [Keychain Services Documentation](https://developer.apple.com/documentation/security/keychain_services)
  * [Keychain Items Documentation](https://developer.apple.com/documentation/security/keychain_services/keychain_items)
* [Security and Your Apps (WWDC 2015)](https://developer.apple.com/videos/play/wwdc2015/706/) `32:30` onwards