Copy client identity to private keychain on Mac OS - objective-c

Question

Background
I'm working on big mutiplatform library where client identity is used. Requirement is that application maintains client identity privately and it is possible to import client identity from system store (in case of Mac OS default keychain).
So basically API has to cover following
set client identity from default keychain
set client identity form file (system keychian should not see it)
delete client identity (this should not break other applications)
if identity will be deleted from default keychain (using Keychain Access for example) my application should not be impacted
Basic problem
Initially I planed store identity in some private encrypted file, but it turn out that Apple API doesn't allow to import client identity without presence of a keychain.
So I've decided that my library will maintain private keychain. In case of importing identity form file it is quite simple and it does work:
NSDictionary *options =
#{
(id)kSecImportExportPassphrase:password.stringValue,
(id)kSecImportExportKeychain:(__bridge id)keychain,
};
CFArrayRef arrayResult = NULL;
OSStatus status = SecPKCS12Import((CFDataRef)pkcs12,
(CFDictionaryRef)options,
&arrayResult);
if (status != errSecSuccess)
Now problem is how to copy client identity form default keychian to private keychain?
Here is a code I used to create a keychain:
- (void)setupOpenMyKeychain
{
NSString *keychainPath = [self keychainPath];
NSString *pass = #"dasndiaisdfs"; // used only for testing
OSStatus status = SecKeychainCreate(keychainPath.UTF8String,
(UInt32)strlen(pass.UTF8String),
pass.UTF8String,
NO,
NULL,
&keychain);
if (status == errSecDuplicateKeychain)
{
status = SecKeychainOpen(keychainPath.UTF8String, &keychain);
if (status == errSecSuccess)
{
status = SecKeychainUnlock(keychain,
(UInt32)strlen(pass.UTF8String),
pass.UTF8String,
TRUE);
if (status != errSecSuccess)
{
[self showOSStatusFailureAlert: status forAction: #"Unlock failure"];
}
}
}
if (status != errSecSuccess)
{
[self showOSStatusFailureAlert: status forAction: #"Open/Create failure"];
}
}
Now I have SecIdentityRef and SecCertificate (in CFArrayRef) in a default keychain and I want to copy it to my custom keychian:
- (NSData *)persistantRefFor: (id)item
{
CFTypeRef result = NULL;
NSDictionary *dic =
#{
(id)kSecValueRef:(id)item,
(id)kSecReturnPersistentRef:(id)kCFBooleanTrue,
//(id)kSecUseKeychain:(__bridge id)keychain,
};
OSStatus status = SecItemCopyMatching((CFDictionaryRef)dic,
&result);
if (status != errSecSuccess)
{
[self showOSStatusFailureAlert: status
forAction: #"Failed to find reference"];
return nil;
}
return (__bridge_transfer NSData *)result;
}
-(OSStatus)copyItemWithPersistantRef:(NSData *)persistantReference
{
SecKeychainItemRef item = NULL;
OSStatus result = SecKeychainItemCopyFromPersistentReference((__bridge CFDataRef)persistantReference, &item);
if (result != errSecSuccess)
{
[self showOSStatusFailureAlert: result forAction: #"Get item from reference"];
return result;
}
CFAutorelease(item);
SecKeychainRef soruceKeychain = NULL;
result = SecKeychainItemCopyKeychain(item, &soruceKeychain);
if (result == errSecSuccess)
{
if (soruceKeychain == keychain)
{
CFRelease(soruceKeychain);
// item is already in desired keychain
return result;
}
} else {
[self showOSStatusFailureAlert: result forAction: #"Fetching source keychain"];
return result;
}
SecAccessRef access = NULL;
result = SecKeychainCopyAccess(keychain, &access);
if (result != errSecSuccess)
{
[self showOSStatusFailureAlert: result forAction: #"Get Access object"];
// return result;
} else {
CFAutorelease(access);
}
SecKeychainItemRef itemCopy = NULL;
result = SecKeychainItemCreateCopy(item, keychain, access, &itemCopy);
if (result != errSecSuccess)
{
[self showOSStatusFailureAlert: result forAction: #"Create copy in private keychain"];
return result;
}
CFAutorelease(itemCopy);
NSLog(#"Copied item %#", itemCopy);
NSData *copyPersistantRef = [self persistantRefFor: (__bridge id)itemCopy];
NSLog(#"Old persisntatn reference %#\n"
"New persisntatn reference %#\n"
"%#", persistantReference, copyPersistantRef,
[persistantReference isEqualToData: copyPersistantRef]?#"SAME":#"DIFFRENT");
return result;
}
- (IBAction)copyIdentityToPrivateKeychain:(id)sender
{
if (!identity)
{
return;
}
NSData *perRef = [self persistantRefFor: (__bridge id)identity];
OSStatus status = [self copyItemWithPersistantRef: perRef];
if (status != errSecSuccess)
{
[self showOSStatusFailureAlert: status forAction: #"Copy Identity has failed"];
}
}
When trying to copy SecCertificateRef to my private keychain. Following things happen:
SecKeychainCopyAccess fails with "Error: 0xFFFFFFFC -4 Function or operation not implemented." - code continues execution since apparently NULL value is fine when reaching SecKeychainItemCreateCopy (documentation sugest that is should work).
SecKeychainItemCreateCopy passes Ok
NSData *copyPersistantRef = [self persistantRefFor: (__bridge id)itemCopy]; fails. I'm unable to get persistent reference to copied item. Without this reference I'm unable to load proper certificate when application starts
It is worse when trying to copy SecIdentityRef,
code fails on SecKeychainItemCopyKeychain with Error: 0xFFFF9D28 -25304 The specified item is no longer valid. It may have been deleted from the keychain.
when I forced to skip this error to reach SecKeychainItemCreateCopy it is failing with same error: Error: 0xFFFF9D28 -25304 The specified item is no longer valid. It may have been deleted from the keychain.
So bottom line according to documentation it suppose to work, but it doesn't work. Probably I'm doing something incorrectly, but I'm unable to find what is the problem.
Any feedback will be appreciated.
Same question I've posted on Apple forum.
Need to support OS X 10.10.
Here is a small test application I'm using for quick testing.

Answer 1

Instead of SecPKCS12Import, use SecItemImport. Pass kSecFormatPKCS12 as inputFormat, kSecItemTypeAggregate as itemType (to require identities or to kSecItemTypeUnknown and it will try to detect the type for you) and set importKeychain to NULL, which prevents import to keychain.