CODEWITHSUNDEEP
macossecuritykeychainprivate-keypki
cnst
cnst

Reputation: 27228

Non-extractable private key in Keychain on OS X

The manual page for /usr/bin/security on OS X 10.9 indicates that there is a -x option for security import to specify that private keys are non-extractable after being imported.

How is this implemented? Are the private keys imported through such means really become completely non-extractable, or is there still a way to get a hold of them through some kind of memory dump? How do applications still use such keys for their crypto?

Upvotes: 4

Views: 2210

Answers (1)

cnst
cnst

Reputation: 27228

I'm not sure how the applications still use such keys, but as per https://reverseengineering.stackexchange.com/questions/6043/extract-non-extractable-private-key-from-os-x-keychain, it appears that this is simply implemented as a bit attribute for CSSM_KEYATTR_FLAGS keyAttributes of struct SecKeyImportExportParameters named CSSM_KEYATTR_EXTRACTABLE.

As per the above, when the import is done, this attribute is specifically omitted when the -x option is specified to security import.

According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6.

Subsequently, when trying to do a wrapped export, several places within the Security framework appear to check to make sure that this CSSM_KEYATTR_EXTRACTABLE bit is set prior to doing any kind of export, and return an error in case the attribute is not set.

Upvotes: 6

Related Questions