Questions tagged [keychain]

For security questions about Apple's Keychain Access app and the keychain file format on macOS and iOS

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Storing APFS password in Apple's Keychain for Time Machine

If you are using an encrypted APFS container, for example, to encrypt the Time Machine, whenever the physical disk is plugged in, MacOS asks for a decryption password with an option to store it ("...
Alexander K.'s user avatar
2 votes
0 answers
132 views

Storing encrypted data in iOS keychain

In my Unity app in C# I am using a 3rd party script which allows me store and retrieve data using iOS keychain. The stored data is a private user generated key which is used to encrypt data before ...
Ando's user avatar
  • 133
3 votes
1 answer
1k views

How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?

I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
Pathong's user avatar
  • 56
1 vote
0 answers
106 views

Password generation algorithm used by MacOS keychain

What algorithm does MacOS use in its keychain system to generate passwords? (using password assistant accessed through keychain app and using Safari keychain). Does it access/is it the GUI for the /...
gamma_ray's user avatar
5 votes
1 answer
506 views

Do passkeys on iCloud Keychain ever exist unencrypted outside the secure enclave?

Regarding Apple's beta feature of storing WebAuthn passkeys in the iCloud Keychain, does anybody know if the unencrypted passkeys ever leave the secure enclave, and get stored in RAM or anything? With ...
Mohamed Hafez's user avatar
0 votes
0 answers
932 views

Storing a private key in android/ios keychain encrypted or not

In my app, the user must use a private key to sign a transaction (on a blockchain). (It is quite common) I am facing questions regarding how to store my user's private key on the device. I am to use a ...
Raphael St's user avatar
1 vote
0 answers
209 views

Storing cleartext password in iOS keychain

I'm having a webservice which I'm using for my app. The webservice is using cookies when authenticated. I want to give my users the option to login via TouchID for faster login. Therefore I'm storing ...
Deserializer19's user avatar
1 vote
0 answers
492 views

Export IOS Certificates and Configuration Profiles

Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
AppleTechy's user avatar
2 votes
0 answers
573 views

iOS secure enclave and jailbreak

If an iOS device is jailbroken, I understand an attacker cannot extricate key material from the secure enclave. But would they be able to use keys using CryptoKit within the enclave to encrypt a ...
Ranjit Murali's user avatar
4 votes
1 answer
2k views

Why is GPG-agent still caching my passphrase?

I can not get gpg to prompt me for my passphrase when I want to decrypt a file. I tried including: default-cache-ttl 0 max-cache-ttl 0 (also flipped the bit to 1) within ~/.gnupg/gpg-agent.conf ...
Chris's user avatar
  • 171
7 votes
2 answers
973 views

Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?

Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server? Sign up The client provides an email and password and saves the clear password on ...
Ignasi's user avatar
  • 123
2 votes
2 answers
637 views

What format is an decrypted RSA private key in, specifically in OS X Keychain?

I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, ...
Vegetto's user avatar
  • 23
2 votes
1 answer
251 views

Why does not updating a MacOS keychain password cause applications to become troublesome? [closed]

I've changed my Macbook computer's password in using recovery mode. I'd changed it once normally, then it suddenly "stopped working" (or I started "mis-remembering" it after using it a few times, ...
uhoh's user avatar
  • 1,415
0 votes
1 answer
633 views

Creating self-signed root CA using MacOS Keychain

I'd like to use MacOS keychain to create a basic Root CA, which will be able to sign CSRs and/or Intermediate CA which will be able to do that. For knowledge purpose, I'd like to create a Root, and ...
Max13's user avatar
  • 195
0 votes
1 answer
407 views

Stolen Google OAuth refresh token

I had authorized Google account on my Mac computer. I think my keychain is stolen and google oauth refresh token was stored in it. I removed the OS X app from my Google account. Is the old OAuth ...
user avatar
5 votes
2 answers
1k views

Entropy on native memorable password on macosX keychain

I have been trying to find information on this. But I haven't found anything online. When you use the password manager on mac, it can provide "memorable" passwords. For example pick3"enigma. (You ...
Alex Recuenco's user avatar
0 votes
0 answers
239 views

MacOS keychain encryption

There has been big media coverage that an application can just go and read the keychain without needing the master password, root access or anything. It just needs to be executed. But one thing I ...
My1's user avatar
  • 394
1 vote
1 answer
625 views

what does "no value specified" default to in keychain on osx?

In the osx keychain I was browsing certificates that my school forces me to trust and came upon an intermediate certificate authority that was signed by an untrusted user, I believe that would be me ...
Mohammad Ali's user avatar
1 vote
0 answers
559 views

Is access token saved in Cache.db-wal bad for iOS app?

tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
karfi's user avatar
  • 11
1 vote
2 answers
1k views

Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?

I am trying to test the following setup: A RADIUS server works with the EAP-TLS protocol. The client and the server have the following certificates: Client Public Key: ...
Jannis Kappertz's user avatar
3 votes
2 answers
7k views

Can OpenSSL verify a public key - intermediate CA certificate chain with a Root CA certificate?

I tried to run the following shell command: openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem where publickey_imcert_chain.cert is a chain of: servercert.pem (public key signed by ...
Jannis Kappertz's user avatar
0 votes
1 answer
592 views

Is it safe to use an encryption library (e.g., RNCryptor) instead of Keychain to store a user account password for an iOS app?

I've been told that iOS Keychain has a bug where it sometimes returns null values. The dev who encountered this issue suggested rolling out our own password storage solution instead of using Keychain, ...
Daniel's user avatar
  • 223
0 votes
2 answers
606 views

Is a password in keychain more secure than storing password in plaintext?

Many email programs such as isync and msmtp provide the facility of specifying a command that once executed prints the user's password to stdout. For example on OSX we can store the password in a ...
Pushpendre's user avatar
4 votes
1 answer
641 views

Using a gmail oath2 token to access web email

I forgot my password to an old gmail account. I have tried the regular route of going through gmail password recovery: answering questions, it keeps looping back to the questions, so I think I'm ...
alexibbb's user avatar
1 vote
1 answer
189 views

Know LastPass fishing apps? Ways to protect?

I am a LastPass user, which I use with the browser extensions. Lately it occurred to me that it should not be too hard to create a fishing browser extension that would replace LastPass upon install,...
LastPassUser's user avatar
6 votes
1 answer
1k views

Keychain-dumper and Secure Enclave

Is it possible to use keychain-dumper to extract private keys that are protected by the secure enclave? Keychain-dumper works with "/private/var/Keychains/keychain-2.db". If a private key is ...
user1118764's user avatar
12 votes
1 answer
2k views

Secure Enclave and keychain security

I've read the WWDC 2015 article from Apple, which says that: We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around ...
Summer's user avatar
  • 221
8 votes
1 answer
10k views

Keychain vs KeyStore vs TrustStore

I'm quite confused between the three, and a Google search didn't come up with much. Can someone please explain?
user1118764's user avatar
3 votes
3 answers
3k views

Hardware-backed Keychain for iOS and Android

I'm researching on hardware-backed keychain for iOS and Android, in order to store some certificates in hardware rather than software. According to Android docs (https://source.android.com/security/...
user1118764's user avatar
2 votes
0 answers
7k views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE CERT ...
zabumba's user avatar
  • 161
3 votes
1 answer
720 views

Storage of account password on keychain iOS to enable TouchID login

Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice? The ...
watdo's user avatar
  • 131
3 votes
0 answers
519 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
rideintothesun's user avatar
1 vote
1 answer
1k views

How to determine effective trust chain for cert on MacOS X?

I'm seeing some curious issues with cert verification for an Issuer: Entrust - L1K cert that was issued and is in use (per inspection of the cert in Chrome and Firefox) for an internal site here. I ...
Scott's user avatar
  • 165
2 votes
0 answers
154 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
makerofthings7's user avatar
5 votes
1 answer
485 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
Zakaria XPI's user avatar
2 votes
1 answer
285 views

Apple's Keychain - good security?

This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." ...
user avatar
4 votes
1 answer
757 views

KeyChain Access and GPG Keychain - should those be running simultaneously?

I have installed GPG Suite and found out also during this time that my OS X has some KeyChain Access app that stores all my passwords under my screenlock password - total news to me. Can I get rid of ...
user avatar
4 votes
0 answers
2k views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
int 2Eh's user avatar
  • 153
1 vote
1 answer
406 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to encrypt/...
Nikolay Derkach's user avatar
0 votes
1 answer
256 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
cnst's user avatar
  • 1,964
14 votes
3 answers
11k views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
cnst's user avatar
  • 1,964
1 vote
1 answer
515 views

Can any malware access the OSX keychain data

I'm working on a security project. I have sensitive data that I would like to store in OS X's keychain. I'm able to add the data programmatically into the OS X keychain by using RHKeychain. But after ...
VSN's user avatar
  • 111
7 votes
4 answers
3k views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
Bharath's user avatar
  • 79
0 votes
3 answers
2k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
Darren's user avatar
  • 135
3 votes
1 answer
967 views

How is the iOS KeyChain master key derived?

I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect. On iOS there is no user account password, only a ...
Matt's user avatar
  • 225
9 votes
4 answers
1k views

How secure is OS X's Keychain access control?

On OS X, when an application requests access to a Keychain item, the user is prompted whether to grant or deny that access. Supposedly, the system saves not only the binary path, but also its hash in ...
lxgr's user avatar
  • 4,243