7
votes
Accepted
Entropy on native memorable password on macosX keychain
Anders Bergh reverse-engineered the OS X Password Assistant and wrote a command-line utility which does the same job. From its source you can find out that all of the password generation is done by a ...
- 3,486
6
votes
Export non-extractable private key from Keychain on OS X
I was able to extract non-extractable private key from macOS High Sierra 10.13.6 using this tool chainbreaker. It requires Python2 with hexdump and pycrypto packages. This README file in the tool's ...
- 161
4
votes
Secure Enclave and keychain security
This depends. If you are using the keychain to store a key which you can retrieve then the security level is not the same. You still have to move that key into memory to use it - all the secure ...
- 11k
4
votes
Accepted
Keychain vs KeyStore vs TrustStore
Look to:
Truststore vs. Keystore - Trust store contains the public parts from others and the keystore contains the personal certificate (and key).
Keychain - the Apple password manager.
[edit]
Now ...
- 617
4
votes
Creating self-signed root CA using MacOS Keychain
It seems to be valid to me. Windows does not complain about the leaf certificate if I install the CA. XCA also confirms the leaf as trusted.
Are you using browser that uses its own list of trusted ...
- 7,858
3
votes
Accepted
Why does not updating a MacOS keychain password cause applications to become troublesome?
Well, the Keychain on macOS is the place for applications to store sensitive data such as credentials, certificates and the like. For instance, Keychain stores the passwords for all wireless networks ...
- 146
3
votes
Why is GPG-agent still caching my passphrase?
Solved the issue.
TL:DR GPG Suite was saving the password in macOS Keychain (not GPG Keychain)
More information here.
- 171
3
votes
Entropy on native memorable password on macosX keychain
Estimating entropy with zxcvbn
One reasonable way to estimate an upper bound on the entropy of a password whose generation method you don't know is to feed it to the zxcvbn password strength meter, ...
- 10.8k
3
votes
Can OpenSSL verify a public key - intermediate CA certificate chain with a Root CA certificate?
First, the syntax is wrong. It should be:
openssl verify -CAfile rootcert.pem publickey_imcert_chain.pem
CAfile is rootcert.pem...
Next that's definitely not the way openssl verify works. You must ...
- 26.8k
3
votes
Accepted
Is it safe to use an encryption library (e.g., RNCryptor) instead of Keychain to store a user account password for an iOS app?
Rule number one with crypto systems is don't re-invent the wheel. Yes, you could implement a secure password store with RNCryptor, but you would need an expert to audit your code to make sure the ...
- 3,322
2
votes
Hardware-backed Keychain for iOS and Android
Note that the answer from HashHazard is outdated; in the meantime Apple has published an API to store keys in the Secure Enclave: https://developer.apple.com/documentation/security/...
- 424
2
votes
Accepted
Hardware-backed Keychain for iOS and Android
No the enclave is just for the iOS encryption processes.
It turns out this was the perfect convergence for the synergy needed
to allow Apple to move forward with TouchID. Apple has customized a
...
- 5,185
2
votes
Accepted
what does "no value specified" default to in keychain on osx?
To be fair, I didn't use OS X much lately, but my suspicion is: Yes.
Not setting specific values for those usage types that supersede the system default is irrelevant, as the certificate is a CA.
...
- 14.4k
2
votes
Accepted
Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?
Not a complete answer (yet?), but:
Yes OpenSSL library called (directly or as here via libssl) by a program like FreeRADIUS can verify a received chain; no your commandline openssl verify does not ...
- 10.9k
2
votes
Accepted
Keychain iOS: info on other users
iOS is a single user operating system (apart from system created users like “root”). So in that sense there can’t be other users.
Now if you logged into an app on a server, using your server username ...
- 2,553
1
vote
How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?
I don't think anyone but an Apple engineer can give an authoritative answer.
But this has been bugging me so I went on a reading spree and this is my interpretation based on previous experience with ...
- 2,067
1
vote
Accepted
Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?
Which drawbacks do you see?
The drawbacks I see have mainly to do with what is not explicitly stated in the question rather than what is explicitly stated. In general, you have not stated what kind ...
- 5,056
1
vote
Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?
This is a well-asked question, and as the question itself lays out, even experts will have different opinions in the context of absolute/abstract framings of safety.
The nuanced reality of course is ...
- 3,547
1
vote
Accepted
What format is an decrypted RSA private key in, specifically in OS X Keychain?
I'm reading between the lines of the chainbreaker docs and your OP (having not tried the tool yet myself), and it seems like the private key should be fully present under "Decrypted Private Key" in ...
- 136
1
vote
Accepted
Is a password in keychain more secure than storing password in plaintext?
This is precisely why you shouldn't grant the security program access to your keychain entries. In general, each keychain entry should only be readable (without prompting the user) by the specific ...
- 2,611
1
vote
Is a password in keychain more secure than storing password in plaintext?
I don't have any internet passwords stored in my keychain, but running security find-generic-password -w, I get this prompt:
Similarly, the first time I use an ssh key, I have to re-enter a password ...
- 9,452
1
vote
Using a gmail oath2 token to access web email
You cannot use the oath2 token used by applications for login via the web browser
- 3,280
1
vote
Accepted
Know LastPass fishing apps? Ways to protect?
First installing extension is not a harmless operation. Common usages say:
Once you have installed an unwanted software on your computer, it is no longer your computer
But the attack should be ...
- 26.8k
1
vote
Accepted
Keychain-dumper and Secure Enclave
No, it won't reside on the keystore.
The secure enclave and the keystore are two different things:
KeyStore, is a secure database, implemented in iOS. It resides in the filesystem. While it is built ...
- 332
1
vote
Storage of account password on keychain iOS to enable TouchID login
Suppose you have an iOS app that accepts a username and passcode. This login information would be entered by the user, then you could store that state by saving the credentials in the Keychain, which ...
- 111
1
vote
How to encrypt data using the iOS secure element?
The keychain already uses it.
From WWDC 2015:
We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around Keychain ...
- 879
Only top scored, non community-wiki answers of a minimum length are eligible