如何将 SecKey 从应用程序钥匙串移动到共享钥匙串组

Question

I'm generating the private key in my iOS app for secure communication between server and app. The private key is being stored in the keychain. In the new version of the app, I want to use the shared keychain group because of notification extensions. How do is transfer the private key that was stored in the app keychain to the shared group keychain. Below is the code I m using to generate the private key

func createPrivateKey(withLabel label: String) throws -> SecKey {
    let privateKeyAttrs: [String: Any] = [
        kSecAttrIsPermanent as String: true,
        kSecAttrApplicationLabel as String: label,
        kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
    ]

    let attributes: [String: Any] = [
        kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
        kSecAttrKeySizeInBits as String: 2048,
        kSecPrivateKeyAttrs as String: privateKeyAttrs,
    ]

    var error: Unmanaged<CFError>?
    guard let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {
        // swiftlint:disable:next force_unwrapping
        throw error!.takeRetainedValue() as Error
    }
    return privateKey
}

Answer 1

You'll have to specify the access group on creation, or update the existing keys with the new access groups. After you've done that, you should setup the entitlements correctly, so that apps and extensions you create can access the correct keychain access group. Read with care, as there is only a thin line between app groups and keychain sharing group. Make sure you set up the correct one ( documentation here ).

As for your query

let accessGroup = "<# Your Team ID #>.com.example.SharedItems"
let attributes: [String: Any] = [
    kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
    kSecAttrKeySizeInBits as String: 2048,
    kSecAttrAccessGroup as String: accessGroup,
    kSecPrivateKeyAttrs as String: privateKeyAttrs
]

That should create the query for creating keys for the access group you specify. I suppose you can figure out the update query yourself.