ios - 尝试使用 Secure Enclave 中的 EC 私钥对数据进行签名时出现身份验证错误

Question

我正在尝试在我的 iOS 应用程序中执行以下操作:

1. 使用 SecKeyGeneratePair 生成 key 对，并将私钥存储在 Secure Enclave 中
2. 使用私钥签署一些数据

如果我在第一次生成 key 时保留私钥引用，它会起作用，但如果我在丢弃初始指针后尝试从钥匙串(keychain)中检索引用，则不起作用。

key 的生成方式如下:

func generateKeyPair() -> Bool {

    if let access = SecAccessControlCreateWithFlags(nil,
                                                    kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
                                                    [.userPresence, .privateKeyUsage],
                                                    nil) {

        let privateKeyAttr = [kSecAttrIsPermanent : 1,
                              kSecAttrApplicationTag : privateTag,
                              kSecAttrAccessControl as String: access
            ] as NSDictionary

        let publicKeyAttr = [kSecAttrIsPermanent : 0,
                             kSecAttrApplicationTag : publicTag
            ] as NSDictionary

        let keyPairAttr = [kSecAttrKeySizeInBits : 256,
                           kSecAttrKeyType : kSecAttrKeyTypeEC,
                           kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
                           kSecPrivateKeyAttrs : privateKeyAttr,
                           kSecPublicKeyAttrs : publicKeyAttr] as NSDictionary

        let err = SecKeyGeneratePair(keyPairAttr, &publicKey, &privateKey)
        return err == noErr
}

签名方式如下:

func signData(plainText: Data) -> NSData? {                
    guard privateKey != nil else {
        print("Private key unavailable")
        return nil
    }

    let digestToSign = self.sha1DigestForData(data: plainText as NSData) as Data

    let signature = UnsafeMutablePointer<UInt8>.allocate(capacity: 128)
    var signatureLength = 128
    let err = SecKeyRawSign(privateKey!,
                            .PKCS1SHA1,
                            [UInt8](digestToSign),
                            Int(CC_SHA1_DIGEST_LENGTH),
                            signature,
                            &signatureLength)

    print("Signature status: \(err)")

    let sigData = NSData(bytes: signature, length: Int(signatureLength))

    return sigData
}

func sha1DigestForData(data: NSData) -> NSData {
    let len = Int(CC_SHA1_DIGEST_LENGTH)
    let digest = UnsafeMutablePointer<UInt8>.allocate(capacity: len)
    CC_SHA1(data.bytes, CC_LONG(data.length), digest)
    return NSData(bytesNoCopy: UnsafeMutableRawPointer(digest), length: len)
}

这需要我的指纹并且工作完美。然后我使用另一种方法从钥匙串(keychain)中获取 key 引用:

func getPrivateKeyRef() -> SecKey? {

    let parameters = [
        kSecClass as String: kSecClassKey,
        kSecAttrKeyClass as String: kSecAttrKeyClassPrivate,
        kSecAttrApplicationTag as String: privateTag,
        kSecReturnRef as String: true,
        ] as [String : Any]
    var ref: AnyObject?
    let status = SecItemCopyMatching(parameters as CFDictionary, &ref)
    print("Get key status: \(status)")

    if status == errSecSuccess { return ref as! SecKey? } else { return nil }
}

SecItemCopyMatching 返回成功状态，但尝试使用生成的 SecKey 项作为 SecKeyRawSign 中的私钥会导致错误-25293授权/身份验证失败。此状态仅在我提供指纹后出现，因此实际指纹验证成功，但 key 不知何故仍然无法使用。

使用 Secure Enclave 中存储的 key 对数据进行签名的正确方法是什么？

Answer 1

看起来使用 kSecAttrLabel 属性对于正确获取 key 是必要的。在生成 key 以及通过 SecItemCopyMatching 获取 key 时必须指定它。

我获取私钥的工作解决方案:

func getPrivateKey() -> SecKey? {
    let parameters = [
        kSecClass as String: kSecClassKey,
        kSecAttrKeyClass as String: kSecAttrKeyClassPrivate,
        kSecAttrApplicationTag as String : "privateTag",
        kSecAttrLabel as String : "privateTag",
        kSecReturnRef as String: true,
        ] as [String : Any]
    var ref: AnyObject?
    let status = SecItemCopyMatching(parameters as CFDictionary, &ref)
    if status == errSecSuccess {
        return (ref as! SecKey)
    }
    return nil
}

key 对的生成方式如下:

    var publicKey:SecKey?
    var privateKey:SecKey?
    if let access = SecAccessControlCreateWithFlags(nil,
                                                    kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
                                                    [.userPresence, .privateKeyUsage],
                                                    nil) {

        let privateKeyAttr = [kSecAttrIsPermanent : 1,
                              kSecAttrApplicationTag as String : "privateTag",
                              kSecAttrLabel as String : "privateTag",
                              kSecAttrAccessControl as String: access
            ] as NSDictionary

        let publicKeyAttr = [kSecAttrIsPermanent : 0,
                             kSecAttrApplicationTag as String : "publicTag",
                             kSecAttrLabel as String : "publicTag",
                             ] as NSDictionary

        // only 256 bit EC keys are supported in the Secure Enclave
        let keyPairAttr = [kSecAttrKeySizeInBits : 256,
                           kSecAttrKeyType : kSecAttrKeyTypeEC,
                           kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
                           kSecPrivateKeyAttrs : privateKeyAttr,
                           kSecPublicKeyAttrs : publicKeyAttr] as NSDictionary

        let err = SecKeyGeneratePair(keyPairAttr, &publicKey, &privateKey)