ios - 将 EC_KEY OpenSSL 中的公钥和私钥导出到 SecKeyRef

Question

我想从从 OpenSSL 创建的 EC_KEY 导出公钥和私钥，并且我们知道 EC_KEY 保存 key 对，但 openssl 不兼容将 key 对存储到安全中飞地。因此，我想从 OpenSSL 创建证书并从那里创建 key 对，然后将 key 从 EC_KEY 导出到 SecKeyRef，然后创建 key 对并存储在 Secure Enclave 中。

• 首先是故事，这可能吗？
• 如果是，那么如何从 EC_KEY 导出私钥公钥并将其转换为 SecRefKey
• 如果我的方法错误，请指导我更好的方法

我完成了第一部分从 OpenSSL 的椭圆曲线 EC_KEY 创建证书，并完成了最后一部分创建 key 对。下面是创建 key 对的代码。

- (void)generateKeyPair:(NSUInteger)keySize {
OSStatus sanityCheck = noErr;
publicKey = NULL;
privateKey = NULL;

//  LOGGING_FACILITY1( keySize == 512 || keySize == 1024 || keySize == 2048, @"%d is an invalid and unsupported key size.", keySize );

// First delete current keys.
//  [self deleteAsymmetricKeys];

// Container dictionaries.
NSMutableDictionary * privateKeyAttr = [[NSMutableDictionary alloc] init];
NSMutableDictionary * publicKeyAttr = [[NSMutableDictionary alloc] init];
NSMutableDictionary * keyPairAttr = [[NSMutableDictionary alloc] init];

// Set top level dictionary for the keypair.
[keyPairAttr setObject:(__bridge id)kSecAttrKeyTypeEC forKey:(__bridge id)kSecAttrKeyType];
[keyPairAttr setObject:[NSNumber numberWithUnsignedInteger:keySize] forKey:(__bridge id)kSecAttrKeySizeInBits];

   [keyPairAttr setObject:(__bridge id)kSecAttrTokenID forKey:(__bridge id)kSecAttrTokenIDSecureEnclave];
//    [keyPairAttr setObject:(__bridge id)kSecAttrTokenID forKey:(__bridge id)kSecAttrTokenIDSecureEnclave];

// Set the private key dictionary.
[privateKeyAttr setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecAttrIsPermanent];
[privateKeyAttr setObject:privateTag forKey:(__bridge id)kSecAttrApplicationTag];

// See SecKey.h to set other flag values.

// Set the public key dictionary.
[publicKeyAttr setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecAttrIsPermanent];
[publicKeyAttr setObject:publicTag forKey:(__bridge id)kSecAttrApplicationTag];
// See SecKey.h to set other flag values.

// Set attributes to top level dictionary.
[keyPairAttr setObject:privateKeyAttr forKey:(__bridge id)kSecPrivateKeyAttrs];
[keyPairAttr setObject:publicKeyAttr forKey:(__bridge id)kSecPublicKeyAttrs];

// SecKeyGeneratePair returns the SecKeyRefs just for educational purposes.
sanityCheck = SecKeyGeneratePair((__bridge CFDictionaryRef)keyPairAttr, &publicKey, &privateKey);

//  LOGGING_FACILITY( sanityCheck == noErr && publicKey != NULL && privateKey != NULL, @"Something really bad went wrong with generating the key pair." );
if(sanityCheck == noErr  && publicKey != NULL && privateKey != NULL)
{
    NSLog(@"Successful");
}

//  [privateKeyAttr release];
//  [publicKeyAttr release];
//  [keyPairAttr release];
}

Answer 1

您无法将任何内容导入安全飞地。您只能使用 SecKeyGeneratePair 生成 key 对(就像您在代码中所做的那样)

以下是 Apple 文档中对此的引用:https://developer.apple.com/reference/security/keychain_services/token_id_values

生成后，您可以:

• 签署数据 (SecKeyRawSign)
• 验证签名 (SecKeyRawVerify)
• 加密/解密 (SecKeyCreateEncryptedData,SecKeyCreateDecryptedData)
• 取出 key (SecItemCopyMatching) 并用它们做任何你想做的事情

如果您想与 OpenSSL 进行互操作，您只需将它们转换为 OpenSSL 可以读取的内容(例如 PEM、DER 等)

这是公钥从原始字节(SecItemCopyMatching 在 kSecValueData 下的字典中为您提供的内容)到 PEM 的简单转换

+ (NSString*) openSSLPubKey:(NSData*) rawPublicKeyBytes {

  uint8_t curveOIDHeader[] = {0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00};

  NSMutableData* data = [[NSMutableData alloc] initWithBytes:curveOIDHeader length:26];

  [data appendData:rawPublicKeyBytes];

  NSString* base64EncodedString = [data base64EncodedStringWithOptions:NSDataBase64Encoding64CharacterLineLength | NSDataBase64EncodingEndLineWithCarriageReturn];
  return [NSString stringWithFormat:@"-----BEGIN PUBLIC KEY-----\n%@\n-----END PUBLIC KEY-----",base64EncodedString];

}

请注意，您只能在安全飞地中存储 256 位椭圆曲线私钥，因此需要硬编码的 OID header