以编程方式从 Mac 钥匙串中存储和检索私钥
在 Mac 应用程序中，我需要以安全的方式存储从服务器发送的登录用户的私钥，并在需要时以编程方式检索它。我知道钥匙扣是存储私钥的最佳位置。是否有任何示例代码可以实现此目的？
我可以使用“Security.framework”的“SecKeychainItemImport”方法将私钥添加到钥匙串中，但从钥匙串中检索私钥时遇到问题。我尝试使用“SecKeychainItemCopyAttributesAndData”和“SecKeychainItemCopyContent”方法从钥匙串中获取私钥。但到目前为止还没有运气。
我还在博客中读到提到“.ssh”隐藏文件夹中的私钥存储。但我认为将私钥存储在钥匙串中可以提供更高级别的安全性，以便其他人无法轻松访问私钥。
In a Mac application, I have a requirement to store the private key sent from the server for logged in user in a secure way and retrieve it back whenever needed programmatically. I know that keychain is the best place to store the private key. Is there any sample code available to achieve this?
I am able to add the private key to the keychain using "SecKeychainItemImport" method of "Security.framework" but having issues retrieving back the private key from the keychain. I have tried using "SecKeychainItemCopyAttributesAndData" and "SecKeychainItemCopyContent" methods for getting private key back from the keychain. But no luck so far.
I have also read in blogs mentioning private key storage inside ".ssh" hidden folder. But I feel that storing the private key inside the keychain provides one more level of security so that someone else can not have an easy access to the private key.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
钥匙串的目的之一是通过不将私钥数据暴露给应用程序来保护私钥。为了防止意外泄露私钥，这些项目被标记为CSSM_KEYATTR_EXTRACTABLE |默认情况下CSSM_KEYATTR_SENSITIVE；即，只能使用 SecKeychainItemExport 获取其数据，并且只能采用受密码保护的格式。
安全框架中的 API 可以使用提供的密钥项对数据进行加密/解密/签名/验证等，而无需将原始密钥数据放入应用程序的地址空间中。 （这些操作通常由单独的特权进程完成。）
如果由于某种原因您确实需要访问私钥的原始位，则需要在将私钥导入钥匙串时为此做好准备。您需要在
SecKeychainItemImport的keyParams参数中将keyAttributes设置为CSSM_KEYATTR_EXTRACTABLE（即不带敏感位）。One purpose of the Keychain is to keep private keys protected by not exposing their data to the application. To prevent accidentally exposing a private key, these items are flagged
CSSM_KEYATTR_EXTRACTABLE | CSSM_KEYATTR_SENSITIVEby default; i.e., it is only possible to get their data usingSecKeychainItemExport, and only in a passphrase-protected format.There are APIs in the Security framework that encrypt/decrypt/sign/verify etc. data using a supplied key item without ever putting the raw key data in the application's address space. (These operations are normally done by a separate, privileged process.)
If for some reason you do need access to the private key's raw bits, you need to prepare for this at the time you import the private key to the keychain. You need to set
keyAttributestoCSSM_KEYATTR_EXTRACTABLE(i.e., without the sensitive bit) in thekeyParamsparameter ofSecKeychainItemImport.是的，钥匙串就是您在这里使用的。你想先阅读文档，然后查看 Apple 的示例代码。
http://developer.apple.com/库/mac/#documentation/Security/Conceptual/keychainServConcepts/01introduction/introduction.html
http://developer.apple.com/library/ios/#samplecode /GenericKeychain/Introduction/Intro.html
Yes, the Keychain is what you'd use here. You want to read the documentation first, then look at Apple's sample code.
http://developer.apple.com/library/mac/#documentation/Security/Conceptual/keychainServConcepts/01introduction/introduction.html
http://developer.apple.com/library/ios/#samplecode/GenericKeychain/Introduction/Intro.html