This is all quite feasible. You don’t need to use CTK here, although there are some situations where you might want to do that [1]. However, for basic functionality all you need to do is:
-
On iOS only, add the com.apple.token keychain access group to your keychain-access-groups entitlement [2].
-
When querying the keychain with SecItemCopyMatching, pass in the kSecAttrAccessGroup attribute with the value set to kSecAttrAccessGroupToken.
Pasted in below are a few code snippets from a test project I have lying around. I tested it with a YubiKey 5 NFC.
IMPORTANT This snippet uses deliberately bad crypto, .rsaSignatureMessagePSSSHA1.
This snippet uses the secCall helpers from here.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] For example, using TKTokenWatcher to watch tokens come and go.
[2] The docs are not at all clear about this, something I recently filed a bug about. Coulda sworn I filed a bug about that but I can’t find the bug number right now )-:
func list() {
do {
print("will list")
let certificates = try secCall { SecItemCopyMatching([
kSecClass: kSecClassCertificate,
kSecAttrAccessGroup: kSecAttrAccessGroupToken,
kSecMatchLimit: kSecMatchLimitAll,
kSecReturnRef: true,
] as NSDictionary, $0) } as! [SecCertificate]
let names = try certificates.map { cert in
try secCall { SecCertificateCopySubjectSummary(cert) }
}
print("did list, names:")
print(names.map { " \($0)" }.joined(separator: "\n"))
} catch {
print("did not list, error: \(error)")
}
}
func sign() {
do {
print("will sign")
let identity = try secCall { SecItemCopyMatching([
kSecClass: kSecClassIdentity,
kSecAttrAccessGroup: kSecAttrAccessGroupToken,
kSecReturnRef: true,
] as NSDictionary, $0) } as! SecIdentity
let privateKey = try secCall { SecIdentityCopyPrivateKey(identity, $0) }
let dataToSign = Data("Hello Cruel World! \(Date())".utf8)
let signature = try secCall { SecKeyCreateSignature(privateKey, .rsaSignatureMessagePSSSHA1, dataToSign as NSData, $0) }
print("did sign, identity: \(identity), signature: \(signature)")
print("will verify")
let cert = try secCall { SecIdentityCopyCertificate(identity, $0) }
let publicKey = try secCall { SecCertificateCopyKey(cert) }
let didVerify = SecKeyVerifySignature(publicKey, .rsaSignatureMessagePSSSHA1, dataToSign as NSData, signature as NSData, nil)
if didVerify {
print("did verify")
} else {
print("did not verify")
}
} catch {
print("did not sign, error: \(error)")
}
}
