iOS keychain: SecItemUpdate returns -50 (paramErr) when updating kSecAttrAccessible

Question

I need to update the kSecAttrAccessible of a keychain entry. I don't need to update the actual data, just the accessibility attribute.

First I try to find the item to make sure that my query dictionary is good:

sanityCheck = SecItemCopyMatching((__bridge CFDictionaryRef)(queryPrivateKey), (void *)&privateKeyRef);

This line successfully finds me the item I am looking for (return code is 0).

I then update the kSecAttrAccessible attribute using the same query:

if (sanityCheck == noErr && privateKeyRef != nil) {
    // found it, update accessibility
    NSMutableDictionary *updatedAttributes = [[NSMutableDictionary alloc] init];
    updatedAttributes[(__bridge id)kSecAttrAccessible] = (__bridge id)kSecAttrAccessibleAlways;
    OSStatus updateItemStatus = SecItemUpdate((__bridge CFDictionaryRef)queryPrivateKey, (__bridge CFDictionaryRef)updatedAttributes);
}

At this point, updateItemStatus is -50 (paramErr).

I have looked at this thread: Is it possible to update a Keychain item's kSecAttrAccessible value? However my issue is different. It returns -50 even if I add kSecValueData to my updatedAttributes. Besides, the documentation also states that we need to add kSecValueData only for iOS 4 and earlier. I am supporting iOS 7 and above, so this shouldn't be my issue.

Could anyone point out what I am missing here? Thanks a lot.

Answer 1

The fact that a query can successfully find you the keychain item via SecItemCopyMatching doesn't mean the same query can be used to update the keychain item.

I'm using the following query for item lookup:

[queryPrivateKey setObject:(__bridge id)kSecClassKey forKey:(__bridge id)kSecClass];
[queryPrivateKey setObject:(__bridge id)kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
[queryPrivateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
[queryPrivateKey setObject:[EncryptionHelper privateKeyTag:JWT_KEYPAIR_TAG] forKey:(__bridge id<NSCopying>)(kSecAttrApplicationTag)];

sanityCheck = SecItemCopyMatching((__bridge CFDictionaryRef)(queryPrivateKey), (void *)&privateKeyef);

However, in order to use this query for item update, I first had to do:

[queryPrivateKey removeObjectForKey:(__bridge id)kSecReturnRef];

Then I can update:

OSStatus updateItemStatus = SecItemUpdate((__bridge CFDictionaryRef)queryPrivateKey,(__bridge CFDictionaryRef)updatedAttributes);

Obviously, kSecReturnRef is not an acceptable key in the query dictionary of SecItemUpdate. I was not able to find the list of acceptable keys of the query of SecItemUpdate from the apple documentation. From the documentation of SecItemUpdate, it seems that only these keys are acceptable, but that doesn't seem to be the correct list as I am expecting keys like kSecClass etc to be in the list. If anyone has an updated doc link please share it, for now it just takes me some trial and error to find out which keys are acceptable for SecItemUpdate.

After the item has been found, there is also another complexity with updating kSecAttrAccessible: you can't update from a higher security setting like kSecAttrAccessibleWhenUnlocked to a lower setting like kSecAttrAccessibleAlways when the phone is locked for security reasons, so the migration has to happen when the phone is unlocked. A good place for the migration is when the app is resumed in foreground, because the device must be in an unlocked state when app is in foreground.