iOS Keychain Services presentation by 흰, 민디 in CodeSquad

1. iOS 안전하게
KeyChain.
키키킼
흰
민디

2. KeyChain 🔑
한번 살펴볼게요.
Why
use
KeyChain
What
is
KeyChain
Using
KeyChain
😈 🧐 😎

3. 앱 안의 수많은 개인정보
😈
😈
😈 😈
😈
😈
😈
😈
😈
😈

4. 똑같은 비밀번호를 여러 곳에 사용합니까?
여러 개의 계정에 (모든 계정은 아니지만)
같은 비밀번호를 사용한다
모든 계정에 다 다른 비밀번호를 사용한다
모든 계정에 같은 비밀번호를 사용한다
Online Security Survey by Google / Harris Poll

5. 편리한 사용자 경험 VS. 개인정보 보호

6. KeyChain.

7. Security Framework
🔑 KeyChain

8. KeyChain

9. KeyChain Item

10. KeyChain Item
Add
Search
Update
Delete
let item = SecKeychainItem()X
Add / Search / Update / Delete

11. KeyChain Item
KeyChain Item
Data
Item Class
Key / Value
Attributes
Item Attribute
Key / Value
query[kSecClass as String] = kSecClassGenericPassword
Class / Attribute - Key : Value

12. KeyChain Item - Class

13. Access.

14. Sharing.

15. Access Group 가족 앱끼리 비밀 공유하기 🤫
Access Group
특정 그룹 이름으로 태깅된 앱들의 logical collection

16. Access Group 가족 앱끼리 비밀 공유하기 🤫
🔓
group name

17. Access Group 가족 앱끼리 비밀 공유하기 🤫
1. KeyChain Access Groups (Optional)
2. Application Identifier
3. Application Groups
Access Group List
System
App

18. Access Group 비밀 Access Group을 만들어보자 🤫
[$(teamID).com.example.AppOne] AppID

19. Access Group 가족 앱끼리 비밀 공유하기 🤫
[$(teamID).com.example.AppOne] [$(teamID).com.example.AppTwo]

20. Access Group 가족 앱끼리 비밀 공유하기 🤫

21. Access Group 가족 앱끼리 비밀 공유하기 🤫
[$(teamID).com.example.SharedItems,
$(teamID).com.example.AppOne]
[$(teamID).com.example.SharedItems,
$(teamID).com.example.AppTwo]
1. KeyChain Access Groups (Optional)
2. Application Identifier
3. Application Groups

22. Restricting.

23. Restricting Keychain Access 디바이스 상태에 따라 접근 제어

24. Restricting Keychain Access 디바이스 상태에 따라 접근 제어
kSecAttrAccessible

25. Restricting Keychain Access 디바이스 상태에 따라 접근 제어
When Passcode Set

26. Restricting Keychain Access 디바이스 상태에 따라 접근 제어
When Unlocked
After First Unlock
Always

27. Restricting Keychain Access 디바이스 상태에 따라 접근 제어

28. Restricting Keychain Access 디바이스 상태에 따라 접근 제어

29. Wrapper.

30. Wrapper 사용 복잡혀,,,🤯
Security
대부분 C 언어로 작성
low-level API 🤯

31. func readPassword() throws -> String {
/*
Build a query to find the item that matches the service, account and
access group.
*/
var query = KeychainPasswordItem.keychainQuery(withService: service, account: account, accessGroup:
essGroup)
query[kSecMatchLimit as String] = kSecMatchLimitOne
query[kSecReturnAttributes as String] = kCFBooleanTrue
query[kSecReturnData as String] = kCFBooleanTrue
// Try to fetch the existing keychain item that matches the query.
var queryResult: AnyObject?
let status = withUnsafeMutablePointer(to: &queryResult) {
SecItemCopyMatching(query as CFDictionary, UnsafeMutablePointer($0))
}
// Check the return status and throw an error if appropriate.
guard status != errSecItemNotFound else { throw KeychainError.noPassword }
guard status == noErr else { throw KeychainError.unhandledError(status: status) }
// Parse the password string from the query result.
guard let existingItem = queryResult as? [String : AnyObject],
let passwordData = existingItem[kSecValueData as String] as? Data,
let password = String(data: passwordData, encoding: String.Encoding.utf8)
else {
throw KeychainError.unexpectedPasswordData
}
return password
}
func savePassword(_ password: String) throws {
// Encode the password into an Data object.
let encodedPassword = password.data(using: String.Encoding.utf8)!
do {
// Check for an existing item in the keychain.
try _ = readPassword()
// Update the existing item with the new password.
var attributesToUpdate = [String : AnyObject]()
attributesToUpdate[kSecValueData as String] = encodedPassword as AnyObject?
let query = KeychainPasswordItem.keychainQuery(withService: service, account: account, accessGroup:
accessGroup)
let status = SecItemUpdate(query as CFDictionary, attributesToUpdate as CFDictionary)
// Throw an error if an unexpected status was returned.
guard status == noErr else { throw KeychainError.unhandledError(status: status) }
}
static func passwordItems(forService service: String, accessGroup
[KeychainPasswordItem] {
// Build a query for all items that match the service and
var query = KeychainPasswordItem.keychainQuery(withService
query[kSecMatchLimit as String] = kSecMatchLimitAll
query[kSecReturnAttributes as String] = kCFBooleanTrue
query[kSecReturnData as String] = kCFBooleanFalse
// Fetch matching items from the keychain.
var queryResult: AnyObject?
let status = withUnsafeMutablePointer(to: &queryResult) {
SecItemCopyMatching(query as CFDictionary, UnsafeMutab
}
// If no items were found, return an empty array.
guard status != errSecItemNotFound else { return [] }
// Throw an error if an unexpected status was returned.
guard status == noErr else { throw KeychainError.unhandled
// Cast the query result to an array of dictionaries.
guard let resultData = queryResult as? [[String : AnyObjec
KeychainError.unexpectedItemData }
// Create a `KeychainPasswordItem` for each dictionary in
var passwordItems = [KeychainPasswordItem]()
for result in resultData {
guard let account = result[kSecAttrAccount as String]
KeychainError.unexpectedItemData }
let passwordItem = KeychainPasswordItem(service: servi
accessGroup)
passwordItems.append(passwordItem)
Wrapper를 사용하는 이유.
var query = [String : AnyObject]()
query[kSecClass as String] = kSecClassGenericPassword
query[kSecAttrService as String] = service as AnyObject?

32. Wrapper 사용 복잡혀,,,🤯
Generic Keychain

33. 감사합니다.