2 * Copyright (c) 2006-2014 Apple Inc. All Rights Reserved.
4 * @APPLE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
21 * @APPLE_LICENSE_HEADER_END@
26 SecItem defines CoreFoundation-based constants and functions for
27 access to Security items (certificates, keys, identities, and
31 #ifndef _SECURITY_SECITEM_H_
32 #define _SECURITY_SECITEM_H_
34 #include <CoreFoundation/CFNumber.h>
35 #include <CoreFoundation/CFArray.h>
36 #include <CoreFoundation/CFDictionary.h>
38 #if defined(__cplusplus)
42 CF_ASSUME_NONNULL_BEGIN
43 CF_IMPLICIT_BRIDGING_ENABLED
46 @enum Class Key Constant
47 @discussion Predefined key constant used to get or set item class values in
48 a dictionary. Its value is one of the constants defined in the Value
49 Constants for kSecClass.
50 @constant kSecClass Specifies a dictionary key whose value is the item's
51 class code. You use this key to get or set a value of type CFTypeRef
52 that contains the item class code.
54 extern const CFStringRef kSecClass
55 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
58 @enum Class Value Constants
59 @discussion Predefined item class constants used to get or set values in
60 a dictionary. The kSecClass constant is the key and its value is one
61 of the constants defined here. Note: on Mac OS X 10.6, only items
62 of class kSecClassInternetPassword are supported.
63 @constant kSecClassInternetPassword Specifies Internet password items.
64 @constant kSecClassGenericPassword Specifies generic password items.
65 @constant kSecClassCertificate Specifies certificate items.
66 @constant kSecClassKey Specifies key items.
67 @constant kSecClassIdentity Specifies identity items.
69 extern const CFStringRef kSecClassInternetPassword
70 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
71 extern const CFStringRef kSecClassGenericPassword
72 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
73 extern const CFStringRef kSecClassCertificate
74 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
75 extern const CFStringRef kSecClassKey
76 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
77 extern const CFStringRef kSecClassIdentity
78 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
81 @enum Attribute Key Constants
82 @discussion Predefined item attribute keys used to get or set values in a
83 dictionary. Not all attributes apply to each item class. The table
84 below lists the currently defined attributes for each item class:
86 kSecClassGenericPassword item attributes:
87 kSecAttrAccess (OS X only)
89 kSecAttrAccessGroup (iOS; also OS X if kSecAttrSynchronizable specified)
90 kSecAttrAccessible (iOS; also OS X if kSecAttrSynchronizable specified)
92 kSecAttrModificationDate
104 kSecClassInternetPassword item attributes:
105 kSecAttrAccess (OS X only)
106 kSecAttrAccessGroup (iOS; also OS X if kSecAttrSynchronizable specified)
107 kSecAttrAccessible (iOS; also OS X if kSecAttrSynchronizable specified)
109 kSecAttrModificationDate
118 kSecAttrSecurityDomain
121 kSecAttrAuthenticationType
125 kSecClassCertificate item attributes:
126 kSecAttrCertificateType
127 kSecAttrCertificateEncoding
133 kSecAttrPublicKeyHash
135 kSecClassKey item attributes:
136 kSecAttrAccess (OS X only)
137 kSecAttrAccessGroup (iOS only)
138 kSecAttrAccessible (iOS only)
141 kSecAttrApplicationLabel
143 kSecAttrApplicationTag
148 kSecAttrKeySizeInBits
149 kSecAttrEffectiveKeySize
158 Note that the attributes kSecAttrCan* describe attributes of the
159 key itself at relatively high level. Some of these attributes are
160 mathematical -- for example, a DSA key cannot encrypt. Others are
161 key-level policy issues -- for example, it is good cryptographic
162 hygiene to use an RSA key either for encryption or signing but not
163 both. Compare these to the certificate-level policy values in
166 kSecClassIdentity item attributes:
167 Since an identity is the combination of a private key and a
168 certificate, this class shares attributes of both kSecClassKey and
169 kSecClassCertificate.
171 @constant kSecAttrAccessible Specifies a dictionary key whose value
172 indicates when your application needs access to an item's data. You
173 should choose the most restrictive option that meets your application's
174 needs to allow the system to protect that item in the best way possible.
175 See the "kSecAttrAccessible Value Constants" section for a list of
176 values which can be specified.
177 IMPORTANT: This attribute is currently not supported for OS X keychain
178 items, unless the kSecAttrSynchronizable attribute is also present. If
179 both attributes are specified on either OS X or iOS, the value for the
180 kSecAttrAccessible key may only be one whose name does not end with
181 "ThisDeviceOnly", as those cannot sync to another device.
183 @constant kSecAttrAccessControl Specifies a dictionary key whose value
184 is SecAccessControl instance which contains access control conditions
186 IMPORTANT: This attribute is mutually exclusive with kSecAttrAccess
189 @constant kSecAttrAccess Specifies a dictionary key whose value
190 is a SecAccessRef describing the access control settings for this item.
191 This key is available on OS X only.
193 @constant kSecAttrAccessGroup Specifies a dictionary key whose value is
194 a CFStringRef indicating which access group a item is in. The access
195 groups that a particular application has membership in are determined by
196 two entitlements for that application. The application-identifier
197 entitlement contains the application's single access group, unless
198 there is a keychain-access-groups entitlement present. The latter
199 has as its value a list of access groups; the first item in this list
200 is the default access group. Unless a specific access group is provided
201 as the value of kSecAttrAccessGroup when SecItemAdd is called, new items
202 are created in the application's default access group. Specifying this
203 attribute in SecItemCopyMatching, SecItemUpdate, or SecItemDelete calls
204 limits the search to the specified access group (of which the calling
205 application must be a member to obtain matching results.) To share
206 keychain items between multiple applications, each application must have
207 a common group listed in its keychain-access-groups entitlement, and each
208 must specify this shared access group name as the value for the
209 kSecAttrAccessGroup key in the dictionary passed to SecItem functions.
211 @constant kSecAttrSynchronizable Specifies a dictionary key whose value is
212 a CFBooleanRef indicating whether the item in question can be synchronized.
213 To add a new item which can be synced to other devices, or to obtain
214 synchronizable results from a query, supply this key with a value of
215 kCFBooleanTrue. If the key is not supplied, or has a value of
216 kCFBooleanFalse, then no synchronizable items will be added or returned.
217 A predefined value, kSecAttrSynchronizableAny, may be provided instead of
218 kCFBooleanTrue if both synchronizable and non-synchronizable results are
221 IMPORTANT: Specifying the kSecAttrSynchronizable key has several caveats:
223 - Updating or deleting items using the kSecAttrSynchronizable key will
224 affect all copies of the item, not just the one on your local device.
225 Be sure that it makes sense to use the same password on all devices
226 before deciding to make a password synchronizable.
227 - Only password items can currently be synchronized. Keychain syncing
228 is not supported for certificates or cryptographic keys.
229 - Items stored or obtained using the kSecAttrSynchronizable key cannot
230 specify SecAccessRef-based access control with kSecAttrAccess. If a
231 password is intended to be shared between multiple applications, the
232 kSecAttrAccessGroup key must be specified, and each application
233 using this password must have a 'keychain-access-groups' entitlement
234 with the specified access group value.
235 - Items stored or obtained using the kSecAttrSynchronizable key may
236 not also specify a kSecAttrAccessible value which is incompatible
237 with syncing (namely, those whose names end with "ThisDeviceOnly".)
238 - Items stored or obtained using the kSecAttrSynchronizable key cannot
239 be specified by reference. You must pass kSecReturnAttributes and/or
240 kSecReturnData to retrieve results; kSecReturnRef is currently not
241 supported for synchronizable items.
242 - Persistent references to synchronizable items should be avoided;
243 while they may work locally, they cannot be moved between devices,
244 and may not resolve if the item is modified on some other device.
245 - When specifying a query that uses the kSecAttrSynchronizable key,
246 search keys are limited to the item's class and attributes.
247 The only search constant which may be used is kSecMatchLimit; other
248 constants using the kSecMatch prefix are not supported at this time.
250 @constant kSecAttrSynchronizableAny Specifies that both synchronizable and
251 non-synchronizable results should be returned from this query. This may be
252 used as a value for the kSecAttrSynchronizable dictionary key in a call to
253 SecItemCopyMatching, SecItemUpdate, or SecItemDelete.
255 @constant kSecAttrCreationDate (read-only) Specifies a dictionary key whose
256 value is the item's creation date. You use this key to get a value
257 of type CFDateRef that represents the date the item was created.
258 @constant kSecAttrModificationDate (read-only) Specifies a dictionary key
259 whose value is the item's modification date. You use this key to get
260 a value of type CFDateRef that represents the last time the item was
262 @constant kSecAttrDescription Specifies a dictionary key whose value is
263 the item's description attribute. You use this key to set or get a
264 value of type CFStringRef that represents a user-visible string
265 describing this particular kind of item (e.g., "disk image password").
266 @constant kSecAttrComment Specifies a dictionary key whose value is the
267 item's comment attribute. You use this key to set or get a value of
268 type CFStringRef containing the user-editable comment for this item.
269 @constant kSecAttrCreator Specifies a dictionary key whose value is the
270 item's creator attribute. You use this key to set or get a value of
271 type CFNumberRef that represents the item's creator. This number is
272 the unsigned integer representation of a four-character code (e.g.,
274 @constant kSecAttrType Specifies a dictionary key whose value is the item's
275 type attribute. You use this key to set or get a value of type
276 CFNumberRef that represents the item's type. This number is the
277 unsigned integer representation of a four-character code (e.g.,
279 @constant kSecAttrLabel Specifies a dictionary key whose value is the
280 item's label attribute. You use this key to set or get a value of
281 type CFStringRef containing the user-visible label for this item.
282 @constant kSecAttrIsInvisible Specifies a dictionary key whose value is the
283 item's invisible attribute. You use this key to set or get a value
284 of type CFBooleanRef that indicates whether the item is invisible
285 (i.e., should not be displayed.)
286 @constant kSecAttrIsNegative Specifies a dictionary key whose value is the
287 item's negative attribute. You use this key to set or get a value of
288 type CFBooleanRef that indicates whether there is a valid password
289 associated with this keychain item. This is useful if your application
290 doesn't want a password for some particular service to be stored in
291 the keychain, but prefers that it always be entered by the user.
292 @constant kSecAttrAccount Specifies a dictionary key whose value is the
293 item's account attribute. You use this key to set or get a CFStringRef
294 that contains an account name. (Items of class
295 kSecClassGenericPassword, kSecClassInternetPassword have this
297 @constant kSecAttrService Specifies a dictionary key whose value is the
298 item's service attribute. You use this key to set or get a CFStringRef
299 that represents the service associated with this item. (Items of class
300 kSecClassGenericPassword have this attribute.)
301 @constant kSecAttrGeneric Specifies a dictionary key whose value is the
302 item's generic attribute. You use this key to set or get a value of
303 CFDataRef that contains a user-defined attribute. (Items of class
304 kSecClassGenericPassword have this attribute.)
305 @constant kSecAttrSecurityDomain Specifies a dictionary key whose value
306 is the item's security domain attribute. You use this key to set or
307 get a CFStringRef value that represents the Internet security domain.
308 (Items of class kSecClassInternetPassword have this attribute.)
309 @constant kSecAttrServer Specifies a dictionary key whose value is the
310 item's server attribute. You use this key to set or get a value of
311 type CFStringRef that contains the server's domain name or IP address.
312 (Items of class kSecClassInternetPassword have this attribute.)
313 @constant kSecAttrProtocol Specifies a dictionary key whose value is the
314 item's protocol attribute. You use this key to set or get a value of
315 type CFNumberRef that denotes the protocol for this item (see the
316 SecProtocolType enum in SecKeychainItem.h). (Items of class
317 kSecClassInternetPassword have this attribute.)
318 @constant kSecAttrAuthenticationType Specifies a dictionary key whose value
319 is the item's authentication type attribute. You use this key to set
320 or get a value of type CFNumberRef that denotes the authentication
321 scheme for this item (see the kSecAttrAuthenticationType value
323 @constant kSecAttrPort Specifies a dictionary key whose value is the item's
324 port attribute. You use this key to set or get a CFNumberRef value
325 that represents an Internet port number. (Items of class
326 kSecClassInternetPassword have this attribute.)
327 @constant kSecAttrPath Specifies a dictionary key whose value is the item's
328 path attribute, typically this is the path component of the URL. You use
329 this key to set or get a CFStringRef value that represents a path. (Items
330 of class kSecClassInternetPassword have this attribute.)
331 @constant kSecAttrSubject (read-only) Specifies a dictionary key whose
332 value is the item's subject. You use this key to get a value of type
333 CFDataRef that contains the X.500 subject name of a certificate.
334 (Items of class kSecClassCertificate have this attribute.)
335 @constant kSecAttrIssuer (read-only) Specifies a dictionary key whose value
336 is the item's issuer. You use this key to get a value of type
337 CFDataRef that contains the X.500 issuer name of a certificate. (Items
338 of class kSecClassCertificate have this attribute.)
339 @constant kSecAttrSerialNumber (read-only) Specifies a dictionary key whose
340 value is the item's serial number. You use this key to get a value
341 of type CFDataRef that contains the serial number data of a
342 certificate. (Items of class kSecClassCertificate have this
344 @constant kSecAttrSubjectKeyID (read-only) Specifies a dictionary key whose
345 value is the item's subject key ID. You use this key to get a value
346 of type CFDataRef that contains the subject key ID of a certificate.
347 (Items of class kSecClassCertificate have this attribute.)
348 @constant kSecAttrPublicKeyHash (read-only) Specifies a dictionary key
349 whose value is the item's public key hash. You use this key to get a
350 value of type CFDataRef that contains the hash of a certificate's
351 public key. (Items of class kSecClassCertificate have this attribute.)
352 @constant kSecAttrCertificateType (read-only) Specifies a dictionary key
353 whose value is the item's certificate type. You use this key to get
354 a value of type CFNumberRef that denotes the certificate type (see the
355 CSSM_CERT_TYPE enum in cssmtype.h). (Items of class
356 kSecClassCertificate have this attribute.)
357 @constant kSecAttrCertificateEncoding (read-only) Specifies a dictionary
358 key whose value is the item's certificate encoding. You use this key
359 to get a value of type CFNumberRef that denotes the certificate
360 encoding (see the CSSM_CERT_ENCODING enum in cssmtype.h). (Items of
361 class kSecClassCertificate have this attribute.)
362 @constant kSecAttrKeyClass (read only) Specifies a dictionary key whose
363 value is one of kSecAttrKeyClassPublic, kSecAttrKeyClassPrivate or
364 kSecAttrKeyClassSymmetric.
365 @constant kSecAttrApplicationLabel Specifies a dictionary key whose value
366 is the key's application label attribute. This is different from the
367 kSecAttrLabel (which is intended to be human-readable). This attribute
368 is used to look up a key programmatically; in particular, for keys of
369 class kSecAttrKeyClassPublic and kSecAttrKeyClassPrivate, the value of
370 this attribute is the hash of the public key. This item is a type of CFDataRef.
371 Legacy keys may contain a UUID in this field as a CFStringRef.
372 @constant kSecAttrIsPermanent Specifies a dictionary key whose value is a
373 CFBooleanRef indicating whether the key in question will be stored
375 @constant kSecAttrIsSensitive Specifies a dictionary key whose value is a
376 CFBooleanRef indicating that the key in question can only be exported
377 in a wrapped (encrypted) format.
378 @constant kSecAttrIsExtractable Specifies a dictionary key whose value is a
379 CFBooleanRef indicating whether the key in question can be exported from
380 its keychain container.
381 @constant kSecAttrApplicationTag Specifies a dictionary key whose value is a
382 CFDataRef containing private tag data.
383 @constant kSecAttrKeyType Specifies a dictionary key whose value is a
384 CFNumberRef indicating the algorithm associated with this key (see the
385 CSSM_ALGORITHMS enum in cssmtype.h).
386 @constant kSecAttrPRF Specifies a dictionary key whose value is the PRF
387 (pseudo-random function) for this key (see "kSecAttrPRF Value Constants".)
388 @constant kSecAttrSalt Specifies a dictionary key whose value is a
389 CFData containing the salt to use for this key.
390 @constant kSecAttrRounds Specifies a dictionary key whose value is the
391 number of rounds for the pseudo-random function specified by kSecAttrPRF.
392 @constant kSecAttrKeySizeInBits Specifies a dictionary key whose value
393 is a CFNumberRef indicating the number of bits in this key.
394 @constant kSecAttrEffectiveKeySize Specifies a dictionary key whose value
395 is a CFNumberRef indicating the effective number of bits in this key.
396 For example, a DES key has a kSecAttrKeySizeInBits of 64, but a
397 kSecAttrEffectiveKeySize of 56 bits.
398 @constant kSecAttrCanEncrypt Specifies a dictionary key whole value is a
399 CFBooleanRef indicating whether the key in question can be used to
401 @constant kSecAttrCanDecrypt Specifies a dictionary key whole value is a
402 CFBooleanRef indicating whether the key in question can be used to
404 @constant kSecAttrCanDerive Specifies a dictionary key whole value is a
405 CFBooleanRef indicating whether the key in question can be used to
407 @constant kSecAttrCanSign Specifies a dictionary key whole value is a
408 CFBooleanRef indicating whether the key in question can be used to
409 create a digital signature.
410 @constant kSecAttrCanVerify Specifies a dictionary key whole value is a
411 CFBooleanRef indicating whether the key in question can be used to
412 verify a digital signature.
413 @constant kSecAttrCanWrap Specifies a dictionary key whole value is a
414 CFBooleanRef indicating whether the key in question can be used to
416 @constant kSecAttrCanUnwrap Specifies a dictionary key whole value is a
417 CFBooleanRef indicating whether the key in question can be used to
420 extern const CFStringRef kSecAttrAccessible
421 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
422 extern const CFStringRef kSecAttrAccess
423 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
424 extern const CFStringRef kSecAttrAccessControl
425 __OSX_AVAILABLE_STARTING(__MAC_10_10
, __IPHONE_8_0
);
426 extern const CFStringRef kSecAttrAccessGroup
427 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_3_0
);
428 extern const CFStringRef kSecAttrSynchronizable
429 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_7_0
);
430 extern const CFStringRef kSecAttrSynchronizableAny
431 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_7_0
);
432 extern const CFStringRef kSecAttrCreationDate
433 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
434 extern const CFStringRef kSecAttrModificationDate
435 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
436 extern const CFStringRef kSecAttrDescription
437 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
438 extern const CFStringRef kSecAttrComment
439 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
440 extern const CFStringRef kSecAttrCreator
441 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
442 extern const CFStringRef kSecAttrType
443 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
444 extern const CFStringRef kSecAttrLabel
445 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
446 extern const CFStringRef kSecAttrIsInvisible
447 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
448 extern const CFStringRef kSecAttrIsNegative
449 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
450 extern const CFStringRef kSecAttrAccount
451 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
452 extern const CFStringRef kSecAttrService
453 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
454 extern const CFStringRef kSecAttrGeneric
455 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
456 extern const CFStringRef kSecAttrSecurityDomain
457 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
458 extern const CFStringRef kSecAttrServer
459 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
460 extern const CFStringRef kSecAttrProtocol
461 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
462 extern const CFStringRef kSecAttrAuthenticationType
463 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
464 extern const CFStringRef kSecAttrPort
465 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
466 extern const CFStringRef kSecAttrPath
467 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
468 extern const CFStringRef kSecAttrSubject
469 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
470 extern const CFStringRef kSecAttrIssuer
471 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
472 extern const CFStringRef kSecAttrSerialNumber
473 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
474 extern const CFStringRef kSecAttrSubjectKeyID
475 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
476 extern const CFStringRef kSecAttrPublicKeyHash
477 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
478 extern const CFStringRef kSecAttrCertificateType
479 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
480 extern const CFStringRef kSecAttrCertificateEncoding
481 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
482 extern const CFStringRef kSecAttrKeyClass
483 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
484 extern const CFStringRef kSecAttrApplicationLabel
485 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
486 extern const CFStringRef kSecAttrIsPermanent
487 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
488 extern const CFStringRef kSecAttrIsSensitive
489 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
490 extern const CFStringRef kSecAttrIsExtractable
491 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
492 extern const CFStringRef kSecAttrApplicationTag
493 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
494 extern const CFStringRef kSecAttrKeyType
495 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
496 extern const CFStringRef kSecAttrPRF
497 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
498 extern const CFStringRef kSecAttrSalt
499 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
500 extern const CFStringRef kSecAttrRounds
501 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
502 extern const CFStringRef kSecAttrKeySizeInBits
503 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
504 extern const CFStringRef kSecAttrEffectiveKeySize
505 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
506 extern const CFStringRef kSecAttrCanEncrypt
507 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
508 extern const CFStringRef kSecAttrCanDecrypt
509 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
510 extern const CFStringRef kSecAttrCanDerive
511 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
512 extern const CFStringRef kSecAttrCanSign
513 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
514 extern const CFStringRef kSecAttrCanVerify
515 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
516 extern const CFStringRef kSecAttrCanWrap
517 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
518 extern const CFStringRef kSecAttrCanUnwrap
519 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
520 extern const CFStringRef kSecAttrTokenID
521 __OSX_AVAILABLE_STARTING(__MAC_10_12
, __IPHONE_9_0
);
524 @enum kSecAttrAccessible Value Constants
525 @discussion Predefined item attribute constants used to get or set values
526 in a dictionary. The kSecAttrAccessible constant is the key and its
527 value is one of the constants defined here.
528 When asking SecItemCopyMatching to return the item's data, the error
529 errSecInteractionNotAllowed will be returned if the item's data is not
530 available until a device unlock occurs.
531 @constant kSecAttrAccessibleWhenUnlocked Item data can only be accessed
532 while the device is unlocked. This is recommended for items that only
533 need be accesible while the application is in the foreground. Items
534 with this attribute will migrate to a new device when using encrypted
536 @constant kSecAttrAccessibleAfterFirstUnlock Item data can only be
537 accessed once the device has been unlocked after a restart. This is
538 recommended for items that need to be accesible by background
539 applications. Items with this attribute will migrate to a new device
540 when using encrypted backups.
541 @constant kSecAttrAccessibleAlways Item data can always be accessed
542 regardless of the lock state of the device. This is not recommended
543 for anything except system use. Items with this attribute will migrate
544 to a new device when using encrypted backups.
545 @constant kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly Item data can
546 only be accessed while the device is unlocked. This is recommended for
547 items that only need to be accessible while the application is in the
548 foreground and requires a passcode to be set on the device. Items with
549 this attribute will never migrate to a new device, so after a backup
550 is restored to a new device, these items will be missing. This
551 attribute will not be available on devices without a passcode. Disabling
552 the device passcode will cause all previously protected items to
554 @constant kSecAttrAccessibleWhenUnlockedThisDeviceOnly Item data can only
555 be accessed while the device is unlocked. This is recommended for items
556 that only need be accesible while the application is in the foreground.
557 Items with this attribute will never migrate to a new device, so after
558 a backup is restored to a new device, these items will be missing.
559 @constant kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly Item data can
560 only be accessed once the device has been unlocked after a restart.
561 This is recommended for items that need to be accessible by background
562 applications. Items with this attribute will never migrate to a new
563 device, so after a backup is restored to a new device these items will
565 @constant kSecAttrAccessibleAlwaysThisDeviceOnly Item data can always
566 be accessed regardless of the lock state of the device. This option
567 is not recommended for anything except system use. Items with this
568 attribute will never migrate to a new device, so after a backup is
569 restored to a new device, these items will be missing.
571 extern const CFStringRef kSecAttrAccessibleWhenUnlocked
572 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
573 extern const CFStringRef kSecAttrAccessibleAfterFirstUnlock
574 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
575 extern const CFStringRef kSecAttrAccessibleAlways
576 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
577 extern const CFStringRef kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly
578 __OSX_AVAILABLE_STARTING(__MAC_10_10
, __IPHONE_8_0
);
579 extern const CFStringRef kSecAttrAccessibleWhenUnlockedThisDeviceOnly
580 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
581 extern const CFStringRef kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
582 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
583 extern const CFStringRef kSecAttrAccessibleAlwaysThisDeviceOnly
584 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
587 @enum kSecAttrProtocol Value Constants
588 @discussion Predefined item attribute constants used to get or set values
589 in a dictionary. The kSecAttrProtocol constant is the key and its
590 value is one of the constants defined here.
591 @constant kSecAttrProtocolFTP
592 @constant kSecAttrProtocolFTPAccount
593 @constant kSecAttrProtocolHTTP
594 @constant kSecAttrProtocolIRC
595 @constant kSecAttrProtocolNNTP
596 @constant kSecAttrProtocolPOP3
597 @constant kSecAttrProtocolSMTP
598 @constant kSecAttrProtocolSOCKS
599 @constant kSecAttrProtocolIMAP
600 @constant kSecAttrProtocolLDAP
601 @constant kSecAttrProtocolAppleTalk
602 @constant kSecAttrProtocolAFP
603 @constant kSecAttrProtocolTelnet
604 @constant kSecAttrProtocolSSH
605 @constant kSecAttrProtocolFTPS
606 @constant kSecAttrProtocolHTTPS
607 @constant kSecAttrProtocolHTTPProxy
608 @constant kSecAttrProtocolHTTPSProxy
609 @constant kSecAttrProtocolFTPProxy
610 @constant kSecAttrProtocolSMB
611 @constant kSecAttrProtocolRTSP
612 @constant kSecAttrProtocolRTSPProxy
613 @constant kSecAttrProtocolDAAP
614 @constant kSecAttrProtocolEPPC
615 @constant kSecAttrProtocolIPP
616 @constant kSecAttrProtocolNNTPS
617 @constant kSecAttrProtocolLDAPS
618 @constant kSecAttrProtocolTelnetS
619 @constant kSecAttrProtocolIMAPS
620 @constant kSecAttrProtocolIRCS
621 @constant kSecAttrProtocolPOP3S
623 extern const CFStringRef kSecAttrProtocolFTP
624 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
625 extern const CFStringRef kSecAttrProtocolFTPAccount
626 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
627 extern const CFStringRef kSecAttrProtocolHTTP
628 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
629 extern const CFStringRef kSecAttrProtocolIRC
630 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
631 extern const CFStringRef kSecAttrProtocolNNTP
632 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
633 extern const CFStringRef kSecAttrProtocolPOP3
634 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
635 extern const CFStringRef kSecAttrProtocolSMTP
636 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
637 extern const CFStringRef kSecAttrProtocolSOCKS
638 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
639 extern const CFStringRef kSecAttrProtocolIMAP
640 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
641 extern const CFStringRef kSecAttrProtocolLDAP
642 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
643 extern const CFStringRef kSecAttrProtocolAppleTalk
644 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
645 extern const CFStringRef kSecAttrProtocolAFP
646 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
647 extern const CFStringRef kSecAttrProtocolTelnet
648 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
649 extern const CFStringRef kSecAttrProtocolSSH
650 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
651 extern const CFStringRef kSecAttrProtocolFTPS
652 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
653 extern const CFStringRef kSecAttrProtocolHTTPS
654 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
655 extern const CFStringRef kSecAttrProtocolHTTPProxy
656 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
657 extern const CFStringRef kSecAttrProtocolHTTPSProxy
658 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
659 extern const CFStringRef kSecAttrProtocolFTPProxy
660 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
661 extern const CFStringRef kSecAttrProtocolSMB
662 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
663 extern const CFStringRef kSecAttrProtocolRTSP
664 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
665 extern const CFStringRef kSecAttrProtocolRTSPProxy
666 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
667 extern const CFStringRef kSecAttrProtocolDAAP
668 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
669 extern const CFStringRef kSecAttrProtocolEPPC
670 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
671 extern const CFStringRef kSecAttrProtocolIPP
672 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
673 extern const CFStringRef kSecAttrProtocolNNTPS
674 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
675 extern const CFStringRef kSecAttrProtocolLDAPS
676 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
677 extern const CFStringRef kSecAttrProtocolTelnetS
678 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
679 extern const CFStringRef kSecAttrProtocolIMAPS
680 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
681 extern const CFStringRef kSecAttrProtocolIRCS
682 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
683 extern const CFStringRef kSecAttrProtocolPOP3S
684 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
687 @enum kSecAttrAuthenticationType Value Constants
688 @discussion Predefined item attribute constants used to get or set values
689 in a dictionary. The kSecAttrAuthenticationType constant is the key
690 and its value is one of the constants defined here.
691 @constant kSecAttrAuthenticationTypeNTLM
692 @constant kSecAttrAuthenticationTypeMSN
693 @constant kSecAttrAuthenticationTypeDPA
694 @constant kSecAttrAuthenticationTypeRPA
695 @constant kSecAttrAuthenticationTypeHTTPBasic
696 @constant kSecAttrAuthenticationTypeHTTPDigest
697 @constant kSecAttrAuthenticationTypeHTMLForm
698 @constant kSecAttrAuthenticationTypeDefault
700 extern const CFStringRef kSecAttrAuthenticationTypeNTLM
701 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
702 extern const CFStringRef kSecAttrAuthenticationTypeMSN
703 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
704 extern const CFStringRef kSecAttrAuthenticationTypeDPA
705 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
706 extern const CFStringRef kSecAttrAuthenticationTypeRPA
707 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
708 extern const CFStringRef kSecAttrAuthenticationTypeHTTPBasic
709 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
710 extern const CFStringRef kSecAttrAuthenticationTypeHTTPDigest
711 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
712 extern const CFStringRef kSecAttrAuthenticationTypeHTMLForm
713 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
714 extern const CFStringRef kSecAttrAuthenticationTypeDefault
715 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
718 @enum kSecAttrKeyClass Value Constants
719 @discussion Predefined item attribute constants used to get or set values
720 in a dictionary. The kSecAttrKeyClass constant is the key
721 and its value is one of the constants defined here.
722 @constant kSecAttrKeyClassPublic
723 @constant kSecAttrKeyClassPrivate
724 @constant kSecAttrKeyClassSymmetric
726 extern const CFStringRef kSecAttrKeyClassPublic
727 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
728 extern const CFStringRef kSecAttrKeyClassPrivate
729 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
730 extern const CFStringRef kSecAttrKeyClassSymmetric
731 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
734 @enum kSecAttrKeyType Value Constants
735 @discussion Predefined item attribute constants used to get or set values
736 in a dictionary. The kSecAttrKeyType constant is the key
737 and its value is one of the constants defined here.
738 @constant kSecAttrKeyTypeRSA
739 @constant kSecAttrKeyTypeDSA
740 @constant kSecAttrKeyTypeAES
741 @constant kSecAttrKeyType3DES
742 @constant kSecAttrKeyTypeRC4
743 @constant kSecAttrKeyTypeRC2
744 @constant kSecAttrKeyTypeCAST
745 @constant kSecAttrKeyTypeECDSA (deprecated; use kSecAttrKeyTypeEC instead.)
746 @constant kSecAttrKeyTypeEC
747 @constant kSecAttrKeyTypeECSECPrimeRandom
749 extern const CFStringRef kSecAttrKeyTypeRSA
750 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_2_0
);
751 extern const CFStringRef kSecAttrKeyTypeDSA
752 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
753 extern const CFStringRef kSecAttrKeyTypeAES
754 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
755 extern const CFStringRef kSecAttrKeyTypeDES
756 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
757 extern const CFStringRef kSecAttrKeyType3DES
758 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
759 extern const CFStringRef kSecAttrKeyTypeRC4
760 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
761 extern const CFStringRef kSecAttrKeyTypeRC2
762 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
763 extern const CFStringRef kSecAttrKeyTypeCAST
764 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
765 extern const CFStringRef kSecAttrKeyTypeECDSA
766 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
767 extern const CFStringRef kSecAttrKeyTypeEC
768 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
769 extern const CFStringRef kSecAttrKeyTypeECSECPrimeRandom
770 __OSX_AVAILABLE_STARTING(__MAC_10_9
, __IPHONE_4_0
);
773 @enum kSecAttrPRF Value Constants
774 @discussion Predefined item attribute constants used to specify the PRF
775 to use with SecKeyDeriveFromPassword.
776 @constant kSecAttrPRFHmacAlgSHA1
777 @constant kSecAttrPRFHmacAlgSHA224
778 @constant kSecAttrPRFHmacAlgSHA256
779 @constant kSecAttrPRFHmacAlgSHA384
780 @constant kSecAttrPRFHmacAlgSHA512
782 extern const CFStringRef kSecAttrPRFHmacAlgSHA1
783 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
784 extern const CFStringRef kSecAttrPRFHmacAlgSHA224
785 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
786 extern const CFStringRef kSecAttrPRFHmacAlgSHA256
787 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
788 extern const CFStringRef kSecAttrPRFHmacAlgSHA384
789 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
790 extern const CFStringRef kSecAttrPRFHmacAlgSHA512
791 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
794 @enum Search Constants
795 @discussion Predefined search constants used to set values in a query
796 dictionary. You can specify a combination of search attributes and
797 item attributes when looking for matching items with the
798 SecItemCopyMatching function.
799 @constant kSecMatchPolicy Specifies a dictionary key whose value is a
800 SecPolicyRef. If provided, returned certificates or identities must
801 verify with this policy.
802 @constant kSecMatchItemList Specifies a dictionary key whose value is a
803 CFArray of SecKeychainItemRef items. If provided, returned items will be
804 limited to the subset which are contained in this list.
805 @constant kSecMatchSearchList Specifies a dictionary key whose value is a
806 CFArray of SecKeychainRef items. If provided, the search will be limited
807 to the keychains contained in this list.
808 @constant kSecMatchIssuers Specifies a dictionary key whose value is a
809 CFArray of X.500 names (of type CFDataRef). If provided, returned
810 certificates or identities will be limited to those whose
811 certificate chain contains one of the issuers provided in this list.
812 @constant kSecMatchEmailAddressIfPresent Specifies a dictionary key whose
813 value is a CFStringRef containing an RFC822 email address. If
814 provided, returned certificates or identities will be limited to those
815 that contain the address, or do not contain any email address.
816 @constant kSecMatchSubjectContains Specifies a dictionary key whose value
817 is a CFStringRef. If provided, returned certificates or identities
818 will be limited to those containing this string in the subject.
819 @constant kSecMatchSubjectStartsWith Specifies a dictionary key whose value
820 is a CFStringRef. If provided, returned certificates or identities
821 will be limited to those with subject names that start with this string.
822 @constant kSecMatchSubjectEndsWith Specifies a dictionary key whose value
823 is a CFStringRef. If provided, returned certificates or identities
824 will be limited to those with subject names that end with this string.
825 @constant kSecMatchSubjectWholeString Specifies a dictionary key whose
826 value is a CFStringRef. If provided, returned certificates or identities
827 will be limited to those matching this string exactly in the subject.
828 @constant kSecMatchCaseInsensitive Specifies a dictionary key whose value
829 is a CFBooleanRef. If this value is kCFBooleanFalse, or is not
830 provided, then case-sensitive string matching is performed.
831 @constant kSecMatchDiacriticInsensitive Specifies a dictionary key whose
832 value is a CFBooleanRef. If this value is kCFBooleanFalse, or is not
833 provided, then diacritic-sensitive string matching is performed.
834 @constant kSecMatchWidthInsensitive Specifies a dictionary key whose
835 value is a CFBooleanRef. If this value is kCFBooleanFalse, or is not
836 provided, then string matching is width-sensitive (e.g. 'a' != 0xFF41).
837 @constant kSecMatchTrustedOnly Specifies a dictionary key whose value is
838 a CFBooleanRef. If provided with a value of kCFBooleanTrue, only
839 certificates which can be verified back to a trusted anchor will be
840 returned. If this value is kCFBooleanFalse, or is not provided, then
841 both trusted and untrusted certificates may be returned.
842 @constant kSecMatchValidOnDate Specifies a dictionary key whose value is
843 of type CFDateRef. If provided, returned keys, certificates or
844 identities will be limited to those which are valid for the given date.
845 Pass a value of kCFNull to indicate the current date.
846 @constant kSecMatchLimit Specifies a dictionary key whose value is a
847 CFNumberRef. If provided, this value specifies the maximum number of
848 results to return. If not provided, results are limited to the first
849 item found. Predefined values are provided for a single item
850 (kSecMatchLimitOne) and all matching items (kSecMatchLimitAll).
851 @constant kSecMatchLimitOne Specifies that results are limited to the first
852 item found; used as a value for the kSecMatchLimit dictionary key.
853 @constant kSecMatchLimitAll Specifies that an unlimited number of results
854 may be returned; used as a value for the kSecMatchLimit dictionary
857 extern const CFStringRef kSecMatchPolicy
858 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
859 extern const CFStringRef kSecMatchItemList
860 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
861 extern const CFStringRef kSecMatchSearchList
862 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
863 extern const CFStringRef kSecMatchIssuers
864 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
865 extern const CFStringRef kSecMatchEmailAddressIfPresent
866 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
867 extern const CFStringRef kSecMatchSubjectContains
868 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
869 extern const CFStringRef kSecMatchSubjectStartsWith
870 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
871 extern const CFStringRef kSecMatchSubjectEndsWith
872 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
873 extern const CFStringRef kSecMatchSubjectWholeString
874 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
875 extern const CFStringRef kSecMatchCaseInsensitive
876 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
877 extern const CFStringRef kSecMatchDiacriticInsensitive
878 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
879 extern const CFStringRef kSecMatchWidthInsensitive
880 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
881 extern const CFStringRef kSecMatchTrustedOnly
882 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
883 extern const CFStringRef kSecMatchValidOnDate
884 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
885 extern const CFStringRef kSecMatchLimit
886 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
887 extern const CFStringRef kSecMatchLimitOne
888 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
889 extern const CFStringRef kSecMatchLimitAll
890 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
894 @enum Return Type Key Constants
895 @discussion Predefined return type keys used to set values in a dictionary.
896 You use these keys to specify the type of results which should be
897 returned by the SecItemCopyMatching or SecItemAdd function. You can
898 specify zero or more of these return types. If more than one of these
899 result types is specified, the result is returned as a CFDictionaryRef
900 whose keys are the result types and values are the requested data.
901 @constant kSecReturnData Specifies a dictionary key whose value is of type
902 CFBooleanRef. A value of kCFBooleanTrue indicates that the data of
903 an item (CFDataRef) should be returned. For keys and password
904 items, data is secret (encrypted) and may require the user to enter
905 a password for access.
906 @constant kSecReturnAttributes Specifies a dictionary key whose value is
907 of type CFBooleanRef. A value of kCFBooleanTrue indicates that the
908 (non-encrypted) attributes of an item (in a CFDictionaryRef) should be
910 @constant kSecReturnRef Specifies a dictionary key whose value is a
911 CFBooleanRef. A value of kCFBooleanTrue indicates that a reference
912 should be returned. Depending on the item class requested, the
913 returned reference(s) may be of type SecKeychainItemRef, SecKeyRef,
914 SecCertificateRef, or SecIdentityRef.
915 @constant kSecReturnPersistentRef Specifies a dictionary key whose value
916 is of type CFBooleanRef. A value of kCFBooleanTrue indicates that a
917 persistent reference to an item (CFDataRef) should be returned.
919 extern const CFStringRef kSecReturnData
920 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
921 extern const CFStringRef kSecReturnAttributes
922 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
923 extern const CFStringRef kSecReturnRef
924 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
925 extern const CFStringRef kSecReturnPersistentRef
926 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
930 @enum Value Type Key Constants
931 @discussion Predefined value type keys used to pass values in a dictionary.
932 You can specify zero or more of these types depending on the function
933 you are calling. For SecItemCopyMatching or SecItemAdd these are
934 used as keys in the results dictionary.
935 @constant kSecValueData Specifies a dictionary key whose value is of type
936 CFDataRef. For keys and password items, data is secret (encrypted)
937 and may require the user to enter a password for access.
938 @constant kSecValueRef Specifies a dictionary key whose value, depending
939 on the item class requested, is of type SecKeychainItemRef, SecKeyRef,
940 SecCertificateRef, or SecIdentityRef.
941 @constant kSecValuePersistentRef Specifies a dictionary key whose value
942 is of type CFDataRef. The bytes in this CFDataRef can be stored by
943 the caller and used on a subsequent invocation of the application (or
944 even a different application) to retrieve the item referenced by it.
946 extern const CFStringRef kSecValueData
947 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
948 extern const CFStringRef kSecValueRef
949 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
950 extern const CFStringRef kSecValuePersistentRef
951 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
955 @enum Other Constants
956 @discussion Predefined constants used to set values in a dictionary.
957 @constant kSecUseItemList Specifies a dictionary key whose value is a
958 CFArray of items. If provided, this array is treated as the set of
959 all possible items to search, or add if the API being called is
960 SecItemAdd. The items in this array may be of type SecKeyRef,
961 SecCertificateRef, SecIdentityRef, or CFDataRef (for a persistent
962 item reference.) The items in the array must all be of the same
963 type. When this attribute is provided, no keychains are searched.
964 @constant kSecUseKeychain Specifies a dictionary key whose value is a
965 keychain reference. You use this key to specify a value of type
966 SecKeychainRef to which SecItemAdd will add the provided item(s).
967 @constant kSecUseOperationPrompt Specifies a dictionary key whose value
968 is a CFStringRef that represents a user-visible string describing
969 the operation for which the application is attempting to authenticate.
970 The application is responsible for the text localization.
971 @constant kSecUseAuthenticationUI Specifies a dictionary key whose value
972 is one of kSecUseAuthenticationUIAllow, kSecUseAuthenticationUIFail, kSecUseAuthenticationUISkip.
973 @constant kSecUseAuthenticationContext Specifies a dictionary key whose value
974 is LAContext to be used for keychain item authentication.
975 * If the item requires authentication and this key is omitted, a new context
976 will be created just for the purpose of the single call.
977 * If the specified context has been previously authenticated, the operation
978 will succeed without asking user for authentication.
979 * If the specified context has not been previously authenticated, the new
980 authentication will be started on this context, allowing caller to
981 eventually reuse the sucessfully authenticated context in subsequent
984 extern const CFStringRef kSecUseItemList
985 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
986 extern const CFStringRef kSecUseKeychain
987 __OSX_AVAILABLE_STARTING(__MAC_10_7
, __IPHONE_NA
);
988 extern const CFStringRef kSecUseOperationPrompt
989 __OSX_AVAILABLE_STARTING(__MAC_10_10
, __IPHONE_8_0
);
990 extern const CFStringRef kSecUseAuthenticationUI
991 __OSX_AVAILABLE_STARTING(__MAC_10_11
, __IPHONE_9_0
);
992 extern const CFStringRef kSecUseAuthenticationContext
993 __OSX_AVAILABLE_STARTING(__MAC_10_11
, __IPHONE_9_0
);
996 @enum kSecUseAuthenticationUI Value Constants
997 @discussion Predefined item attribute constants used to get or set values
998 in a dictionary. The kSecUseAuthenticationUI constant is the key and its
999 value is one of the constants defined here.
1000 If the key kSecUseAuthenticationUI not provided then kSecUseAuthenticationUIAllow
1002 @constant kSecUseAuthenticationUIAllow Specifies that authenticate UI can appear.
1003 @constant kSecUseAuthenticationUIFail Specifies that the error
1004 errSecInteractionNotAllowed will be returned if an item needs
1005 to authenticate with UI
1006 @constant kSecUseAuthenticationUIAllowSkip Specifies that all items which need
1007 to authenticate with UI will be silently skipped. This value can be used
1008 only with SecItemCopyMatching.
1010 extern const CFStringRef kSecUseAuthenticationUIAllow
1011 __OSX_AVAILABLE_STARTING(__MAC_10_11
, __IPHONE_9_0
);
1012 extern const CFStringRef kSecUseAuthenticationUIFail
1013 __OSX_AVAILABLE_STARTING(__MAC_10_11
, __IPHONE_9_0
);
1014 extern const CFStringRef kSecUseAuthenticationUISkip
1015 __OSX_AVAILABLE_STARTING(__MAC_10_11
, __IPHONE_9_0
);
1017 #if !RC_HIDE_J79 && !RC_HIDE_J80
1019 @enum kSecAttrTokenID Value Constants
1020 @discussion Predefined item attribute constant used to get or set values
1021 in a dictionary. The kSecAttrTokenID constant is the key and its value
1022 can be kSecAttrTokenIDSecureEnclave.
1023 @constant kSecAttrTokenIDSecureEnclave Specifies well-known identifier of the
1024 token implemented using device's Secure Enclave. The only keychain items
1025 supported by the Secure Enclave token are 256-bit elliptic curve keys
1026 (kSecAttrKeyTypeEC). Keys must be generated on the secure enclave using
1027 SecKeyGenerateKeyPair call with kSecAttrTokenID set to
1028 kSecAttrTokenIDSecureEnclave in the parameters dictionary, it is not
1029 possible to import pregenerated keys to kSecAttrTokenIDSecureEnclave token.
1031 extern const CFStringRef kSecAttrTokenIDSecureEnclave
1032 __OSX_AVAILABLE_STARTING(__MAC_10_12
, __IPHONE_9_0
);
1036 @enum kSecAttrAccessGroup Value Constants
1037 @constant kSecAttrAccessGroupToken Represents well-known access group
1038 which contains items provided by external token (typically smart card).
1039 This may be used as a value for kSecAttrAccessGroup attribute. Every
1040 application has access to this access group so it is not needed to
1041 explicitly list it in keychain-access-groups entitlement, but application
1042 must explicitly state this access group in keychain queries in order to
1043 be able to access items from external tokens.
1045 extern const CFStringRef kSecAttrAccessGroupToken
1046 __OSX_AVAILABLE_STARTING(__MAC_10_12
, __IPHONE_10_0
);
1049 @function SecItemCopyMatching
1050 @abstract Returns one or more items which match a search query.
1051 @param query A dictionary containing an item class specification and
1052 optional attributes for controlling the search. See the "Keychain
1053 Search Attributes" section for a description of currently defined
1055 @param result On return, a CFTypeRef reference to the found item(s). The
1056 exact type of the result is based on the search attributes supplied
1057 in the query, as discussed below.
1058 @result A result code. See "Security Error Codes" (SecBase.h).
1059 @discussion Attributes defining a search are specified by adding key/value
1060 pairs to the query dictionary.
1062 A typical query consists of:
1064 * a kSecClass key, whose value is a constant from the Class
1065 Constants section that specifies the class of item(s) to be searched
1066 * one or more keys from the "Attribute Key Constants" section, whose value
1067 is the attribute data to be matched
1068 * one or more keys from the "Search Constants" section, whose value is
1069 used to further refine the search
1070 * a key from the "Return Type Key Constants" section, specifying the type of
1073 Result types are specified as follows:
1075 * To obtain the data of a matching item (CFDataRef), specify
1076 kSecReturnData with a value of kCFBooleanTrue.
1077 * To obtain the attributes of a matching item (CFDictionaryRef), specify
1078 kSecReturnAttributes with a value of kCFBooleanTrue.
1079 * To obtain a reference to a matching item (SecKeychainItemRef,
1080 SecKeyRef, SecCertificateRef, or SecIdentityRef), specify kSecReturnRef
1081 with a value of kCFBooleanTrue.
1082 * To obtain a persistent reference to a matching item (CFDataRef),
1083 specify kSecReturnPersistentRef with a value of kCFBooleanTrue. Note
1084 that unlike normal references, a persistent reference may be stored
1085 on disk or passed between processes.
1086 * If more than one of these result types is specified, the result is
1087 returned as a CFDictionaryRef containing all the requested data.
1089 By default, this function returns only the first match found. To obtain
1090 more than one matching item at a time, specify kSecMatchLimit with a value
1091 greater than 1. The result will be a CFArrayRef containing up to that
1092 number of matching items; the items' types are described above.
1094 To filter a provided list of items down to those matching the query,
1095 specify a kSecMatchItemList whose value is a CFArray of SecKeychainItemRef,
1096 SecKeyRef, SecCertificateRef, or SecIdentityRef items. The objects in the
1097 provided array must be of the same type.
1099 To convert from persistent item references to normal item references,
1100 specify a kSecMatchItemList whose value is a CFArray containing one or
1101 more CFDataRef elements (the persistent reference), and a kSecReturnRef
1102 whose value is kCFBooleanTrue. The objects in the provided array must be
1105 OSStatus
SecItemCopyMatching(CFDictionaryRef query
, CFTypeRef
* __nullable CF_RETURNS_RETAINED result
)
1106 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
1109 @function SecItemAdd
1110 @abstract Add one or more items to a keychain.
1111 @param attributes A dictionary containing an item class specification and
1112 optional entries specifying the item's attribute values. See the
1113 "Attribute Key Constants" section for a description of currently defined
1115 @param result On return, a CFTypeRef reference to the newly added item(s).
1116 The exact type of the result is based on the values supplied
1117 in attributes, as discussed below. Pass NULL if this result is not
1119 @result A result code. See "Security Error Codes" (SecBase.h).
1120 @discussion Attributes defining an item are specified by adding key/value
1121 pairs to the attributes dictionary. To add multiple items to a keychain
1122 at once use the kSecUseItemList key with an array of items as its value.
1123 This is currently only supported for non password items. To add an item
1124 to a particular keychain, supply kSecUseKeychain with a SecKeychainRef as
1127 Result types are specified as follows:
1129 * To obtain the data of the added item (CFDataRef), specify
1130 kSecReturnData with a value of kCFBooleanTrue.
1131 * To obtain all the attributes of the added item (CFDictionaryRef),
1132 specify kSecReturnAttributes with a value of kCFBooleanTrue.
1133 * To obtain a reference to the added item (SecKeychainItemRef, SecKeyRef,
1134 SecCertificateRef, or SecIdentityRef), specify kSecReturnRef with a
1135 value of kCFBooleanTrue. This is the default behavior if a result
1136 type is not explicitly specified.
1137 * To obtain a persistent reference to the added item (CFDataRef), specify
1138 kSecReturnPersistentRef with a value of kCFBooleanTrue. Note that
1139 unlike normal references, a persistent reference may be stored on disk
1140 or passed between processes.
1141 * If more than one of these result types is specified, the result is
1142 returned as a CFDictionaryRef containing all the requested data.
1144 OSStatus
SecItemAdd(CFDictionaryRef attributes
, CFTypeRef
* __nullable CF_RETURNS_RETAINED result
)
1145 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
1148 @function SecItemUpdate
1149 @abstract Modify zero or more items which match a search query.
1150 @param query A dictionary containing an item class specification and
1151 optional attributes for controlling the search. See the "Attribute
1152 Constants" and "Search Constants" sections for a description of
1153 currently defined search attributes.
1154 @param attributesToUpdate A dictionary containing one or more attributes
1155 whose values should be set to the ones specified. Only real keychain
1156 attributes are permitted in this dictionary (no "meta" attributes are
1157 allowed.) See the "Attribute Key Constants" section for a description of
1158 currently defined value attributes.
1159 @result A result code. See "Security Error Codes" (SecBase.h).
1160 @discussion Attributes defining a search are specified by adding key/value
1161 pairs to the query dictionary.
1163 OSStatus
SecItemUpdate(CFDictionaryRef query
, CFDictionaryRef attributesToUpdate
)
1164 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
1167 @function SecItemDelete
1168 @abstract Delete zero or more items which match a search query.
1169 @param query A dictionary containing an item class specification and
1170 optional attributes for controlling the search. See the "Attribute
1171 Constants" and "Search Constants" sections for a description of
1172 currently defined search attributes.
1173 @result A result code. See "Security Error Codes" (SecBase.h).
1174 @discussion Attributes defining a search are specified by adding key/value
1175 pairs to the query dictionary.
1177 By default, this function deletes all items matching the specified query.
1178 You can change this behavior by specifying one of the follow keys:
1180 * To delete an item identified by a transient reference, specify
1181 kSecMatchItemList with a reference returned by using the kSecReturnRef
1182 key in a previous call to SecItemCopyMatching or SecItemAdd.
1183 * To delete an item identified by a persistent reference, specify
1184 kSecMatchItemList with a persistent reference returned by using the
1185 kSecReturnPersistentRef key to SecItemCopyMatching or SecItemAdd.
1186 * If more than one of these result keys is specified, the behavior is
1189 OSStatus
SecItemDelete(CFDictionaryRef query
)
1190 __OSX_AVAILABLE_STARTING(__MAC_10_6
, __IPHONE_2_0
);
1192 CF_IMPLICIT_BRIDGING_DISABLED
1193 CF_ASSUME_NONNULL_END
1195 #if defined(__cplusplus)
1199 #endif /* !_SECURITY_SECITEM_H_ */
projects / apple / security.git / blob