SecAccessControlCreateFlags missing touchIDAny/biometryAny flag ?
- Dominant language
- Swift
- Stars
- 6.9k
- Forks
- 746
- PR merge metrics
- No merged PRs in 30d
Description
I'm not sure if you would classify this as a feature request or a bug, but I've put it down as a bug as its (potentially) quite an important security flag missing from `SecAccessControlCreateFlags`.
I'm no iOS developer, but I was interested to see blinksh implements secure enclave storage of keys, and so I wanted to check how this was actually implemented.
My understanding of the code is that the magic happens on [Line 65 of SEKey.swift](https://github.com/blinksh/blink/blob/695ff79a2207f348923f4a07fe1bb67d870ad0d9/BlinkConfig/SEKey.swift#L65).
I also note this from [the Apple dev docs](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave) (my highlighting of the second phrase of the paragraph):
> You could also combine the [privateKeyUsage](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1617983-privatekeyusage) flag with other flags, using a bitwise OR to obtain additional protection for your key. **_For example, if you include the [touchIDAny](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1617988-touchidany) flag, you instruct the system to make the key available only when the system can authenticate the user with Touch ID (or a fallback passcode)_**. See [SecAccessControlCreateFlags](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags) for the complete list of available flags.
However, searching the `blinksh` code for `touchIDAny` (or indeed `biometryAny` since the `touchIDAny` form seems to be [deprecated](https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1617988-touchidany)) yields no results.
I would have thought it was somewhat important that `blinksh` required touchID/biometry before using a key ? (Or at the very least give the user the option to mandate it).
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at BlinkConfig/SEKey.swift line 65 and compare the current SecAccessControlCreateFlags usage with Apple's Secure Enclave and biometry documentation. Determine whether biometryAny or touchIDAny should protect the key, or be offered as a user option; done means the intended security behavior and implementation scope are clear.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- authentication, mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100