The manual page for /usr/bin/security on OS X 10.9 indicates that there is a -x option for security import to specify that private keys are non-extractable after being imported.
How is this implemented? Are the private keys imported through such means really become completely non-extractable, or is there still a way to get a hold of them through some kind of memory dump?
How do applications still use such keys for their crypto?
I've tried using https://github.com/torsten/keychain_access, with the following patch,
- fprintf(stderr, "Export error: %ld\n", status);
+ fprintf(stderr, "Export error: %ld: %s\n", status, CFStringGetCStringPtr(SecCopyErrorMessageString(status, NULL), kCFStringEncodingUTF8));
but I'm getting the following error when trying to export the private key,
Export error: 4294941980: The contents of this item cannot be retrieved.
Is there some other way to get a hold of the non-extractable key?
