The manual page for /usr/bin/security on OS X 10.9 indicates that there is a -x option for security import to specify that private keys are non-extractable after being imported.

How is this implemented? Are the private keys imported through such means really become completely non-extractable, or is there still a way to get a hold of them through some kind of memory dump?

How do applications still use such keys for their crypto?

I've tried using https://github.com/torsten/keychain_access, with the following patch,

-    fprintf(stderr, "Export error: %ld\n", status);
+    fprintf(stderr, "Export error: %ld: %s\n", status, CFStringGetCStringPtr(SecCopyErrorMessageString(status, NULL), kCFStringEncodingUTF8));

but I'm getting the following error when trying to export the private key,

Export error: 4294941980: The contents of this item cannot be retrieved.

Is there some other way to get a hold of the non-extractable key?


You must log in to answer this question.

Browse other questions tagged .