Is there a way to modify keychain item ACL descriptions?

Question

I'm importing my digital ID (X.509 certificate and private key for signing, verifying, encrypting, and decrypting messages) into the keychain. In the GUI I see my certificate and the corresponding key and I can modify their descriptions and can write a note describing their usage, etc.

However, when Mail.app tries to get access to the private key it displays a dialog window saying 'Mail wants to use your confidential information stored in "privateKey" in your keychain.'.

Now, I have multiple digital IDs for different addresses, so that message doesn't give me any idea which key it tries to access. I investigated a bit and it turned out that when you import a key an ACL list is also created inside the keychain. Each item in that ACL list has an optional description. I believe that when there is no description defined it the mentioned dialog will use key's description, but if there is an ACL description it will be used instead.

When I dump my keychain with "security dump-keychain -a" I'm getting the following:

keychain: "/Users/galaxy/Library/Keychains/login.keychain"
class: 0x00000010
attributes:
    0x00000000 <uint32>=0x00000010
    0x00000001 <blob>=0x646[...]00  "galaxy@domain.tld\000"
    0x00000002 <blob>=<NULL>
[...]
    0x0000001A <uint32>=0x00000001
access: 3 entries
    entry 0:
        authorizations (1): encrypt
        don't-require-password
        description: privateKey
        applications: <null>
    entry 1:
        authorizations (6): decrypt derive export_clear export_wrapped mac sign
        don't-require-password
        description: privateKey
        applications (0):
    entry 2:
        authorizations (1): change_acl
        don't-require-password
        description: privateKey
        applications (0):

First of all, I want to change the description from "privateKey" to "galaxy@domain.tld (Encryption)" for ACL entry 0. I searched a lot, but so far I found only references to OS X API to do so. Is there a tool to do that? If there is no such tool, how can I set it up at the time of the import? I'm asking since when StartSSL automatically forces Safari to import the digital ID the ACL description is set to 'www.startssl.com', so I know that it's possible to set it up.

Finally, a bonus question is there is a tool or a way to customise ACLs? For example I want to drop export_* from entry 1's ACL (I've also seen that done by StartSSL with their digital IDs).

UPDATE: Since Apple has released their Keychain Access GUI as Open Source I checked the sources for the PKCS#12 import and there they do have an option to set the description and ACLs up at the time of the import. However, I never coded anything for OS X and it hard to figure out what condition should be met to get the description of ACLs and ACLs themselves right at the time of the import. The logic is located in the Security package in pkcs12Crypto.cpp:

[galaxy@home:~/xcode/Security-55471.14.18/libsecurity_pkcs12/lib]$ grep -B5 -A5 '"privateKey"' pkcs12Crypto.cpp
        try {
            CssmClient::KeyAclBearer bearer(
                cspHand, *privKey, Allocator::standard());
            SecPointer<KeychainCore::Access> initialAccess(access ?
                KeychainCore::Access::required(access) :        /* caller-supplied */
                new KeychainCore::Access("privateKey"));        /* default */
            initialAccess->setAccess(bearer, maker);
        }
        catch (const CssmError &e) {
            /* not implemented means we're talking to the CSP which does
             * not implement ACLs */

Unfortunately in all my import attempts I'm still hitting that hardcoded "privateKey" description and when I have, say, 5 different digital IDs they all request access with "privateKey" in the dialog and it's confusing.

Answer 1

After quite a tedious research it seems that there is no easy way to edit the description of the private key, so basically unless Apple enhances their Keychain Access application there is no way to distinguish between multiple digital IDs imported into the same key chain.

It also looks like Google Chrome (and Chromium) have implemented some key management routines and are managing the descriptions of imported private keys. However, I didn't figure out exactly how to leverage this functionality yet.

Anyway, the short answer to my question: there is no way to modify item's ACL and/or their descriptions in OS X keychain at the moment and it seems that nobody really cares.

Answer 2

By chance I stumbled on to a fix (of sorts) for the problem of "privateKey" being displayed in the mail dialogs and confusing a ...

way to distinguish between multiple digital IDs imported into the same key chain.

This is not such an elegant solution and I don't understand why it works, but after much testing, in multiple mail clients, under both OS X 10.10.3 and 10.10.4, I have found that it does work, it's easy, and it works every time. In a nutshell, you basically just drag the digital IDs to a new keychain and then turn around and drag them back.

Helpful details and lessons learned are as follows:

• Applicable to digital IDs in the login keychain. Other keychains not tested.
• Using an existing system keychain as the intermediary didn't work.
• New keychains require a password of at least six characters but of any strength.
• Beware passwords for new keychains are not saved on any other keychain!
• Default Lock Settings for new keychains are an annoying 5 minutes and Sleep.
• On drag (or paste) of ID, Private Key Access Control faults to Allow all applications access to this item. Manually go in and change it back to Confirm before allowing access.
• Just leaving the IDs in the new keychain and using them there may not be practical since new keychains don't unlock on login.
• On delete the new keychain best to select the non-default option Delete References & Files.
• Subsequent edits of private key name require another "fix" to effect the changes.