2

I'm successfully using security to fetch keys from my Keychain via their label, e.g.:

security find-generic-password -l "PDF Encryption"

However, I'm trying to build a UI that offers me a CHOICE of keys to decrypt. Specifically, I'm only interested in the keys that I MANUALLY ADDED via Keychain Access. These show the Kind: Application Password when viewed in Keychain Access:

enter image description here

Unfortunately, I can't seem to come up with any command/filter/search to come up with this list. When I specifically call one out via label, or use dump keychain, I see the following data for each key:

keychain: "/Users/jay/Library/Keychains/vault.keychain-db"
version: 512
class: "genp"
attributes:
    0x00000007 <blob>="PDF Encryption"
    0x00000008 <blob>=<NULL>
    "acct"<blob>="PDF Encryption"
    "cdat"<timedate>=0x32303137313030323032333433385A00  "20171002023438Z\000"
    "crtr"<uint32>=<NULL>
    "cusi"<sint32>=<NULL>
    "desc"<blob>=<NULL>
    "gena"<blob>=<NULL>
    "icmt"<blob>=<NULL>
    "invi"<sint32>=<NULL>
    "mdat"<timedate>=0x32303137313030323032333433385A00  "20171002023438Z\000"
    "nega"<sint32>=<NULL>
    "prot"<blob>=<NULL>
    "scrp"<sint32>=<NULL>
    "svce"<blob>="PDF Encryption"
    "type"<uint32>=<NULL>

Unfortunately, it looks like every bit of data except for account and service are set to NULL. But, I don't seem to be able to search via NULL.

Is there any direct way to get a list of these keys?

  • excuse me for asking, but how often you do that so you need a UI for it – Ruskes Oct 22 '18 at 2:46
  • Preview doesn't natively use the keychain for opening PDFs, and never will for creating them, and Macs without Touch ID can't store their iCloud Notes password in keychain, so probably on average of 10+ times a day for those two apps alone. – jaydisc Oct 22 '18 at 22:42
2

It looks like the answer here is as close as I can get, which is to use dump-keychain and filter by 0x00000007:

security dump-keychain | awk -F= '/0x00000007/ {print $2}'

It includes more than just Application Passwords, but it's definitely a more workable subset, and I can filter out a blacklist with grep -v.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .