Generating key pair in iOS using SecKeyGeneratePair failed with errSecInteractionNotAllowed

Question

In my app I am using SecKeyGeneratePair to generate RSA key pair. After releasing the app, I started to notice occasional errSecInteractionNotAllowed errors (currently very rare) when using this function, so far only on iOS 10 devices. It is unclear to me why the key pair generation failed, or what I should do to fix that. Also, I could not find any documentation as to why key pair generation should fail with this error.

This is the code I used to generate the key pair:

guard let access = SecAccessControlCreateWithFlags(nil,
                                                       kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
                                                       [],
                                                       nil) else {throw Error(description: "Failed to create access control")}

    let privateAttributes = [String(kSecAttrIsPermanent): true,
                             String(kSecAttrApplicationTag): keyTag + self.privateKeyExtension,
                             String(kSecAttrAccessControl): access] as [String : Any]
    let publicAttributes = [String(kSecAttrIsPermanent): true,
                            String(kSecAttrApplicationTag): keyTag + self.publicKeyExtension] as [String : Any]

    let pairAttributes = [String(kSecAttrKeyType): kSecAttrKeyTypeRSA,
                          String(kSecAttrKeySizeInBits): self.rsaKeySize,
                          String(kSecPublicKeyAttrs): publicAttributes,
                          String(kSecPrivateKeyAttrs): privateAttributes] as [String : Any]
    var pubKey, privKey: SecKey?
    let status = SecKeyGeneratePair(pairAttributes as CFDictionary, &pubKey, &privKey)

After this code, I am checking the status, and if it is not errSecSuccess, I am logging an error with the status returned from the function. This is where I noticed the errSecInteractionNotAllowed error. So, why does key pair generation or what I could do in order to fix it?

Thanks,

Omer

Answer 1

After discussing this with Apple Developer Support, here is the solution:

 let privateAttributes = [String(kSecAttrIsPermanent): true,
                                 String(kSecAttrApplicationTag): keyTag + self.privateKeyExtension,
                                 String(kSecAttrAccessible): kSecAttrAccessibleAlways] as [String : Any]
        let publicAttributes = [String(kSecAttrIsPermanent): true,
                                String(kSecAttrApplicationTag): keyTag + self.publicKeyExtension,
                                String(kSecAttrAccessible): kSecAttrAccessibleAlways] as [String : Any]

        let pairAttributes = [String(kSecAttrKeyType): kSecAttrKeyTypeRSA,
                              String(kSecAttrKeySizeInBits): self.rsaKeySize,
                              String(kSecPublicKeyAttrs): publicAttributes,
                              String(kSecPrivateKeyAttrs): privateAttributes] as [String : Any]
        var pubKey, privKey: SecKey?
        let status = SecKeyGeneratePair(pairAttributes as CFDictionary, &pubKey, &privKey)

The important part is the kSecAttrAccessible, choose the value that matches your needs from this list. Notice that some of the values will limit the access to the key in KeyVault.

Answer 2

Two suggestions:

1. Try to add an other protection class like kSecAttrAccessibleAlways to your call of SecAccessControlCreateWithFlags and test if the behavior still occurs.
2. Further define a flag for your use case instead of passing an empty array. E.g. userPresence.

Additionally I stumbled across this SO post, maybe you can find some inspiration there.