如果仅在设备上设置了设备代码，IOS将无法创建私钥？

Question

我正在尝试生成仅当使用设备代码或当前使用的生物特征识别集（已在设备上注册）时才可访问的私钥。

当我在设备上注册了手指时，它就可以工作，然后一切都很好。但是，如果我删除注册的“ touchid-finger”，并尝试生成新密钥，则返回nil

错误代码为-25293

代码示例：

func generateKey() -> SecKey?{
    var error: Unmanaged<CFError>?
    let accessControl = SecAccessControlCreateWithFlags(
            kCFAllocatorDefault,
            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
            [.devicePasscode,.or,.biometryCurrentSet],
            nil)

    let attributes:[String : Any] = [kSecAttrType as String: kSecAttrKeyTypeRSA,
    kSecAttrKeySizeInBits as String:4096,
    kSecPrivateKeyAttrs as String: [
      kSecAttrIsPermanent:true,
      kSecAttrCanSign: true,
      kSecAttrApplicationTag: "yes.its.my.tag",
      kSecAttrAccessControl:accessControl!]]
      let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error)
     if(error != nil || privateKey == nil) {
      fatalError("explode Kittens")
     }
     return privateKey
}

fyi。它实际上在模拟器上起作用，但在实际设备上不起作用。

我做错什么了吗？这按预期工作吗？是虫子吗？ （很多问题：D）

Answer 1

我正在生成一个私钥，您需要在ACL对象参数中添加kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly。这将使您可以使用密码或生物识别数据来获取私钥。

    guard let aclObject = SecAccessControlCreateWithFlags(
        kCFAllocatorDefault, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
        [.userPresence, .privateKeyUsage], nil) else {
        return ""
    }
    // private key parameters
    let privateKeyParams: [String: AnyObject] = [
        kSecAttrAccessControl as String:    aclObject as AnyObject, //protect with touch id
        kSecAttrIsPermanent as String:      true as AnyObject
        ]

    // global parameters for our key generation
    let parameters: [String: AnyObject] = [
        kSecAttrTokenID as String:          kSecAttrTokenIDSecureEnclave,
        kSecAttrKeyType as String:          kSecMessECCKeyType,
        kSecAttrKeySizeInBits as String:    kSecMessECCKeySize as AnyObject,
        kSecAttrLabel as String:            kSecMessECCSignLabel as AnyObject,
        kSecPrivateKeyAttrs as String:      privateKeyParams as AnyObject
    ]

    guard let eCCPrivKey = SecKeyCreateRandomKey(parameters as CFDictionary, nil) else {
        print("ECC KeyGen Error!")
        return ""
    }

    guard let eCCPubKey = SecKeyCopyPublicKey(eCCPrivKey) else {
        print("ECC Pub KeyGen Error")
        return ""
    }