4 releases
0.1.1 | Dec 10, 2018 |
---|---|
0.1.0 | Nov 6, 2018 |
0.0.2 | Nov 1, 2018 |
0.0.1 | Oct 31, 2018 |
#2085 in Cryptography
Used in passkit
135KB
2K
SLoC
Keychain Services for Rust 🔐
Rust binding for macOS Keychain Services, including TouchID-guarded access to cryptographic keys stored in the Secure Enclave Processor (SEP).
This binding aims to provide a thin wrapper using largely the same type names as Keychain Services itself, but also provide a safe, mostly idiomatic API which does not rely on e.g. Core Foundation types.
NOTE: This is an unofficial binding which is in no way affiliated with Apple!
Status
This crate is experimental and may have bugs/memory safety issues. USE AT YOUR OWN RISK!
Below is a rough outline of the Keychain Service API and what is supported by this crate:
- Keychains (
SecKeychain
)- Creating keychains
- Deleting keychains
- Open keychain (
SecKeychainOpen
) - Keychain status (
SecKeychainGetStatus
) - Keychain version (
SecKeychainGetVersion
) - Set default keychain (
SecKeychainSetDefault
)
- Keychain Items (
SecKeychainItem
)- Creating keychain items
- Fetching keychain items
- Getting keychain item attributes
- Deleting keychain items
- Certificates / Identities (
SecCertificate
)- Creating certificates
- Deleting certificates
- Querying certificates
- Signing certificates
- Cryptographic keys (
SecKey
)- Generating cryptographic keys
- Importing cryptographic keys
- Exporting cryptographic keys
- Deleting cryptographic keys
- Querying cryptographic keys
- Querying cryptographic key attributes
- Digital signatures (ECDSA/RSA)
- Encryption
- Passwords
- Creating passwords
- Querying passwords
- Deleting passwords
Tests
This crate has two suites of tests:
- Core:
cargo test
- run a minimal set of tests (e.g. in CI) that work everywhere, but don't cover all functionality. - Interactive:
cargo test --features=interactive-tests --no-run
compile tests which require user interactions, and additionally must be signed by macOS's code signing in order to work. See code signing notes.
Code Signing
The Keychain Service API requires signed code to access much of its
functionality. Accessing many APIs from an unsigned app will return
an ErrorKind::MissingEntitlement
.
Follow the instructions here to create a self-signed code signing certificate: https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html
You will need to use the codesign command-line utility (or XCode) to sign your code before it will be able to access most Keychain Services API functionality.
License
Licensed under either of
- Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you shall be dual licensed as above, without any additional terms or conditions.
Dependencies
~2MB
~48K SLoC