I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4.
Basically, it appears that security import has a -x option to specify that private keys are non-extractable after being importedsecurity import has a -x option to specify that private keys are non-extractable after being imported.
- http://opensource.apple.com/source/SecurityTool/SecurityTool-55115/keychain_import.c
- http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecImportExport.h
As per above, this is implemented by explicitly omitting CSSM_KEYATTR_EXTRACTABLE during the import. Subsequently, when trying to export, the key without such an attribute cannot be exported.
I could find at least two relevant mentions which appear to prevent such keys from being exported (hint: use fgrep -OR to avoid following the symbolic links when searching through Apple source code):
- http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecImportExportCrypto.cpp
- http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_pkcs12/lib/pkcs12Crypto.cpp
I've tried keychain_access from github.com/torsten, but it didn't work.
I've tried using lldb, lldb -- security export -t identities -f pkcs12 -o /tmp/mycerts.p12, to break on SecWrappedKeys.cpp::impExpWrappedKeyOpenSslExport(), but that doesn't seem to work, either, with break impExpWrappedKeyOpenSslExport giving out an error invalid command 'breakpoint impExpWrappedKeyOpenSslExport'.
I've tried DTraceI've tried DTrace to trace Cisco AnyConnect, but I'm not familiar enough with DTrace for it to reveal the datastructures.
I've tried re-compilingI've tried re-compiling the Security and SecurityTool packages, but they all appear to require bootstrapping that does not appear to be in place.
How do I get the private key?
