I'm trying to extract a non-extractable private key as a
.p12 file from
Keychain Access.app or
/usr/bin/security on Mac OS X 10.9.4.
Basically, it appears that
security import has a
-x option to specify that
private keys are non-extractable after being imported.
As per above, this is implemented by explicitly omitting
CSSM_KEYATTR_EXTRACTABLE during the import. Subsequently, when trying to export, the key without such an attribute cannot be exported.
I could find at least two relevant mentions which appear to prevent such keys from being exported (hint: use
fgrep -OR to avoid following the symbolic links when searching through Apple source code):
I've tried keychain_access from github.com/torsten, but it didn't work.
I've tried using lldb,
lldb -- security export -t identities -f pkcs12 -o /tmp/mycerts.p12, to break on SecWrappedKeys.cpp::impExpWrappedKeyOpenSslExport(), but that doesn't seem to work, either, with
break impExpWrappedKeyOpenSslExport giving out an error
invalid command 'breakpoint impExpWrappedKeyOpenSslExport'.
I've tried DTrace to trace Cisco AnyConnect, but I'm not familiar enough with DTrace for it to reveal the datastructures.
I've tried re-compiling the Security and SecurityTool packages, but they all appear to require bootstrapping that does not appear to be in place.
How do I get the private key?