如何从存储在iOS钥匙串中的密钥中获取DER格式的公钥？

Question

我正在使用以下代码创建密钥：

let tag = "com.example.keys.mykey".data(using: .utf8)!
let attributes: [String: Any] =
[kSecAttrKeyType as String:            kSecAttrKeyTypeECSECPrimeRandom,
 kSecAttrKeySizeInBits as String:      256,
 kSecPrivateKeyAttrs as String:
    [kSecAttrIsPermanent as String:    true,
     kSecAttrApplicationTag as String: tag]]
guard let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {
throw error!.takeRetainedValue() as Error}

使用以下步骤获取公钥：

let publicKey = SecKeyCopyPublicKey(privateKey)

- Gokul

Answer 1

 func addDerKeyInfo(rawPublicKey:[UInt8]) -> [UInt8] {
    let DerHdrSubjPubKeyInfo:[UInt8]=[
        /* Ref: RFC 5480 - SubjectPublicKeyInfo's ASN encoded header */
        0x30, 0x59, /* SEQUENCE */
        0x30, 0x13, /* SEQUENCE */
        0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, /* oid: 1.2.840.10045.2.1   */
        0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, /* oid: 1.2.840.10045.3.1.7 */
        0x03, 0x42, /* BITSTRING */
        0x00 /* unused number of bits in bitstring, followed by raw public-key bits */]
    let derKeyInfo = DerHdrSubjPubKeyInfo + rawPublicKey
    return derKeyInfo
}

func convertbase64StringToByteArray(base64String: String) -> [UInt8] {
    if let nsdata = NSData(base64Encoded: base64String, options: NSData.Base64DecodingOptions.ignoreUnknownCharacters)  {
        var bytes = [UInt8](repeating: 0, count: nsdata.length)
        nsdata.getBytes(&bytes,length: nsdata.length)
        return bytes
    }
    else
    {
        print("Invalid base64 String")
    }
}
func convertSecKeyToDerKeyFormat(publicKey:SecKey) throws -> String
{
    do
    {
        if let externalRepresentationOfPublicKey = SecKeyCopyExternalRepresentation(publicKey,&error)
        {
            let derKeyFormat = externalRepresentationOfPublicKey as Data
            var publicKeyByteArray = try convertbase64StringToByteArray(base64String: derKeyFormat.base64EncodedString())
            publicKeyByteArray =  addDerKeyInfo(rawPublicKey: publicKeyByteArray)
            let base64EncodedPublicKey:String=Data(publicKeyByteArray).base64EncodedString()
            return base64EncodedPublicKey
        }
        else
        {
            throw error as! Error
        }
    }
    catch
    {
        throw error
    }
}

通过将公钥传递给convertSecKeyToDerKeyFormat函数来调用该函数。

- Gokul

---

非常感谢！这节省了我很多时间。不幸的是，苹果只支持 ASN.1 在 Mac 机器上，而不支持 IOS。 - Sergey Brazhnik

Answer 2

一些信息供其他人参考，以获取最新的信息。 从iOS 13+开始，您可以使用Security和CryptoKit框架的组合。

正如苹果文档所示，您现在可以使用CryptoKit框架，该框架具有默认情况下可以转换为DER、RAW、PEM或紧凑形式的密钥。

https://developer.apple.com/documentation/cryptokit/storing_cryptokit_keys_in_the_keychain

本页面介绍了如何初始化密钥并将其存储为SecKey在钥匙串中，然后以加密方式检索它们。

- Jerrin