Jump to content

Keychain (software): Difference between revisions

From Wikipedia, the free encyclopedia
Content deleted Content added
m Reverting possible vandalism by 124.122.91.214 to version by Serols. Report False Positive? Thanks, ClueBot NG. (4071547) (Bot)
Citation bot (talk | contribs)
Removed parameters. | Use this bot. Report bugs. | Suggested by Abductive | Category:Authentication | #UCB_Category 11/12
 
(32 intermediate revisions by 26 users not shown)
Line 1: Line 1:
{{Short description|Password management system in macOS}}
{{Multiple issues|
{{Multiple issues|
{{More citations needed|date=July 2013}}
{{More citations needed|date=July 2013}}
Line 22: Line 23:
| logo = [[Image:Keychain Access Icon.png|75px]]
| logo = [[Image:Keychain Access Icon.png|75px]]
| screenshot = [[Image:keychainaccess.png|220px]]
| screenshot = [[Image:keychainaccess.png|220px]]
| caption = Screenshot of Keychain Access on [[Mac OS X Leopard|Mac OS X 10.5]].
| caption = Screenshot of Keychain Access on [[macOS Monterey|macOS 12]].
| developer = [[Apple Inc.]]
| developer = [[Apple Inc.]]
| latest_release_version = 10.5 (55237.200.14)
| latest_release_version = 11.0 (55314)
| latest_release_date = August 21, 2018
| latest_release_date = 2022
| latest_preview_version =
| latest_preview_version =
| latest_preview_date =
| latest_preview_date =
Line 35: Line 36:


'''Keychain''' is the [[Password manager|password management system]] in [[macOS]], developed by [[Apple Inc.|Apple]]. It was introduced with [[Mac OS 8|Mac OS 8.6]], and has been included in all subsequent versions of the operating system, now known as macOS. A Keychain can contain various types of data: [[password]]s (for [[website]]s, [[File transfer protocol|FTP servers]], [[Secure shell|SSH]] accounts, [[network share]]s, [[wireless network]]s, [[groupware|groupware applications]], [[encryption|encrypted]] [[disk image]]s), [[public-key cryptography|private key]]s, [[public key certificate|certificate]]s, and secure notes.
'''Keychain''' is the [[Password manager|password management system]] in [[macOS]], developed by [[Apple Inc.|Apple]]. It was introduced with [[Mac OS 8|Mac OS 8.6]], and has been included in all subsequent versions of the operating system, now known as macOS. A Keychain can contain various types of data: [[password]]s (for [[website]]s, [[File transfer protocol|FTP servers]], [[Secure shell|SSH]] accounts, [[network share]]s, [[wireless network]]s, [[groupware|groupware applications]], [[encryption|encrypted]] [[disk image]]s), [[public-key cryptography|private key]]s, [[public key certificate|certificate]]s, and secure notes.

==History==
Keychains were initially developed for Apple's e-mail system, [[Apple Open Collaboration Environment|PowerTalk]], in the early 1990s. Among its many features, PowerTalk used [[Plug-in (computing)|plug-ins]] that allowed mail to be retrieved from a wide variety of mail servers and online services. The keychain concept naturally "fell out" of this code, and was used in PowerTalk to manage all of a user's various login credentials for the various e-mail systems PowerTalk could connect to.

The passwords were not easily retrievable due to the encryption, yet the simplicity of the interface allowed the user to select a different password for every system without fear of forgetting them, as a single password would open the file and return them all. At the time, implementations of this concept were not available on other platforms. Keychain was one of the few parts of PowerTalk that was obviously useful "on its own", which suggested it should be promoted to become a part of the basic Mac OS. But due to internal politics, it was kept inside the PowerTalk system and, therefore, available to very few Mac users.{{citation needed | date = March 2015}}

It was not until the return of [[Steve Jobs]] in 1997 that Keychain concept was revived from the now-discontinued PowerTalk. By this point in time the concept was no longer so unusual, but it was still rare to see a keychain system that was not associated with a particular piece of application software, typically a [[web browser]]. Keychain was later made a standard part of Mac OS 9, and was included in [[macOS|Mac OS X]] in the first commercial versions.


==Storage and access{{anchor|Keychain_Access}}==
==Storage and access{{anchor|Keychain_Access}}==
In macOS, keychain files are stored in <tt>~/Library/Keychains/</tt> (and subdirectories), <tt>/Library/Keychains/</tt>, and <tt>/Network/Library/Keychains/</tt>, and the Keychain Access GUI application is located in the Utilities folder in the Applications folder.<ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.5/en/9066.html |title=Mac OS X 10.5 Help - Changing your keychain password |publisher=Docs.info.apple.com |archive-url=https://web.archive.org/web/20120531093508/http://docs.info.apple.com/article.html?path=Mac%2F10.5%2Fen%2F9066.html |archive-date=May 31, 2012 |access-date=2016-03-28 |url-status=dead }}</ref><ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.4/en/mh463.html |title=Mac OS X 10.4 Help - Changing your keychain password |publisher=Docs.info.apple.com |archive-url=https://web.archive.org/web/20120531093615/http://docs.info.apple.com/article.html?path=Mac%2F10.4%2Fen%2Fmh463.html |archive-date=May 31, 2012 |access-date=2016-03-28 |url-status=dead }}</ref> It is [[Free software|free]], [[Open-source software|open source]] software released under the terms of the [[Apple Public Source License|APSL-2.0]].<ref name=":0">{{cite web|author=Apple Inc. |url=https://opensource.apple.com/source/libsecurity_keychain/libsecurity_keychain-27723/ |title=Source Browser |publisher=opensource.apple.com |access-date=February 26, 2012}}</ref> The command line equivalent of Keychain Access is <tt>/usr/bin/security</tt>.
In macOS, keychain files are stored in <code>~/Library/Keychains/</code> (and subdirectories), <code>/Library/Keychains/</code>, and <code>/Network/Library/Keychains/</code>, and the Keychain Access GUI application is located in the Utilities folder in the Applications folder.<ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.5/en/9066.html |title=Mac OS X 10.5 Help - Changing your keychain password |publisher=Docs.info.apple.com |archive-url=https://web.archive.org/web/20120531093508/http://docs.info.apple.com/article.html?path=Mac%2F10.5%2Fen%2F9066.html |archive-date=May 31, 2012 |access-date=2016-03-28 |url-status=dead }}</ref><ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.4/en/mh463.html |title=Mac OS X 10.4 Help - Changing your keychain password |publisher=Docs.info.apple.com |archive-url=https://web.archive.org/web/20120531093615/http://docs.info.apple.com/article.html?path=Mac%2F10.4%2Fen%2Fmh463.html |archive-date=May 31, 2012 |access-date=2016-03-28 |url-status=dead }}</ref> It is [[Free software|free]], [[Open-source software|open source]] software released under the terms of the [[Apple Public Source License|APSL-2.0]].<ref name=":0">{{cite web|author=Apple Inc. |url=https://opensource.apple.com/source/libsecurity_keychain/libsecurity_keychain-27723/ |title=Source Browser |publisher=opensource.apple.com |access-date=February 26, 2012}}</ref> The command line equivalent of Keychain Access is <code>/usr/bin/security</code>.


The keychain database is encrypted per-table and per-row with [[Galois/Counter Mode|AES-256-GCM]]. The time at which each credential is decrypted, how long it will remain decrypted, and whether the encrypted credential will be synced to iCloud varies depending on the type of data stored, and is documented on the Apple support website.<ref>{{cite web
The keychain file(s) stores a variety of data fields including a title, URL, notes and password. Only the passwords and Secure Notes are encrypted, with [[Triple DES]].<ref>{{cite web
| url=https://images.apple.com/macosx/security/docs/MacOSX_Security_TB.pdf
| url=https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web
| title=Keychain data protection
| title=Mac OS X Security: Keeping safety simple.
| work=Technology Brief
| publisher=[[Apple Inc.]]
| publisher=[[Apple Inc.]]
| archive-url=https://web.archive.org/web/20110410065128/https://images.apple.com/macosx/security/docs/MacOSX_Security_TB.pdf
| archive-url=https://web.archive.org/web/20211220080716/https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web
| archive-date=2011-04-10
| archive-date=2021-12-20
| date=2009-08-20
| date=2021-05-17
| access-date=2018-07-30}}</ref>
| access-date=2021-12-20}}</ref>


==Locking and unlocking==
==Locking and unlocking==
The default keychain file is the <tt>login</tt> keychain, typically unlocked on login by the user's login password, although the password for this keychain can instead be different from a user's login password, adding security at the expense of some convenience.<ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.5/en/9066.html |title=Mac OS X 10.5 Help: Changing your keychain password |publisher=Docs.info.apple.com |access-date=February 26, 2012 |archive-url=https://web.archive.org/web/20110613180425/http://docs.info.apple.com/article.html?path=Mac%2F10.5%2Fen%2F9066.html |archive-date=June 13, 2011 |url-status=dead }}</ref> The Keychain Access application does not permit setting an empty password on a keychain.
The default keychain file is the <code>login</code> keychain, typically unlocked on login by the user's login password, although the password for this keychain can instead be different from a user's login password, adding security at the expense of some convenience.<ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.5/en/9066.html |title=Mac OS X 10.5 Help: Changing your keychain password |publisher=Docs.info.apple.com |access-date=February 26, 2012 |archive-url=https://web.archive.org/web/20110613180425/http://docs.info.apple.com/article.html?path=Mac%2F10.5%2Fen%2F9066.html |archive-date=June 13, 2011 |url-status=dead }}</ref> The Keychain Access application does not permit setting an empty password on a keychain.


The keychain may be set to be automatically "locked" if the computer has been idle for a time,<ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.4/en/mh848.html |title=Mac OS X 10.4 Help: Locking and unlocking your keychain |archive-url=https://web.archive.org/web/20110613180521/http://docs.info.apple.com/article.html?path=Mac%2F10.4%2Fen%2Fmh848.html |archive-date=June 13, 2011 |publisher=Docs.info.apple.com |access-date=February 26, 2012 |url-status=dead }}</ref> and can be locked manually from the Keychain Access application. When locked, the password has to be re-entered next time the keychain is accessed, to unlock it. Overwriting the file in <tt>~/Library/Keychains/</tt> with a new one (e.g. as part of a restore operation) also causes the keychain to lock and a password is required at next access.
The keychain may be set to be automatically "locked" if the computer has been idle for a time,<ref>{{cite web|url=http://docs.info.apple.com/article.html?path=Mac/10.4/en/mh848.html |title=Mac OS X 10.4 Help: Locking and unlocking your keychain |archive-url=https://web.archive.org/web/20110613180521/http://docs.info.apple.com/article.html?path=Mac%2F10.4%2Fen%2Fmh848.html |archive-date=June 13, 2011 |publisher=Docs.info.apple.com |access-date=February 26, 2012 |url-status=dead }}</ref> and can be locked manually from the Keychain Access application. When locked, the password has to be re-entered next time the keychain is accessed, to unlock it. Overwriting the file in <code>~/Library/Keychains/</code> with a new one (e.g. as part of a restore operation) also causes the keychain to lock and a password is required at next access.


==Password synchronization==
==Password synchronization==
If the login keychain is protected by the login password, then the keychain's password will be changed whenever the login password is changed from within a logged in session on macOS. On a shared Mac/non-Mac network, it is possible for the login keychain's password to lose synchronization if the user's login password is changed from a non-Mac system. Also, if the password is changed from a directory service like Active Directory or Open Directory, or if the password is changed from another admin account e.g. using the System Preferences. Some network administrators react to this by deleting the keychain file on logout, so that a new one will be created next time the user logs in. This means keychain passwords will not be remembered from one session to the next, even if the login password has not been changed. If this happens, the user can restore the keychain file in <tt>~/Library/Keychains/</tt> from a backup, but doing so will lock the keychain which will then need to be unlocked at next use.
If the login keychain is protected by the login password, then the keychain's password will be changed whenever the login password is changed from within a logged-in session on macOS. On a shared Mac/non-Mac network, it is possible for the login keychain's password to lose synchronization if the user's login password is changed from a non-Mac system. Also, if the password is changed from a directory service like Active Directory or Open Directory, or if the password is changed from another admin account e.g. using the System Preferences. Some network administrators react to this by deleting the keychain file on logout, so that a new one will be created next time the user logs in. This means keychain passwords will not be remembered from one session to the next, even if the login password has not been changed. If this happens, the user can restore the keychain file in <code>~/Library/Keychains/</code> from a backup, but doing so will lock the keychain, which will then need to be unlocked at next use.


==Third-party software for keychain synchronization==
==History==
There was a 3rd party software application developed, that enabled synchronization of personal keychains generated using keychain access in [[macOS|Mac OS X]], these standard keychain access - generated users keychains could then be synchronised between devices (iPhones - desktop Apple computers), using a pair of keychain synchronization apps developed by Patrick Stein of Jinx Software, one for [[macOS|Mac OS X]] and another for iOS called Keychain2Go. Keychain2Go could not be successfully updated by the developer to account for restrictions that Apple made to Keychain and access to Keychain in [[macOS|Mac OS X]] Sierra 10.12.<ref>{{cite web |last1=Stein |first1=Patrick |title=Keychain2go keychain synhcronisation software |url=https://www.jinx.de/Keychain2Go.html |website=Jinx Software |access-date=22 March 2023}}</ref>
Keychains were initially developed for Apple's e-mail system, [[Apple Open Collaboration Environment|PowerTalk]], in the early 1990s. Among its many features, PowerTalk used [[Plug-in (computing)|plug-ins]] that allowed mail to be retrieved from a wide variety of mail servers and online services. The keychain concept naturally "fell out" of this code, and was used in PowerTalk to manage all of a user's various login credentials for the various e-mail systems PowerTalk could connect to.

The passwords were not easily retrievable due to the encryption, yet the simplicity of the interface allowed the user to select a different password for every system without fear of forgetting them, as a single password would open the file and return them all. At the time, implementations of this concept were not available on other platforms. Keychain was one of the few parts of PowerTalk that was obviously useful "on its own", which suggested it should be promoted to become a part of the basic Mac OS. But due to internal politics, it was kept inside the PowerTalk system and, therefore, available to very few Mac users.{{citation needed | date = March 2015}}

It was not until the return of [[Steve Jobs]] in 1997 that Keychain concept was revived from the now-discontinued PowerTalk. By this point in time the concept was no longer so unusual, but it was still rare to see a keychain system that was not associated with a particular piece of application software, typically a [[web browser]]. Keychain was later made a standard part of Mac OS 9, and was included in [[macOS|Mac OS X]] in the first commercial versions.


==Security==
==Security==
Line 69: Line 72:
As Mac users’ default storage for sensitive information, Keychain is a prime target for security attacks.
As Mac users’ default storage for sensitive information, Keychain is a prime target for security attacks.


In 2019, 18-year-old German security researcher Linus Henze demonstrated his hack, dubbed KeySteal, that grabs passwords from the Keychain. Initially he withheld details of the hack, demanding Apple set up a bug bounty for macOS. Apple had however not done so when Henze subsequently revealed the hack. It utilized Safari's access to security services, disguised as a utility in macOS that enables IT administrators to manipulate keychains.<ref>{{Cite web |last=Newman |first=Lily Hay |date=June 1, 2019 |title=The Tricky Shenanigans Behind a Stealthy Apple Keychain Attack |url=https://www.wired.com/story/keysteal-apple-keychain-attack-shenanigans/ |access-date=2021-07-09 |website=[[Wired (magazine)]]}}</ref>
In 2019, 18-year-old German security researcher Linus Henze demonstrated his hack, dubbed KeySteal, that grabs passwords from the Keychain. Initially, he withheld details of the hack, demanding Apple set up a bug bounty for macOS. Apple had however not done so when Henze subsequently revealed the hack. It utilized Safari's access to security services, disguised as a utility in macOS that enables IT administrators to manipulate keychains.<ref>{{Cite magazine |last=Newman |first=Lily Hay |date=June 1, 2019 |title=The Tricky Shenanigans Behind a Stealthy Apple Keychain Attack |url=https://www.wired.com/story/keysteal-apple-keychain-attack-shenanigans/ |access-date=2021-07-09 |magazine=[[Wired (magazine)|Wired]]}}</ref>


==See also==
==See also==
Line 87: Line 90:
{{DEFAULTSORT:Keychain}}
{{DEFAULTSORT:Keychain}}
[[Category:MacOS security technology]]
[[Category:MacOS security technology]]
[[Category:PIM-software for MacOS]]
[[Category:Personal information manager software for macOS]]
[[Category:Free password managers]]
[[Category:Free password managers]]
[[Category:Software using the Apple Public Source License]]
[[Category:Software using the Apple Public Source License]]
[[Category:Authentication]]

Latest revision as of 13:51, 13 September 2024

Keychain
Developer(s)Apple Inc.
Initial release1999
Operating systemMac OS 9, macOS
Typesystem utility
LicenseAPSL-2.0
WebsiteKeychain Services
Keychain Access
Developer(s)Apple Inc.
Stable release
11.0 (55314) / 2022
Operating systemMac OS 9, macOS
Typepassword manager
WebsiteKeychain Access Help

Keychain is the password management system in macOS, developed by Apple. It was introduced with Mac OS 8.6, and has been included in all subsequent versions of the operating system, now known as macOS. A Keychain can contain various types of data: passwords (for websites, FTP servers, SSH accounts, network shares, wireless networks, groupware applications, encrypted disk images), private keys, certificates, and secure notes.

History

[edit]

Keychains were initially developed for Apple's e-mail system, PowerTalk, in the early 1990s. Among its many features, PowerTalk used plug-ins that allowed mail to be retrieved from a wide variety of mail servers and online services. The keychain concept naturally "fell out" of this code, and was used in PowerTalk to manage all of a user's various login credentials for the various e-mail systems PowerTalk could connect to.

The passwords were not easily retrievable due to the encryption, yet the simplicity of the interface allowed the user to select a different password for every system without fear of forgetting them, as a single password would open the file and return them all. At the time, implementations of this concept were not available on other platforms. Keychain was one of the few parts of PowerTalk that was obviously useful "on its own", which suggested it should be promoted to become a part of the basic Mac OS. But due to internal politics, it was kept inside the PowerTalk system and, therefore, available to very few Mac users.[citation needed]

It was not until the return of Steve Jobs in 1997 that Keychain concept was revived from the now-discontinued PowerTalk. By this point in time the concept was no longer so unusual, but it was still rare to see a keychain system that was not associated with a particular piece of application software, typically a web browser. Keychain was later made a standard part of Mac OS 9, and was included in Mac OS X in the first commercial versions.

Storage and access

[edit]

In macOS, keychain files are stored in ~/Library/Keychains/ (and subdirectories), /Library/Keychains/, and /Network/Library/Keychains/, and the Keychain Access GUI application is located in the Utilities folder in the Applications folder.[1][2] It is free, open source software released under the terms of the APSL-2.0.[3] The command line equivalent of Keychain Access is /usr/bin/security.

The keychain database is encrypted per-table and per-row with AES-256-GCM. The time at which each credential is decrypted, how long it will remain decrypted, and whether the encrypted credential will be synced to iCloud varies depending on the type of data stored, and is documented on the Apple support website.[4]

Locking and unlocking

[edit]

The default keychain file is the login keychain, typically unlocked on login by the user's login password, although the password for this keychain can instead be different from a user's login password, adding security at the expense of some convenience.[5] The Keychain Access application does not permit setting an empty password on a keychain.

The keychain may be set to be automatically "locked" if the computer has been idle for a time,[6] and can be locked manually from the Keychain Access application. When locked, the password has to be re-entered next time the keychain is accessed, to unlock it. Overwriting the file in ~/Library/Keychains/ with a new one (e.g. as part of a restore operation) also causes the keychain to lock and a password is required at next access.

Password synchronization

[edit]

If the login keychain is protected by the login password, then the keychain's password will be changed whenever the login password is changed from within a logged-in session on macOS. On a shared Mac/non-Mac network, it is possible for the login keychain's password to lose synchronization if the user's login password is changed from a non-Mac system. Also, if the password is changed from a directory service like Active Directory or Open Directory, or if the password is changed from another admin account e.g. using the System Preferences. Some network administrators react to this by deleting the keychain file on logout, so that a new one will be created next time the user logs in. This means keychain passwords will not be remembered from one session to the next, even if the login password has not been changed. If this happens, the user can restore the keychain file in ~/Library/Keychains/ from a backup, but doing so will lock the keychain, which will then need to be unlocked at next use.

Third-party software for keychain synchronization

[edit]

There was a 3rd party software application developed, that enabled synchronization of personal keychains generated using keychain access in Mac OS X, these standard keychain access - generated users keychains could then be synchronised between devices (iPhones - desktop Apple computers), using a pair of keychain synchronization apps developed by Patrick Stein of Jinx Software, one for Mac OS X and another for iOS called Keychain2Go. Keychain2Go could not be successfully updated by the developer to account for restrictions that Apple made to Keychain and access to Keychain in Mac OS X Sierra 10.12.[7]

Security

[edit]

Keychain is distributed with both iOS and macOS. The iOS version is simpler because applications that run on mobile devices typically need only very basic Keychain features. For example, features such as ACLs (Access Control Lists) and sharing Keychain items between different apps are not present. Thus, iOS Keychain items are only accessible to the app that created them.

As Mac users’ default storage for sensitive information, Keychain is a prime target for security attacks.

In 2019, 18-year-old German security researcher Linus Henze demonstrated his hack, dubbed KeySteal, that grabs passwords from the Keychain. Initially, he withheld details of the hack, demanding Apple set up a bug bounty for macOS. Apple had however not done so when Henze subsequently revealed the hack. It utilized Safari's access to security services, disguised as a utility in macOS that enables IT administrators to manipulate keychains.[8]

See also

[edit]

References

[edit]
  1. ^ "Mac OS X 10.5 Help - Changing your keychain password". Docs.info.apple.com. Archived from the original on May 31, 2012. Retrieved March 28, 2016.
  2. ^ "Mac OS X 10.4 Help - Changing your keychain password". Docs.info.apple.com. Archived from the original on May 31, 2012. Retrieved March 28, 2016.
  3. ^ Apple Inc. "Source Browser". opensource.apple.com. Retrieved February 26, 2012.
  4. ^ "Keychain data protection". Apple Inc. May 17, 2021. Archived from the original on December 20, 2021. Retrieved December 20, 2021.
  5. ^ "Mac OS X 10.5 Help: Changing your keychain password". Docs.info.apple.com. Archived from the original on June 13, 2011. Retrieved February 26, 2012.
  6. ^ "Mac OS X 10.4 Help: Locking and unlocking your keychain". Docs.info.apple.com. Archived from the original on June 13, 2011. Retrieved February 26, 2012.
  7. ^ Stein, Patrick. "Keychain2go keychain synhcronisation software". Jinx Software. Retrieved March 22, 2023.
  8. ^ Newman, Lily Hay (June 1, 2019). "The Tricky Shenanigans Behind a Stealthy Apple Keychain Attack". Wired. Retrieved July 9, 2021.