Can someone tell me the applications requirements for using the secure enclave on MacOS? Does the application need to be signed with the secure-enclave entitlement in order to use it? Since this is a restricted entitlement, does my App ID need approval to use it from Apple?
Currently I'm building in XCode 16 on Sequoia (15.5) using developer signing. My application is a C/C++ daemon running as plist out of /Library/LaunchDaemons. I have also built it as an application using the instructions here but this has not lead to a solution:
https://developer.apple.com/documentation/xcode/signing-a-daemon-with-a-restricted-entitlement/
When I run my application from the command line via sudo signed but without the secure-enclave entitlement enabled in my entitlements file it runs. The first call to:
SecAccessControlRef access = SecAccessControlCreateWithFlags(
kCFAllocatorDefault,
kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
kSecAccessControlPrivateKeyUsage,
&error);
succeeds without error. The call to create the key using:
SecKeyRef privateKey = SecKeyCreateRandomKey(attributes, &error);
then fails with error:
(OSStatus error -50 - Failed to generate keypair)
Here are the setup attributes (keySize = 256):
CFDictionarySetValue(attributes, kSecAttrKeyType, kSecAttrKeyTypeECSECPrimeRandom);
CFDictionarySetValue(attributes, kSecAttrKeySizeInBits, keySize);
CFDictionarySetValue(attributes, kSecAttrLabel, keyName);
CFDictionarySetValue(attributes, kSecAttrApplicationTag, keyLabel);
CFDictionarySetValue(attributes, kSecAttrTokenID, kSecAttrTokenIDSecureEnclave); // Store in the Secure Enclave
CFDictionarySetValue(attributes, kSecAttrKeyClass, kSecAttrKeyClassPrivate);
CFDictionarySetValue(attributes, kSecAttrAccessControl, access);
CFDictionarySetValue(attributes, kSecAttrIsPermanent, kCFBooleanTrue); // persist key across app restarts and reboots
CFDictionarySetValue(attributes, kSecAttrCanEncrypt, kCFBooleanTrue);
CFDictionarySetValue(attributes, kSecAttrCanDecrypt, kCFBooleanTrue);
CFDictionarySetValue(attributes, kSecAttrAccessible, kSecAttrAccessibleWhenUnlockedThisDeviceOnly);
CFDictionarySetValue(attributes, kSecReturnPersistentRef, kCFBooleanTrue);
When I run the application signed and include the "com.apple.developer.secure-enclave" in my entitlements file it crashes at startup. I believe this is to be expected based on above.
How do I proceed such that my application can use the secure enclave correctly?
