MacOS – Decrypting Login Keychain encrypted with smartcard

authenticationkeychainmacos

I set up login with smartcard (actually a yubikey, but over
PKCS#11/PIV).

I restarted and logged in with my smartcard+pin instead
of with my password, and I was prompted to give my old password to
update my keychain. I foolishly entered my current password
confusedly.

I then rebooted again and was asked for my current keychain password
as it wasn't the password I entered on boot (apparently). I tried both
my current and previous passwords and neither work. I suspect it's
been set to something based on my smartcard encrypting something, but
I have no idea what and can't find it online.

Not only do I not have access to my keychain now, but I'm constantly
prompted for my keychain password.

Suggestions as to how to figure out my current keychain password? or
to induce logging in with smartcard/PIN instead of password so it
magically works?

Best Answer

If you performed your initial login and profile setup using your "smartcard" then your login keychain password will be your PIN.

If you find this is not the case (& no passwords you enter work either), you may just have to trash your login keychain by deleting the login.keychain & login.keychain-db files from ~/Library/Keychains, restarting, logging in again with your "smartcard" & PIN to create a new login keychain, the password for which will then be the same as your PIN.

Related Solutions

How is the System Keychain secured in OS X

The system keychain is stored in /Library/Keychains/System.keychain and the key to unlock it is stored in /var/db/SystemKey (its default file permissions are readable by root only). The location of these files is referenced in the security-checksystem script (from the security_systemkeychain source). It is even possible to test to automatic locking/unlocking of the system keychain by using

systemkeychain -vt

The keychain security framework allows non-privileged programs to make requests for information provided they are in the ACL stored within the keychain entry. Obviously if a user has root they on a system they can directly access both the file storing the system keychain and the key to unlock it, thus they do not have make requests via the security framework and are not beholden to the ACLs stored within the keychain itself.

(I didn't actually answer the original questions so let's give this another go)

How are the keys architected such that any administrative user can unlock the System Keychain?

The libsecurity keychain framework allows regular processes to interact with the system keychain in an authenticated manner using Apple's XPC interprocess communication framework (IPC).

Program A sends a request to access the system keychain information using IPC. A check is made that the requesting user is already in the wheel group and also knows the password of a user in the wheel group. Once authorization is confirmed, the privileged kcproxy daemon can be used to access material in /var/db/SystemKey, unlock the system keychain and return the requested information.

Are there cryptographic restrictions that limit what an administrative user can do with information in the System Keychain in any way?

No - an administrative user is allowed to access/change anything in the system keychain. Even if they couldn't, they could copy the underlying files to another machine on which they have complete control and just unlock/access it there.

Given an unencrypted system backup without /Users, how would you gain access to the keys in the System Keychain?

If the backup contained copies of /Library/Keychains/System.keychain and /var/db/SystemKey then I would copy them to their respective locations on a new OS X system and use systemkeychain to make the later unlock the former and dump the keychain database using security dump-keychain.

MacOS – Keychain Access is empty

I was also running into the same issue for a very long time and stumbled upon this post which explains the same problem. At last, I got it working today.

Here's how I got it to work:

Open "Keychain Access" application
Everything will be empty
Go to View -> Sort By -> Keychain (By default, it will be sorted by Name)

After you do this first sort, every entry in the keychain will start showing up magically. You can later change the sort order to anything.

I got the clue from Console logs:

4/22/14 11:36:19.792 PM Keychain Access[1575]: * -[KeychainStore _keyKeychainItemsByKeyOrItemClass:itemClass:attributes:]: Ignoring exception * -[NSMutableArray sortUsingFunction:context:]: function pointer cannot be NULL

Try it!

Best Answer

Related Solutions

How is the System Keychain secured in OS X

MacOS – Keychain Access is empty

Related Question