Question: how should I use the `keychainAccessible` attribute? about securedefaults

[vpeschenkov]

Hi @cwhenderson20, actually, it's quite a tricky question. I'm not even sure if it's a good idea to set anything else other than kSecAttrAccessibleAlways to that property 🙂. I remember that it hasn't been possible to modify any key in Keychain since it was created. So to update a key, it must be removed first (e.g., here or here). The solution the is to clear old AES & AESIV keys every time you need to change the Keychain accessibility level. However, it means that all data will be lost when the accessibility level is changed. Does that sound good to you @cwhenderson20, I mean the data loss?

So, I think we can consider the following approach as a fix :

public var password: String? {
    didSet {
         let AESKey = suitename != nil ? "\(Keys.AESKey)-\(suitename!)" : Keys.AESKey
         let AESIVKey = suitename != nil ? "\(Keys.AESIV)-\(suitename!)" : Keys.AESIV
         let clearKeychain = { (AESIVKey: String, AESKey: String, accessible: String) in
             KeychainHelper.remove(forKey: AESIVKey, accessible: accessible)
             KeychainHelper.remove(forKey: AESKey, accessible: accessible)
         }
         clearKeychain(AESIVKey, AESKey, keychainAccessible)
         clearKeychain(AESIVKey, AESKey, kSecAttrAccessibleWhenUnlocked as String)
         clearKeychain(AESIVKey, AESKey, kSecAttrAccessibleAfterFirstUnlock as String)
         clearKeychain(AESIVKey, AESKey, kSecAttrAccessibleAlways as String)
         clearKeychain(AESIVKey, AESKey, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly as String)
         clearKeychain(AESIVKey, AESKey, kSecAttrAccessibleWhenUnlockedThisDeviceOnly as String)
         clearKeychain(AESIVKey, AESKey, kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly as String)
         clearKeychain(AESIVKey, AESKey, kSecAttrAccessibleAlwaysThisDeviceOnly as String)
    }
}

Both ways (before & after defaults.isKeyCreated) seem to work fine then:

let defaults = SecureDefaults()
if !defaults.isKeyCreated {
    defaults.password = UUID().uuidString
}
defaults.keychainAccessible = kSecAttrAccessibleAlwaysThisDeviceOnly as String

and

let defaults = SecureDefaults()
if !defaults.isKeyCreated {
    defaults.password = UUID().uuidString
}
defaults.keychainAccessible = kSecAttrAccessibleAlwaysThisDeviceOnly as String

I made a PR with those changes #16. Could you please test it and let me know if it works for you and answers your question?