GoKawiilI recently encountered an issue with the login keychain on macOS. For those not familiar with the login keychain, it’s a keychain that macOS automatically creates for each user account on a Mac. The password for a user’s login keychain matches the password used to log in to the Mac. It is stored as an encrypted database file and unlocks automatically when the user logs in, since the login password and keychain password are the same by default.
As of macOS Tahoe, the login keychain is a SQLite database file named login.keychain-db. It is stored in the user’s home folder in the following directory:
/Users/username_goes_here/Library/Keychains
Historically, you could copy the login keychain file from one Mac to another and be able to open it on the destination Mac by providing the password to that keychain. As of macOS Tahoe, this does not appear to work for Macs which use Secure Enclave. For those Macs, only having the password to the login keychain is no longer sufficient for reasons discussed in the Keychain data protection section of Apple’s Platform Security documentation:
Keychain items are encrypted using two different AES-256-GCM keys: a table key (metadata) and a per-row key (secret key). Keychain metadata (all attributes other than kSecValue) is encrypted with the metadata key to speed searches, and the secret value (kSecValueData) is encrypted with the secret key. The metadata key is protected by the Secure Enclave but is cached in the Application Processor to allow fast queries of the keychain. The secret key always requires a round trip through the Secure Enclave.
For more details, please see below the jump.
The relevant section of the passage above is this:
The metadata key is protected by the Secure Enclave but is cached in the Application Processor to allow fast queries of the keychain. The secret key always requires a round trip through the Secure Enclave.
From that, it appears that unlocking the login keychain requires more than the password because the keys it unlocks are tied to the Secure Enclave of the Mac where the keychain was created. With the decryption keys stored in the source Mac’s Secure Enclave, manually copying the keychain to another Mac and then unlocking it won’t work. The password you have for the keychain may be correct, but the actual keys needed to decrypt its contents won’t be available on the destination Mac.
I was able to test this by copying a login.keychain-db file from an Apple Silicon Mac to a second Mac (in this case, a macOS virtual machine) and attempted to unlock it using the account’s correct password.
... continue reading