KeyChain詳解

keychain 是一個相對獨立的空間，保存到keychain鑰匙串中的信息不會因為卸載/重裝app而丟失, 。相對于NSUserDefaults、plist文件保存等一般方式，keychain保存更為安全。所以我們會用keyChain保存一些私密信息，比如密碼、證書、設(shè)備唯一碼（把獲取到用戶設(shè)備的唯一ID 存到keychain 里面這樣卸載或重裝之后還可以獲取到id，保證了一個設(shè)備一個ID）等等。keychain是用SQLite進行存儲的。用蘋果的話來說是一個專業(yè)的數(shù)據(jù)庫，加密我們保存的數(shù)據(jù)，可以通過metadata（attributes）進行高效的搜索。keychain適合保存一些比較小的數(shù)據(jù)量的數(shù)據(jù)，如果要保存大的數(shù)據(jù)，可以考慮文件的形式存儲在磁盤上，在keychain里面保存解密這個文件的密鑰

接下來記錄下平時用到的基本方法

存儲數(shù)據(jù)

+ (BOOL)saveValue:(NSString *)value key:(NSString *)key group:(NSString *)group service:(NSString *)service
{
    NSMutableDictionary *keychainQuery = [self getKeychainQuery:key withAccessGroup:group withService:service];

    NSMutableDictionary *query = nil;
    OSStatus status;
    status = SecItemCopyMatching((__bridge CFDictionaryRef)keychainQuery, nil);
    if (status == errSecSuccess) {
        query = [[NSMutableDictionary alloc]init];
        [query setObject:[NSKeyedArchiver archivedDataWithRootObject:value] forKey:(__bridge id)kSecValueData];
        
        status = SecItemUpdate((__bridge CFDictionaryRef)(keychainQuery), (__bridge CFDictionaryRef)(query));
    }else if(status == errSecItemNotFound)
    {
        [keychainQuery setObject:[NSKeyedArchiver archivedDataWithRootObject:value] forKey:(__bridge id)kSecValueData];
        status = SecItemAdd((__bridge CFDictionaryRef)keychainQuery, NULL);
    }
    
    return (status == errSecSuccess);
}

刪除數(shù)據(jù)

+ (BOOL)deleteWithkey:(NSString *)key group:(NSString *)group service:(NSString *)service
{
    NSMutableDictionary *query = [self getKeychainQuery:key withAccessGroup:group withService:service];
    OSStatus status = SecItemDelete((__bridge CFDictionaryRef)query);
    return (status == errSecSuccess);
}

讀取數(shù)據(jù)

+ (id)loadWithkey:(NSString *)key group:(NSString *)group service:(NSString *)service
{
    CFTypeRef result = NULL;
    NSMutableDictionary *query = [self getKeychainQuery:key withAccessGroup:group withService:service];
    [query setObject:@YES forKey:(__bridge id)kSecReturnData];
    [query setObject:(__bridge id)kSecMatchLimitOne forKey:(__bridge id)kSecMatchLimit];
    id value;
    if (SecItemCopyMatching((__bridge CFDictionaryRef)query, &result) == noErr) {
        @try {
            value = [NSKeyedUnarchiver unarchiveObjectWithData:(__bridge NSData *)result];
        }
        @catch (NSException *e) {
            NSLog(@"Unarchive of %@ failed: %@", key, e);
            value = nil;
        }
        @finally {}
    }
    if (result) {
        CFRelease(result);
    }
    return value;
}

默認數(shù)據(jù)

+ (NSMutableDictionary *)getKeychainQuery:(NSString *)key withAccessGroup:(NSString *)group withService:(NSString *)service
{
    NSMutableDictionary *keychainQuery = [NSMutableDictionary dictionary];
    [keychainQuery setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id)kSecClass];
    [keychainQuery setValue:service forKey:(__bridge id)kSecAttrService];
    [keychainQuery setValue:key forKey:(__bridge id)kSecAttrAccount];
    [keychainQuery setValue:(__bridge id)kSecAttrAccessibleWhenUnlocked forKey:(__bridge id)kSecAttrAccessible];
    [keychainQuery setValue:group forKey:(__bridge id)kSecAttrAccessGroup];
    return keychainQuery;
}

note:每個group命名開頭必須是開發(fā)者賬號的teamId。不同開發(fā)者賬號的teamId是唯一的，所以蘋果限制了只有同一個開發(fā)者賬號下的應(yīng)用才可以進行共享。如果有多個sharedGroup，在添加的時候如果不指定，默認是第一個group。