Keychain Accessibility Hardening

Overview

Keychain Accessibility Hardening automatically strengthens the security posture of all keychain items stored by your application. It enforces device-only storage policies and removes cloud synchronization flags, reducing the attack surface for credential theft across multiple vectors.

When enabled, all keychain operations (adding or updating items) are transparently hardened to prevent:

• Cross-device synchronization of sensitive credentials via iCloud Keychain
• Backup restoration of keychain items to unauthorized devices
• Lock-state vulnerabilities where items are accessible when the device is locked

This is a prevention control that operates transparently at runtime without requiring code changes in your application.

How It Works

When your app writes to the keychain (using SecItemAdd or SecItemUpdate), the control automatically:

1. Rewrites accessibility class — Converts accessibility attributes to their device-only equivalents:

• Items that would be accessible when unlocked → restricted to unlocked state, device-only
• Items that would be accessible after first unlock → restricted to after first unlock, device-only
• Background-accessible items → preserved for background compatibility but still device-only

1. Strips iCloud synchronization — Removes kSecAttrSynchronizable=true flags to prevent credentials from being synced to iCloud Keychain

1. Preserves secure storage — Items using Secure Enclave or biometric-protected access controls pass through unchanged (already maximally secure)

The hardening happens automatically for all keychain operations. Your application code requires no changes.

Threats Mitigated

How to Enable the Control

Navigate to Preventative Controls from the AppTego portal, and expand the Data at Rest Protection section. Under this section you will find the Keychain Accessibility Hardening control. Click Enable to enable it for the next build or for it to be applied with a live push (if enabled).

API Configuration Example

{
  "KeychainAccessibilityPrevention": {
    "protection": true
  }
}

Configuration

{
  "protection": true,
  "migrate_existing": false
}

Parameters

Existing Items Migration

By default, only new keychain items written after enabling the control are hardened. Pre-existing items remain unchanged.

Set "migrate_existing": true to trigger a one-time background migration that:

• Scans all keychain items in the app's default access group
• Updates accessibility classes to device-only variants
• Removes synchronization flags
• Skips Secure Enclave items and items with biometric access controls

Important: Migration is a one-time operation (tracked by NSUserDefaults flag). Subsequent launches skip migration even if you toggle the control off and back on. Migration runs asynchronously and does not block app launch.

Caution: If your app uses shared keychain access groups or stores keychain items that are intentionally meant to sync across devices, carefully test migration behavior in a staging environment first.

Defaults

When your application does not specify an accessibility class for a keychain item, this control uses:

• kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly as the default

This preserves compatibility with background URL sessions, background app refresh, and other background tasks that may need to read keychain items before the user unlocks the device.

If your application explicitly requests foreground-only access, the control preserves that intent while applying device-bound storage behavior where supported.

Caveats and Limitations

Secure Enclave and Biometric Items

Items that use:

• Secure Enclave protections
• Biometric access controls

are already maximally secure and pass through unchanged. The control does not attempt to rewrite these items.

Shared Keychain Access Groups

If your app shares keychain items with other apps or extensions via access groups, all members of the access group must have the control enabled for consistent behavior. Otherwise, one app may write items with default accessibility while another hardens them.

Background Compatibility

The control defaults to AfterFirstUnlockThisDeviceOnly (not WhenUnlockedThisDeviceOnly) to preserve compatibility with:

• Background URL sessions
• Background app refresh
• Silent push notification handlers
• VoIP push handlers

These background contexts may need to read keychain items before the user unlocks the device. If you are certain your app does not require background keychain access, you can manually specify kSecAttrAccessibleWhenUnlockedThisDeviceOnly in your code and the control will preserve that stricter policy.

Support Matrix

Plan Requirement

Related Controls

• Backup Protection — Prevents device backups from containing sensitive app data (iOS/Android)
• Clipboard Protection — Blocks protected content from being copied to the clipboard (iOS/Android)

Further Reading

• Apple Security Guide: Keychain Data Protection
• Apple Platform Security