Default kSecAttrAccessible value for keychain items?

Question

Does anyone know the default value of the kSecAttrAccessible attribute for iOS keychain items (see reference)? I'm just now upgrading an app to use stricter security, and I'm curious about how accessible my old keychain items–which didn't specify the kSecAttrAccessible key-value pair–are.

Aloin

Answer 1

Update: As of a few years ago, the default is now kSecAttrAccessibleWhenUnlocked.

According to the Session 209 (Securing Application Data) video from last year's WWDC, the existing data defaults to kSecAttrAccessibleAlways (so you'll need to update the accessibility class as necessary).

Bunton

this might have changed in iOS6, I had to explicitly set it to kSecAttrAccessibleAlwaysin order to get this behavior – Bayern

I agree with Erik's answer in that it's best to be explicit about what you want. – Bunton

kSecAttrAccessibleWhenUnlocked is now the default, and probably was a while ago. – Larcher

Yeah I think it changed a couple of years ago. Not sure of the exact year. I’ll edit! – Bunton

Answer 2

I've just tested this on iOS 5.1 and 6.0, the default is now kSecAttrAccessibleWhenUnlocked.

However, I think it is always better to set an explicit kSecAttrAccessible, rather than relying on defaults to be secure enough for you.

Peoria

Answer 3

I've tested this on IOS 8.1 and default value is kSecAttrAccessibleWhenUnlocked.

Camara

Answer 4

The documentation for kSecAttrAccessibleWhenUnlocked says:

This is the default value for keychain items added without explicitly setting an accessibility constant.

Larcher