iOS/Swift: SecItemCopyMatching生成用于biometryCurrentSet访问控制的errSecParam (-50)状态

Question

目前，我正试图使我的应用程序的用户能够使用生物识别身份验证从密钥链中添加和检索数据。当将项添加到密钥链时，对SecItemAdd的调用返回成功状态，但是当通过SecItemCopyMatching从密钥链检索项时，将得到-50 OSStatus (errSecParam)，这表明我的一个参数是错误的。

调试时，我从查询中删除了kSecAttrAccessControl或kSecAttrAccessible参数，从而消除了错误。但是，现在我面临一个不同的问题--系统是在没有首先提示用户的情况下从密钥链中检索值。

代码，要么导致errSecParam (-50)结果，要么没有身份验证提示符：

let query: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrService as String: "MyApp",
    kSecAttrAccount as String: "BiometricLogin",
    // removing this key from the SecItemCopyMatching query gets rid of the error but results in no authentication prompt
    kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
    kSecReturnAttributes as String: kCFBooleanTrue,
    kSecReturnData as String: kCFBooleanTrue,
    // removing this key from the SecItemCopyMatching query gets rid of the error but results in no authentication prompt
    kSecAttrAccessControl as String: SecAccessControlCreateWithFlags(kCFAllocatorDefault, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, .biometryCurrentSet, nil)!,
    kSecUseAuthenticationUI as String: kSecUseAuthenticationUIAllow,
    kSecUseOperationPrompt as String: "Authenticate with Biometrics"
]

let addQuery = query.merging([(kSecValueData as String, "Hi".data(encoding: .utf8)!)], uniquingKeysWith: { $1 })
let status = SecItemAdd(query as CFDictionary, nil)
print(status) // prints 0, success

let retrieveQuery = query
var queryResult: AnyObject?
let status = SecItemCopyMatching(retrieveQuery as CFDictionary, &queryResult)
print(status) // prints -50 if both kSecAttrAccessible and kSecAttrAccessControl are in the query, and prints 0 if either of those attributes are removed but the result is no authentication prompt

因此，我的问题是:如何通过身份验证提示提示用户从密钥链中检索数据？重申一下，我使用的是kSecClassGenericPassword、kSecAttrAccessibleWhenUnlockedThisDeviceOnly和.biometryCurrentSet。

Answer 1

kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,  

以上键引起问题。这需要删除，因为它已经作为

SecAccessControlCreateWithFlags(kCFAllocatorDefault, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, .biometryCurrentSet, nil)!