macOS Tahoe改变了装有Secure Enclave的Mac上登录钥匙串的工作方式，导致传统的手动复制方法失效1。用户不再能够通过将login.keychain-db文件复制到另一台Mac上并使用正确密码来解锁它，因为解密密钥现已与源Mac的Secure Enclave绑定1。
在macOS Tahoe中，登录钥匙串存储为SQLite数据库文件login.keychain-db，其中的数据使用两种AES-256-GCM密钥进行加密：元数据密钥和每行密钥1。元数据密钥由Secure Enclave保护，秘密密钥始终需要经过Secure Enclave进行处理1。经过实验验证，当将钥匙串文件从Apple Silicon Mac复制到虚拟机时，尽管提供了正确密码，解锁仍然失败1。解锁尝试失败后，原有文件被重命名为login_renamed_1.keychain-db，macOS随后创建了新的钥匙串文件1。
macOS Tahoe has fundamentally altered how login keychains function on Macs equipped with Secure Enclave, breaking the traditional method of manually transferring keychain files between computers.1 The conventional approach of copying the login.keychain-db file to another Mac and unlocking it with the correct password no longer works because the decryption keys are now bound to the source Mac's Secure Enclave.1
In macOS Tahoe, login keychains are stored as SQLite database files named login.keychain-db, with keychain data encrypted using two AES-256-GCM keys: a metadata key and per-row keys.1 The metadata key is protected by the Secure Enclave, and secret keys consistently require Secure Enclave access.1 Testing confirmed this limitation: when the login.keychain-db file was copied from an Apple Silicon Mac to a virtual machine, the system failed to unlock it despite the correct password being provided.1 System logs showed that the unlock attempt failed, after which the original file was renamed to login_renamed_1.keychain-db and a new keychain file was automatically created.1
评论
还没有评论，欢迎留下第一条。