Keychain for secure storage in iOS Swift - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ ui_behavior

intermediate

How does Keychain store data securely?

Which statement best describes how the iOS Keychain stores data?

A It saves data as plain text files inside the app's document directory.

B It stores data in UserDefaults but with a password lock.

C It encrypts data and stores it in a secure system area accessible only to the app or authorized apps.

D It sends data to iCloud and retrieves it when needed.

💡 Hint

Think about where sensitive data like passwords should be kept on iOS devices.

The Keychain encrypts data and stores it in a protected area of the device. Only the app or authorized apps can access it, ensuring security.

📝 Syntax

intermediate

What is the correct way to add a password to Keychain in Swift?

Given the following Swift code snippet, which option correctly adds a password string to the Keychain?

let password = "mypassword123"
let account = "[e-mail]"
let service = "com.example.app"

A

let query = [kSecClass: kSecClassGenericPassword, kSecAttrAccount: account, kSecAttrService: service, kSecValueData: password.data(using: .utf16)!]
SecItemAdd(query as CFDictionary, nil)

B

let query: [String: Any] = [kSecClass: kSecClassGenericPassword, kSecAttrAccount: account, kSecAttrService: service, kSecValueData: password]
SecItemAdd(query, nil)

C

let query = ["class": "genericPassword", "account": account, "service": service, "value": password]
SecItemAdd(query, nil)

D

let query: [String: Any] = [kSecClass as String: kSecClassGenericPassword, kSecAttrAccount as String: account, kSecAttrService as String: service, kSecValueData as String: password.data(using: .utf8)!]
SecItemAdd(query as CFDictionary, nil)

💡 Hint

Remember the password must be converted to Data using UTF-8 encoding before storing.

Keychain expects the password as Data type encoded in UTF-8. The keys must be cast to String and the dictionary passed as CFDictionary.

❓ lifecycle

advanced

When is Keychain data accessible to an app?

Consider an app that stores a password in Keychain with kSecAttrAccessibleAfterFirstUnlock. When can the app access this data?

A Only when the device is unlocked for the first time after reboot, and afterwards even if locked.

B Only while the app is running in the foreground.

C Only when the device is unlocked and the app is active.

D At any time, even if the device is locked or rebooted.

💡 Hint

Think about the meaning of AfterFirstUnlock accessibility option.

The kSecAttrAccessibleAfterFirstUnlock option allows access after the device has been unlocked once after reboot, even if it is locked later.

🔧 Debug

advanced

Why does this Keychain query fail to find stored data?

Given this Swift code to retrieve a password from Keychain, why does it fail to find the stored password?

let query: [String: Any] = [kSecClass as String: kSecClassGenericPassword, kSecAttrAccount as String: "[e-mail]", kSecReturnData as String: true]
var item: CFTypeRef?
let status = SecItemCopyMatching(query as CFDictionary, &item)

A The <code>kSecReturnData</code> key should be false to retrieve the password.

B The query is missing the <code>kSecAttrService</code> key, so it does not match the stored item.

C The <code>item</code> variable is not initialized to nil before the call.

D The <code>kSecClass</code> value should be <code>kSecClassInternetPassword</code> instead.

💡 Hint

Think about what keys were used when storing the password.

If the stored item included kSecAttrService, the query must include it to find the exact match.

🧠 Conceptual

expert

What is the main advantage of using Keychain over UserDefaults for sensitive data?

Why should developers prefer Keychain instead of UserDefaults to store passwords or tokens?

A Keychain encrypts data and restricts access based on device security, while UserDefaults stores data unencrypted and accessible to anyone with device access.

B UserDefaults automatically syncs data across devices, but Keychain does not support syncing.

C Keychain is faster to read and write data than UserDefaults.

D UserDefaults requires explicit user permission to store data, Keychain does not.

💡 Hint

Consider the security and privacy differences between the two storage methods.

Keychain encrypts and protects sensitive data using device security features. UserDefaults stores data in plain text and is not secure for sensitive info.

Practice

1. What is the primary purpose of using the iOS Keychain in app development?

easy

A. To store large media files for offline use

B. To securely store sensitive data like passwords and tokens

C. To cache images for faster loading

D. To manage app user interface layouts

Solution

1. Step 1: Understand Keychain's role

   The Keychain is designed to securely store sensitive information such as passwords, tokens, and certificates.

2. Step 2: Differentiate from other storage

   It is not meant for large files, caching images, or UI management, which are handled by other systems.

3. Final Answer:

   To securely store sensitive data like passwords and tokens -> Option B

4. Quick Check:

   Keychain = Secure sensitive data [OK]

Hint: Keychain is for secrets, not files or UI [OK]

Common Mistakes:

• Thinking Keychain stores large files
• Confusing Keychain with cache or UI storage
• Using Keychain for non-sensitive data

2. Which Swift code snippet correctly converts a String to Data for saving in Keychain?

easy

A. let data = myString.toData()

B. let data = Data(myString)

C. let data = myString.data(using: .utf8)

D. let data = Data.fromString(myString)

Solution

1. Step 1: Identify correct String to Data conversion

   In Swift, String has a method data(using:) that converts it to Data using a specified encoding like UTF-8.

2. Step 2: Check method validity

   Options B, C, and D use invalid or non-existent methods for this conversion.

3. Final Answer:

   let data = myString.data(using: .utf8) -> Option C

4. Quick Check:

   String.data(using:) = correct conversion [OK]

Hint: Use .data(using: .utf8) to convert String to Data [OK]

Common Mistakes:

• Using non-existent methods like toData()
• Trying to initialize Data directly with String
• Forgetting to specify encoding

3. Given the following Swift code snippet, what will be the output if the keychain item exists and contains the string "secret123"?

let query: [String: Any] = [
  kSecClass as String: kSecClassGenericPassword,
  kSecAttrAccount as String: "userKey",
  kSecReturnData as String: true
]
var item: CFTypeRef?
let status = SecItemCopyMatching(query as CFDictionary, &item)
if status == errSecSuccess, let data = item as? Data, let password = String(data: data, encoding: .utf8) {
  print(password)
} else {
  print("No data found")
}

medium

A. Error: Keychain item missing

B. No data found

C. nil

D. secret123

Solution

1. Step 1: Understand SecItemCopyMatching behavior

   If the keychain item with key "userKey" exists, SecItemCopyMatching returns errSecSuccess and the data is assigned to item.

2. Step 2: Convert data to String

   The code safely unwraps the data and converts it to a UTF-8 string, then prints it.

3. Final Answer:

   secret123 -> Option D

4. Quick Check:

   Keychain item found = print stored string [OK]

Hint: If status is success, data prints as stored string [OK]

Common Mistakes:

• Assuming print shows 'No data found' when item exists
• Not casting item to Data before conversion
• Ignoring status check before unwrapping

4. Identify the error in this Swift code snippet that tries to save a password to Keychain:

let password = "mypassword"
let data = password.data(using: .utf8)
let query: [String: Any] = [
  kSecClass as String: kSecClassGenericPassword,
  kSecAttrAccount as String: "userKey",
  kSecValueData as String: data
]
let status = SecItemAdd(query as CFDictionary, nil)
if status == errSecSuccess {
  print("Saved")
} else {
  print("Failed")
}

medium

A. data is optional and should be unwrapped before use

B. kSecAttrAccount key is incorrect

C. SecItemAdd requires a non-nil second parameter

D. kSecClassGenericPassword is not a valid class

Solution

1. Step 1: Check data conversion

   The data(using:) method returns an optional Data?. It must be safely unwrapped before use.

2. Step 2: Identify usage error

   Passing optional data directly to kSecValueData can cause runtime issues or failure to save.

3. Final Answer:

   data is optional and should be unwrapped before use -> Option A

4. Quick Check:

   Optional Data must be unwrapped before Keychain save [OK]

Hint: Always unwrap optional Data before saving to Keychain [OK]

Common Mistakes:

• Passing optional Data without unwrapping
• Misusing Keychain attribute keys
• Assuming SecItemAdd second parameter cannot be nil

5. You want to update an existing password stored in Keychain for the account "userKey". Which approach correctly updates the password securely?

hard

A. Use SecItemUpdate with a query matching the account and provide new kSecValueData

B. Call SecItemAdd again with the same account and new password

C. Delete the old item with SecItemDelete then add a new item with SecItemAdd

D. Modify the stored password directly by changing the Keychain file

Solution

1. Step 1: Understand Keychain update method

   The correct way to update an existing Keychain item is to use SecItemUpdate with a query to find the item and attributes to change.

2. Step 2: Evaluate alternatives

   Using SecItemAdd with the same key will fail because the item exists. Deleting then adding works but is less efficient. Direct file modification is unsafe and unsupported.

3. Final Answer:

   Use SecItemUpdate with a query matching the account and provide new kSecValueData -> Option A

4. Quick Check:

   Update Keychain = SecItemUpdate [OK]

Hint: Use SecItemUpdate to change existing Keychain data [OK]

Common Mistakes:

• Trying to add duplicate items with SecItemAdd
• Deleting then adding instead of updating
• Attempting unsafe direct file edits