Check pin without leaving the iOS Keychain

Question

I have a user pin stored in the iOS Keychain. For every pin attempt, I use SecItemCopyMatching to retrieve the reference pin, and then do the comparison.

The problem is that, for a short amount of time, the retrieved reference pin enters the app's working memory. If the phone is compromised, the reference pin can potentially be read off.

Is there a way to pass the pin attempt to the Keychain and have the Keychain do the comparison with the reference pin in its secure environment? (Can the Secure Element do that kind of stuff?)

Answer 1

In general, you store a one-way hash of the password with a salt, not the actual password. To verify, add the salt, hash the string, compare against the stored hash, and if it matches, it's verified.

The strength then, is the strength of the algorithm, the salt, and the password.