Reset keychain on the device

Question

I'm testing login flow (using KeychainItemWrapper) inside my app on a device. How do I reset/delete keychain for my app?

On the Simulator, I do it by clicking on iOS Simulator -> Reset Content and Settings....

Answer 1

Keychain items are in iOS sandbox, users don't have access to remove unwanted keychain item. These are accessible via API's only.

KeychainItemWrapper *keychainItem = [[KeychainItemWrapper alloc] initWithIdentifier:[[NSBundle mainBundle] bundleIdentifier] accessGroup:nil]; 

//or how you access your keychain

[keychainItem resetKeychainItem];

or you can reset your device >> from the device Settings, General, Reset, Reset All Settings. But, it will reset the keychain for every app installed on the device.

Answer 2

you can dump keychain data using Keychain dumper. Grab the following link https://github.com/ptoomey3/Keychain-Dumper

Just go to this url and download the zip file and unzip it. Inside this folder, the only file that we are interested is the keychain_dumper binary. The information that is allowed to be accessed by an application in the keychain is specified in its entitlements. This binary is signed with a self signed certificate with wildcard entitlements and hence it is able to access all the keychain items. There could also have been other ways to make sure all the keychain information is granted, like having the entitlements file contain all the keychain access groups or using a specific keychain access group that provides access to all the keychain data. For e.g a tool Keychain-viewer uses the following entitlments.

com.apple.keystore.access-keychain-keys

com.apple.keystore.device

1) Just upload this binary into your device in the /tmp folder and make sure its executable.

2) Now make sure that the keychain database file stored at the location /private/var/Keychains/keychain-2.db is world readable.

3) now go to terminal and you can dump your data by passing command

.keychain_dumper

4) above command will list down all the username and password. but above will only dump out the generic and internet passwords. You can see the usage information by using the “-h” command.

5) You can dump all the information using the “-a” command.

You can read more information and example over here dumping keychain data