Hi, Have there been any new developments with this? Understand the design of having the none attestation to enable the credential syncing, but in a world where we 'want' to restrict passkeys to the device, having the attestation for passkeys provides the extra integrity.

likewise, what is the direction relating to this?

yes! I have sent it over :)

Hi, back with an update. Our customers have been able to reproduce the issue and we have been able to retrieve some logs. The error from SecItemCopyMatching is errSecAuthFailed. The error code usually points to and invalid password or invalidate context but we can confirm those are not the case in this scenario. This issue is occurring during an OS upgrade to iOS 17 and the key becomes unrecoverable. We have received info as well that the issue is appears to happen only on older devices which upgrade to iOS 17 (iPhone 11 family, iPhone 12 family, iPhone XS, iPhone XR). Newer devices 13/14 do not report this issue at all.

Thank you for sharing. Unfortunately, what I foresee here is that the SecItemAdd does correctly report the errSecDuplicateItem as the key does indeed exist (it was created beforehand). Hence, I doubt the issue lies with the SecItemAdd. Our SDK has logic to create the key if the query fails. However, it is my opinion that the issue as hand is the SecItemCopyMatching is incorrectly reporting that the key does not exist when it should. I further amend the above code snippet that during the query, we do also provide the kSecUseAuthenticationContext to ensure that the key can be fetch. In the expected behaviour (which consistently occurs to the majority of devices, the key is correctly retrieved. It is unfortunately this subset where the key is not.

To add additionally that the key generated is also protected using the following access control attributes: context = [[LAContext alloc] init]; secAccessControlRef = SecAccessControlCreateWithFlags(kCFAllocatorDefault, kSecAttrAccessibleAfterFirstUnlock, kSecAccessControlApplicationPassword, &error); NSData *data = [@"B_password" dataUsingEncoding:NSUTF8StringEncoding]; [context setCredential:data type:LACredentialTypeApplicationPassword]; CFDictionarySetValue(*attr, kSecUseAuthenticationContext, (__bridge const void *)context); CFDictionarySetValue(*attr, kSecAttrAccessControl, secAccessControlRef);