带有钥匙串搜索的kSecAttrAccessible属性的errSecParam错误

Question

我要在钥匙串存储中添加一个身份

- (BOOL) importIdentity:(SecIdentityRef)identity
{
    .....

    CFTypeRef persistentRef = NULL;
    NSDictionary* query = @{ (id)kSecValueRef : (id)identity,
                       (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
                  (id)kSecReturnPersistentRef : (id)kCFBooleanTrue };

    OSStatus status = SecItemAdd((CFDictionaryRef) query, &persistentRef);

    NSData* data = (__bridge NSData*) persistentRef;
    [[NSUserDefaults standardUserDefaults] setObject:(id)data forKey:kRPIdentifierRef];

    .....
}

然后无法使用-50代码在钥匙串存储中建立此身份（errSecParam-传递给该函数的一个或多个参数无效）。

- (SecIdentityRef) exportIdentity
{
    .....

    CFDataRef identityRefData = (CFDataRef)[[NSUserDefaults standardUserDefaults] objectForKey:kRPIdentifierRef];

    NSDictionary* query = @{ (id)kSecClass : (id)kSecClassIdentity,
                (id)kSecValuePersistentRef : (id)identityRefData,
                    (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
                         (id)kSecReturnRef : (id)kCFBooleanTrue };

    CFTypeRef identityRefType = NULL;
    OSStatus status = SecItemCopyMatching((CFDictionaryRef)query, &identityRefType);

    .....
}

值得注意的是，当我从SecItemAdd和SecItemCopyMatching中删除kSecAttrAccessible时，一切正常！

我没有找到类似的问题。