Multiple Secrets in One Keychain Entry

Question

I have three secrets to store in the Mac OS keychain. Currenly I store each of these in a separate keychain entry. The drawback to this is that if my application is updated the user sees three "allow access" dialogs, one for each entry. What I'd like to do is store all three secrets in one keychain entry. One of these secrets is a user-supplied password.

What is the standard method for doing this? Should I just cram all data into the password field (which means the one secret that is a user-supplied password won't be very readable in KeychainAccess.app), or is there some other way to add multiple "passwords" (i.e., encrypted fields) into one keychain entry?

Answer 1

I don't think there's a standard method, but if your secrets are reasonably short then you can stick them at the beginning, e.g. "base64-encoded-secret-1 base64-encoded-secret-2 password", which is easy to parse (even if the password contains spaces) and means that the user can see the password in Keychain Access if necessary.