SecItemExport fails when exporting private key - macos

Question

I would like to export a private ECDSA key using the new 10.7 Security.framework APIs but the operation keeps failing with error code -26260:
errSecPassphraseRequired = -25260, /* Passphrase is required for import/export. */
I would also like for the keys I generate not to be added to the keychain because they are for use on other machines and I will handle the storage myself. Here is code that doesn't work- the first export succeeds, but the same key data once imported can't be exported again without a passphrase. I haven't set a passphrase for this key. I've tried many combinations of export types, included wrapped OpenSSL and PEM armoring, but it doesn't seem to make a difference. I have working code that does this already using OpenSSL, but since it is deprecated in Lion I wanted to see what the new APIs could do.
// Set up the parameters for 256-bit ECDSA
CFMutableDictionaryRef parameters = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
CFDictionarySetValue(parameters, kSecAttrKeyType, kSecAttrKeyTypeECDSA);
CFDictionarySetValue(parameters, kSecAttrKeySizeInBits, CFSTR("256")); // kSecp256r1
CFDictionarySetValue(parameters, kSecAttrIsPermanent, kCFBooleanFalse);
// Issue #1:
// SecKeyGeneratePair() adds the keys to the keychain, which I don't want to do
// The docs say that kSecAttrIsPermanent should change this behavior
SecKeyRef publicKey, privateKey;
OSStatus result = SecKeyGeneratePair((CFDictionaryRef)parameters, &publicKey, &privateKey);
CFRelease(parameters), parameters = nullptr;
if(noErr == result) {
CFDataRef privateKeyData = nullptr;
result = SecItemExport(privateKey, kSecFormatUnknown, 0, nullptr, &privateKeyData);
if(noErr == result) {
CFShow(privateKeyData);
uint32_t format = kSecFormatUnknown;
uint32_t itemType = kSecItemTypePrivateKey;
CFArrayRef items = nullptr;
result = SecItemImport(privateKeyData, nullptr, &format, &itemType, 0, nullptr, nullptr, &items);
CFRelease(privateKeyData), privateKeyData = nullptr;
CFRelease(privateKey), privateKey = nullptr;
if(noErr == result) {
privateKey = (SecKeyRef)CFRetain(CFArrayGetValueAtIndex(items, 0));
CFRelease(items), items = nullptr;
// Issue #2:
// SecItemExport() fails with -25260
result = SecItemExport(privateKey, kSecFormatUnknown, 0, nullptr, &privateKeyData);
if(noErr == result) {
CFShow(privateKeyData);
CFRelease(privateKeyData), privateKeyData = nullptr;
}
else
printf("SecItemExport error: %d\n", result);
}
else
puts("SecItemImport failed");
}
else
printf("SecItemExport error: %d\n", result);
}
else
printf("SecKeyGeneratePair error: %d\n", result);
Here is output from a sample run:
<CFData 0x10061b390 [0x7fff79ed3fa0]>{length = 121, capacity = 256, bytes = 0x307702010104209432679e712a4ac156 ... 219ffed31a54aff1}
SecItemExport error: -25260