I need to develop some simple demonstration of an application reading a file over HTTPS and saving it to the local memory (internal or external) of an iOS device (e.g., an iPhone), in a way that it is only accessible to it. So, application-specific file encryption is required.
The "Advanced App Tricks" page of the Apple iOS Developer Library, in the "Protecting Data Using On-Disk Encryption" section, seems to imply that a file encrypted on disk, via either Default (i.e., iOS filesystem) or "Complete" Data Protection, would be accessible by all applications, after the user types the device's lock code.
If that is the case, could someone please suggest the best way of implementing file encryption per-application on an iOS device, with a password request when a user tries to open the file? Any sample code would also be very helpful.
Also, does "software encryption" apply to iOS anymore? Both Default and Data Protection encryption seem to be hardware-based.
Thanks!
Application files are not accessible between Apps. Each App is individually sandboxed.
In all cases the document is talking about the access available to "Your App"/ It is never accessible to another App. But see below. Sone of the protection options help cover what and when "Your App" has access to the file when in the background.
JailBroken iOS devices will have greater file system access so adding "Data Protection" will protect from this vector.
See the document session on The iOS Environment and particularly the section "The App Sandbox" iOS Environment
Hardware encryption: There are a few things that hardware encryption provide. 1. Speed. 2. The encryption method can not be changed, that is as with software encryption there is no code that could be compromised. 3. The key can not be accessed. The key is in some manner placed/created in the hardware and the hardware will does not allow read access (there are occasionally very secure export capabilities). The device is asked to perform crypto functions on data and returns data. Examples of this are smart cards, HSMs, TPMs and TPM Equivalents, the iPhone has a TPM Equivalent and that is used for the Keychain. By chance my wife and I were discussing this very topic yesterday. :-)
As far as I know, for encryption of bulk data, iOS does use special hardware instructions to aid AES encryption for speed but that would not be considered hardware encryption due to the key being available in software. There is a little guessing here due to the lack of information about the Apple A-series ARM chips, it is true of the Intel chips in Macs.
Related
I found this Does my application "contain encryption"? which provides very useful information but I'm not sure if my case falls under this export compliance where my App only displays encrypted messages ( let say AES 256 encrypted messages ).
For more details, let's say App sends clear message (with base64 encode) to a Server using HTTP ( not even HTTPS) to encrypt using AES, and then display the received result on the App. App also sends encrypted messages, which user to key in, to Server to fetch the clear messages back and display. So, should this App be considered 'No contain encryption' ?
Thank you
According to the Apple documentation:
"If your app uses, accesses, contains, implements, or incorporates encryption, this is considered an export of encryption software, and is therefore subject to U.S. export and other country or region import compliance requirements.
Use of encryption includes, but is not limited to:
Making calls over secure channels (i.e. HTTPS, SSL, and so on).
Using standard encryption algorithms.
Using crypto functionality from other sources such as iOS or macOS.
There are, however, exemptions to this, and you are exempt if (and only if) all of the encryption used in your app falls into at least one of the following categories:
(a) Specially designed for medical end-use
(b) Limited to intellectual property and copyright protection
(c) Limited to authentication, digital signature, or the decryption of data or files
(d) Specially designed and limited for banking use or "money transactions"; or
(e) Limited to "fixed" data compression or coding techniques
So in this specific example (as with most iOS apps), it is likely that your app will require export compliance.
If you require compliance, you will be required to file a year-end self classification report to the US Bureau of Commerce.
I am wondering what is considered the most secure way of two apps exchanging data within Cocoa Touch env.
I am very much new in iOS development and swift development and I am just looking to explore another part of the OS capabilities.
I read about App Groups sharing a location (directory) where files can be exchanged but also about URL schemas between apps to share data.
Are there any other ways of inter-app data exchange? And which is considered the most secure one?
It depends on what you consider secure, but the iOS Keychain may fit your needs. The iOS Keychain is password protected and can be accessed by other applications that you authorize.
Take a look at the official Keychain Services Programming Guide and this article explain how it works.
I have a doubt if any one can access the files and document directories of an iphone app. Need to check if anyone can access the files if they get the device. I have a sqlite file in my app whose data is sensitive i dont want other users to hack or access it.
Please let me know how we can access any apps database.
It will depend on the user, basically, if the user has set a passcode, it will encrypt all data on the device. If the user has not set a passcode, then data will live unencrypted. As a rule of thumb, you must assume if the information lives on the device, that information might be at risk.
Here is what apple has to say about it:
Data protection is available for devices that offer hardware
encryption, including iPhone 3GS and later, all iPad models, and iPod
touch (3rd generation and later). Data protection enhances the
built-in hardware encryption by protecting the hardware encryption
keys with your passcode. This provides an additional layer of
protection for your email messages attachments, and third-party
applications.]1
Also:
On devices running iOS 8, your personal data such as photos, messages
(including attachments), email, contacts, call history, iTunes
content, notes, and reminders is placed under the protection of your
passcode.
We are submitting an update of our Adobe AIR created app to the Apple App Store. We wish to change our encryption status.
The app was created using AIR 3.7 and uses several Encrypted SQLite Databases and an SSL connection to our server. As a precaution we got the US BIS export notice when we first submitted the app, but during the submit process we received this notice from Apple:
French authorities have agreed to limit the regulatory approval requirements for Apple’s App Store apps that use, access, implement, or incorporate:
any encryption algorithm that is yet to be standardized by international standard bodies such as IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA, etc. or not otherwise published; or
standard (e.g., AES, DES, 3DES, RSA) encryption algorithm(s) instead of or in addition to accessing or using the encryption in Apple OS
Consistent with the requirement, Apple will require you to upload a copy of your approved French declaration when you submit your app to the App Store if it meets the criteria described above.
So we decided to not publish to the French app store for our first release.
We now would like to publish to France, but I am not sure if we can state that our encryption is not in addition to accessing or using the encryption in Apple OS . I have found documentation that Encrypted Local Store uses KeyChain, but not that Encrypted SQLite Database does, only that it uses AES encryption.
We do not want to apply for the French import decleration unless really necessary, as it seems like a terribly complex process, in French.
Does anyone know if Encrypted SQLite Database uses that encryption already there in iOS?
Quoting from Adobe's documentation, Considerations for using encryption with a database:
AIR database encryption uses the Advanced Encryption Standard (AES) with Counter with CBC-MAC (CCM) mode.
I can find no indication that it uses a platform-specific method on iOS.
The client is concerned about safety of the data application uses and stores locally on device (e.g. they want to prevent reading our data files even on jailbroken iPhones). So I wonder - what are the possible ways to ensure data safety on iPhone?
Edit:
I'm thinking about 2 ways of storing data - a bunch of xml files (maximum size - about 1MB) or sqlite database. I'm more inclined to the 2nd variant but still not sure
You might want to check out this article - Protecting resources in iPhone and iPad apps. It talks about a scheme to encrypt app resources at build time, which can then be decrypted when needed by your app. Decryption happens in-memory so unprotected temporary files are not left on the filesystem. You can even load encrypted HTML, PDF & images straight into a UIWebView.
For transparency's sake: I wrote that article and it is hosted on my own website.
Any time code is running on physical hardware that's out of your control, it is vulnerable - the iPhone must have the ability to decode the data for it to be usable, and if the iPhone has that ability, so does the user. If the data is valuable enough, someone will break your encryption.
The movie industry spent millions on their DVD DRM. It got cracked in a few weeks.
The commoncrypto library, available on the phone, supports symmetric encryption. You can store the key in the keychain, which is itself asymmetrically encrypted. The key to decrypt the keychain is baked into the hardware so you'd need to go to some lengths to retrieve the data.
(e.g. they want to prevent reading our data files even on jailbroken iPhones). you may use localytics mobile analytics(open source) to find out whether the application has been used in Jail broken iphone or not.. They have premium options also..Lot of mobile analytics are available.you can check..