I am pretty much a newbie at cryptography but I am trying to encrypt some data and save it in a file in iOS 3 because I do not want the user to just go in and edit the file. What is the proper way to securely (relatively) encrypt the data in iOS 3? Most of the documentations I found online were for iOS 5.
Any help would be appreciated!
Thanks,
Alex
I do not know iOS3 well enough to suggest something that is already built-in. If you need to develop encryption from scratch, then RC4 is absurdly easy to program. It is obsolescent now, but still reasonably secure. Its major fault from your point of view is that you need to pick a secure key using a good KDF (Key Derivation Function), such as PBKDF2.
The "proper" way to do it is to use Apple's Key chain in IOS. Unfortunately, as this post says, this isn't really that secure for IOs3. For ios4 it works fine.
Someone probably has a paid solution out there , but you may well end up writing one yourself. You are going to want to
Derive your key from a user supplied password using a key derivation function such as PBKDF2. In fact your need to derive two keys, so you are gong to run it twice with two different RANDOM salts.
Use AES with a RANDOM IV and one of your derived keys (that parts important and all the example code I've seen didn't). prepend the salts and the IV to your cipher text
Use an hmac with the other derived key on all of the above data. Prepend that.
To decrypt, rederive the keys using the key derivation algorithm with the password and prepended salts, regenerate the hmac , take the sha1 hash of the generated one and separately the sha1 hash of the one in the message, and verify that they are the same ( don't directly compare the hmacs directly) and then decrypt the data using the other derived key and the prepended IV.
This is a pain to write and annoying to users since they need to put in a separate password, but there is no way to do it securely otherwise. If you store the key on the iphone, someone can read it and decrypt the data. Yeah you could encrypt the key, but then how do you store that key?
I don't believe apple has decent objective c bindings for any of this,so you need to use the common crypto c API. Its documented here. The objective-c APIs which appear to be useless, are documented here
Related
This question already has answers here:
Secure keys in iOS App scenario, is it safe?
(3 answers)
Closed 3 years ago.
I am working on a simple iOS app in Swift that uses an API that I pay for. I do not have a ton of resources and have yet to find a simple/up to date solution to this issue. I want to protect my API key and not put the key directly in my code where I make requests (I have heard this is best practice).
What would be the simplest way to protect my API key from someone taking apart my code and using it.
I've heard something about using Keychain but I'm unsure if this is the best route.
class APIService {
static let shared = APIService()
private let token = "(my token goes here)"
//...various API request functions
}
There is no easy way, nor is there a way to completely protect them from attackers. You can always do some simple key obfuscation or store them in a server but if a hacker can reverse-engineer your code they can likely reverse-engineer your obfuscation.
It'd be good to develop safety measures to take if someone does get your keys (database backups, etc.. ).
This link helped me when I was originally looking into this topic for one of my apps.
NSUserDefaults:
NSUserDefaults is simple and effective for saving small datas like NSNumbers or NSStrings, or even saving remember me option for saving ur state of UserName. NSUserDefaults is no way stored securely as it's easily gets Hacked.
KeyChain:
Best place to save tokens, api keys. Find the below apple documentation which describes more,
**“An encrypted container that securely stores small chunks of data on behalf of apps and secure services.” "Simply a database stored in the file system.”**
KeyChain Documentation
And here is the example of Swift Version with simple way to store and retrieve data using KeyChain
https://stackoverflow.com/a/37539998/1244403
I used jasypt-1.9.2 to encrypt property value in configuration file.
Unfortunately, I lost key but I have encrypted string and plain text.
In this situation, Is there way to get key from encrypted string and plain text?
If the encryption was not a trivial method the answer is NO.
The best chance you have is to try potential passwords and find one that works.
Note: critical passwords need to be saved securely somewhere that is very hard to loose by accident. One solution is on paper, in a good safe, not a cheap fireproof only safe. Perhaps in a bank Safety Deposit Box.
I´m developing an App with encrypted data. I download the key from my server, but I want get the key encrypted too. For this, I need create a first key in my iOS app and then, decrypt the new Key and save it in the Keychain. Can I have a initial code in a safe way by default? For example, an String, a Key...
Thank you very much,
Patrick
Including a key compiled in the binary is not perfectly safe, but it's probably good enough unless your app is a target.
There is no way to hand someone a key without them being able to use it. It's logically impossible.
I am building an iOS app for someone. The app will be used to take mock exams on for a professional license. The question data is stored in Core Data but the question and answers strings need to be encrypted as the client spent a lot of time writing them and doesn't want someone else stealing his work to use in a competing product.
So what I want to do is set the attributes in core data to transformable, use a custom NSValueTransformer to transform the strings to NSData and while they are being transformed use RNEncrypt to encrypt and decrypt.
So far so good.
Here is my predicament: I need to use a key to encrypt and decrypt the data but how do I get/create it?
My options:
hardcode it == bad!
generate key and store in keychain == not the right type of security. i.e.. does not protect against owner of the device.
generate key from user password == no other reason for the user to have to login.
the app connects to a server and gets a key with some authentication stuff(I don't know what is involved exactly) == I don't want to rely on a network connection for the app to work.
obfuscation, I feel like if I create a string from bits of other strings and method sigs and then hash it then that will be enough == It probably won't be.
My questions then are these:
- Obfuscation, can it be enough, has anyone else had success with it?
- From my research I've learnt that a hacker with an ipa can see all the hardcoded strings, class names and method sigs but they can't see the code inside the methods (is that correct?), so how could someone read the key if it was built up/generated inside a method?
- As the title, Can I use Obfuscation?
- Are there any options I have missed?
For the record, if I have to then I'll make people register and login.
You cannot store data locally securely. As soon as you are able to decrypt it an attacker can as well. That goes for EVERY encryption technique. No matter what you try.
You have to store the data or a different decryption key for each data point on a server and retrieve it one by one every time. You additionally have to make sure that the user does not just send 100s of requests and retrieves all data by hand.
Note that storing just one key on a server will result in the exact same thing as writing it hardcoded in the app. And not limiting the requests will just cause the attacker to need a little more time than just looking at an already decrypted local db.
Of course you can obfuscate it to make it seem like it has some good encryption behind it - but if someone WANTS to get the data, he will be able to.
Regarding the code in an ipa: you will not be able to see the original code but you will be able to see some code that produces the same output as the original code. As long as the device can produce the valid key, an attacker can as well.
I do not know if there is a huge community out there that is looking through random apps to steal some of its internal questions / answers / data, I doubt it.
You just have to make the product sooooo good that no competing product with the same data has any chance against it. The data itself can always be "stolen".
I'm working on an app that has a red button. What that means is that every client account has two (secret) keys that are automatically generated. When someone enters those keys on a special (public) page, a certain process will be set in motion. The process is not critical, but
That's all taken care of, the keys are automatically generated on user account creation, stored encryped in the database and are shown to the user once so he can distribute the keys as he sees fit. He can of course reset the keys if he wants to.
The thing is, some clients keep forgetting the keys. Our solution is to reset the keys and redistribute the new keys, but for some clients that's just not practical. I'd like to offer the option of retrieving the keys without resetting them.
My idea was to be able to decrypt the keys using the user's password, meaning that the already logged in user would have to enter his password again, which was used to encrypt the keys and is now used to decrypt them. I'm just not sure how that would technically work (is there an encryption/decryption algorithm that I could use?) and whether there's anything I should consider before employing such a technique.
Does anyone have any ideas on this? Maybe even a better suggestion?
You want to check out ciphers like AES.
I'd check out this gisthub example on how to use Ruby and AES for encryption and decryption.