Is it possible to use AES128 with GCM mode on iOS?

Question

So my question for you stackoverflow geniuses is: if there a way (native, library, framework, whatever..) to encrypt data with AES (preferably 128 but could be 256 too) using a strong Authenticated encryption algorithm, let's say GCM mode?

Question is short, I have done some research and I only found one library that seems to support it ( RNCryptor ) but it also seems to use password to crypt instead of keys (like you provide a password and the library made the key) and I don't like that a lot, I prefer to manage my keys myself.

I also look at CommonCryptor.h and I found that line, which seems to me the only reference of GCM in commoncryptor source code (but I could be wrong, actually I am probably wrong) :

case kCCModeGCM: if((ref->symMode[direction].gcm = getCipherMode(cipher, mode, direction).gcm) == NULL) return kCCUnimplemented;

Thanks by advance !

Our SecureBlackbox supports AES-GCM and is available for iOS. But this is undocumented functionality so you'll need to ask for samples on our forum. — Eugene Mayevski 'Callback, May 15 '14 at 17:21

score 2 · Answer 1 · answered May 15 '14 at 15:34

RNCryptor uses a HMAC, which is considered a cryptographically strong method of creating an authentication tag. It is open source as well. So I would seriously consider cloning RNCryptor code for this (keep the copyright in the header intact!).

Password based encryption consists of deriving a keys (and possibly an IV), then performing the encryption and authentication. So you should get a long way by simply removing the key derivation part.

The only time when this doesn't work is if the code for key derivation is woven into the part that does the encryption/authentication, but this does not seem to be the case for RNCryptor.

Thanks mate! I followed your advice and it is actually possible in RNCryptor to use a key and to skip the key derivation. However RNCryptor doesn't use GCM but CBC and then HMAC+SHA1, but that fits my requirement. Thanks for the guidance ! — tanou, May 16 '14 at 12:59

score 2 · Accepted Answer · answered May 16 '14 at 13:11

Thanks to owlstead suggest I take a look deeper into RNCryptor and found a solution.

First of all after lots of googling it's seems that Zaph were right and iOS doesn't provide GCM but use it in iOS. ref there: iOS Security feb 2014

Second, RNCryptor doesn't use GCM but use AES256 in CBC mode (Cipher Block Chaining), which is fine, and then authenticate with HMAC+SHA1. This fits my requirements.

To encrypt with a key and to skip the password derivation part, RNCryptor provide this function:

NSData *encryptedData = [RNEncryptor encryptData:yourData
                                        withSettings:kRNCryptorAES256Settings
                                       encryptionKey:encryptionKey
                                             HMACKey:HMACKey
                                               error:&error];

and then decrypt with this

NSData *decryptedData = [RNDecryptor decryptData:encryptedData withEncryptionKey:encryptionKey HMACKey:HMACKey error:&decryptionError];

RNCryptor also provide random generation methods for keys.

Note: take care when using AES256, the key schedule can be weak: Schneier article but no drama and there are other point of view on AES256 that are pros: Colin Percival article

score 1 · Answer 3 · answered May 15 '14 at 14:59

1

GCM is missing from CommonCrypto. Interestingly Apple is using GCM for the keychain since ios5.

answered May 15 '14 at 14:59

zaph

111,848
21
189
228

I am truly surprised by the lack of mode/methods available in CommonCrypto while seeing the that most of them (or at least a lot) are used by apple in iOS ( http://images.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf ) – tanou May 16 '14 at 13:13
@tanou There is more available via CryptoKit in Swift. – TJ Olsen Apr 27 '22 at 19:41

Is it possible to use AES128 with GCM mode on iOS?

3 Answers3

Linked

Related