1

I'm new to iOS development and working on a small iOS mobile app that stores sensitive information of users. Initially I thought of using custom AES encryption to encrypt/decrypt all the data. I also want the encrypted data to be synced with iCloud. After reading more I came to know from iPhone 3GS each device has a built-in AES-256 crypto engine. From the XCode, I observed that I can turn on an option called "Data Protection" for the mobile app to secure data. Based on my analysis I've below questions:

  1. To use data protection for iPhone 3GS (uses iOS 6.1) do I need to set passcode?

  2. Without setting passcode for the device how can I use the built-in crypto engine to encrypt my data?

  3. The information are very sensitive and so in this case do I need to implement custom encryption?

VJAI
  • 32,167
  • 23
  • 102
  • 164

3 Answers3

5

RNCryptor is very useful, but it's basically just a wrapper for Apple's own CommonCrypto functionality (that makes implementing it pretty easy). It's useful if you want to encrypt data on the device that even the user cannot get ahold of.

Regarding your specific questions:

  1. Data protection encrypts your app data using Apple's device-level encryption (you do not password protect it yourself). This has its uses - it will keep a 3rd party from being able to access data on a device if they are unable to unlock it - but does not prevent (for example) a user from getting access to data on their an unlocked device. Using RNCryptor and CommonCrypto which it is built upon you can AES256 encrypt content using a password of your choosing.

  2. Apple details this here. Basically, from the end user's perspective they just set a password for their device as normal. You do not use a password of your own choosing.

    You can set this up for your app using the following instructions:

    https://developer.apple.com/library/ios/documentation/IDEs/Conceptual/AppDistributionGuide/AddingCapabilities/AddingCapabilities.html#//apple_ref/doc/uid/TP40012582-CH26-SW30

  3. This depends on how sensitive the data is and what threats you foresee (Who are you trying to keep it away from? Are there any laws/regulations you intend to comply with? How much work do you want to take upon yourself to protect this data?). There are a lot of trade-offs and caveats that can apply in certain situations.

    If you have a small amount of data, you might consider just storing it in the iOS keychain. Otherwise, I'd recommend giving RNCryptor a try. It's fairly easy to integrate.

I hope this helps.

UPDATE: Another thing to consider... There are potential export control ramifications that might come up if you implement your own encryption, even using RNCryptor/CommonCrypto. Depending on how much paperwork and/or delay you're willing to deal with, this may influence your decision. You can learn more about this from Apple's site, here:

https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/wo/20.0.0.13.7.2.7.9.3.1.2.3.3.1.5.7.1

Jeff C.
  • 2,031
  • 2
  • 17
  • 28
  • 1
    You can't link into iTunes Connect like that, but I know what you are talking about. Actually, most apps are exempt from this via Note 4 [here](http://www.bis.doc.gov/index.php/policy-guidance/encryption/identifying-encryption-items#Three) section b – borrrden Oct 09 '14 at 08:30
2

This really depends on how many scenarios you are trying to protect against. Pretty much any scenario you can possibly create will be broken given enough time and effort. However to address a few points:

1) Yes you need to set a passcode for this feature to become active.

2) You can make use of the CommonCrypto library (or a wrapper around it like RNCryptor)

3) This is a bad idea for the simple reason that developing a secure algorithm is insanely hard. The slightest flaw will leak out all of the data and people have devoted years of their lives to sniffing out these flaws (although I may have misunderstood what you meant by "custom encryption")

If you want to be as secure as possible you will have to do this: Send your file to a server for processing (via HTTPS). It is much harder to hack into a server then it is to hack into an iOS application. If you simply use RNCryptor it is pretty trivial to rip apart the app looking for the password, or how you obtain the password. Basically if the app can do it then BlackHat can do it too.

EDIT I forgot about one thing! If you generate a random password for each install and store it in the keychain then this will help, but it is not foolproof (There is a small chance that the iOS keychain contents can be retrieved from a jailbroken device, especially if the user has a week passcode). However this will make the user's data non-recoverable if they wipe the OS for any reason.

borrrden
  • 33,256
  • 8
  • 74
  • 109
  • Very helpful answer. I don't know RNCryptor is a wrapper around CommonCrypto library. The custom solution I meant is actually using RNCryptor. I can't use server but I would like to store the encryption key in Keychain. I want to sync the encrytped data with iCloud so I cannot create new key at each install right? – VJAI Oct 09 '14 at 09:49
  • 1
    @Mark You only have limited options then...and none of them are great. Even if you store the key in the keychain, where is the key going to come from? If the app can find it, so can someone hacking the app. Even worse, if they hack one account then they have the password for all of them. I would suggest having the user register a password which can control the encryption and decryption and store **that** in the keychain. This will be hard to verify between devices though...(but not impossible) – borrrden Oct 09 '14 at 09:52
  • @borrrden Jailbreaking an iOS device does not provide access to the keychain data. The attack code will still have to make requests to the keychain engine and the request rate is limited by the engine. So the attack is a rate limited bruit force attack on the lock passcode. The key is a good passcode, typically something better than the default 4 digit passcode. – zaph Oct 09 '14 at 11:53
  • @Zaph Are you sure? Because there are articles like [this](http://isaiahjturner.com/can-i-trust-ios-keychain-to-store-passwords-unencrypted/) – borrrden Oct 09 '14 at 12:59
  • I have personally spoken to the security staff at Apple who implemented the Keychain, I was given the minimum time per request and told that as processors became faster the minimum time would be maintained. The Keychain uses the "TPM equivalent" in the iOS device. The point: Jailbreaking does not allow direct access to the keys. – zaph Oct 09 '14 at 13:58
  • Having looked at the referenced page and all references no where do I see the time that the bruit force attack takes. A bruit force attach via the Keychain engine for a 4-digit passcode is realistic in practical time from a Jailbroken iOS device, that is why a better passcode is necessary as I stated. Also note that these articles are based on rather old versions of iOS. It is possible (I'm guessing here) that Apple could have improved the security with a method such as exponential back-off. It might be interesting to ask on the security mailing list. – zaph Oct 09 '14 at 14:17
  • One note from iphone-dataprotection: "It is not possible to bruteforce passcode or fix boot-loops on A5+ devices (anything newer than iPhone 4)". How accurate this is unknown. – zaph Oct 09 '14 at 14:24
  • Thanks for the analysis! So I suppose I should rephrase to "there is a slight chance of recovery of the keychain data, especially if the user has a weak password" and refer back to the first sentence of my answer regarding how much protection is needed. – borrrden Oct 09 '14 at 21:42
1

very very very simple : https://github.com/RNCryptor/RNCryptor I was used it for a chat application it so good.

HaiN
  • 917
  • 11
  • 31