Securing Data in iOS

http://blog.chariotsolutions.com/2012/04/securing-data-in-ios.html

by twelsonrossman • 14 years ago

33 6 14 years ago

blog.chariotsolutions.com

DenisM• 14 years ago

If you're rolling your own you still need to solve the problem of key management, which is not mentioned in the article. Simply storing they key next to data will accomplish nothing. For that I would recommend one of few approaches:

1. Using iOS keychain. The nice thing about it is that it's transparent to the user and easy to explain - "we store it he same way Mail app stores your email password".

2. Asking the user to enter a pass phrase and use it as an encryption key. The key here is to resist the urge to hash the phrase to turn it into a key, and instead use a well known key derivation function for the same purpose.

sjlo3• 14 years ago

The keychain is really great for convenience, though it is dependent on the iOS passcode. Users are free to setup their phones without one, use a weak pin, etc. It's exceedingly rare to see an iOS user with a strong multi-character passphrase. For enhanced security there is really no substitue for a suitably long/strong passphrase.

With regard to the second point, one added benefit of SQLCipher over a roll-your-own solution is that SQLCipher automatically applies PBKDF2 derivation. It handles most of the security under the hood so that the application doesn't need to worry about it.

brettm2• 14 years ago

On iOS keychain access is not dependent on the passcode. Each application has access to its own keychain and cannot access the keychain for other applications. The keychain will still be encrypted even if there is no passcode set.

Securing Data in iOS

Related Stories