Geek Answers Handbook

Dynamically generate a decryption key rather than hard-code a string literal? (Objective-C / iPhone)

My iPhone application uses encrypted assets. The decryption key must be hard-coded, but I try to avoid using a string literal. Is there a good standard algorithm for this kind of thing?

Suppose my key is:

abcdef01-2345-6789-abcd-ef0123456789

Instead of this:

 NSString *key = @"abcdef01-2345-6789-abcd-ef0123456789";

I would rather do something like this:

 -(NSString *)key { //TODO: generate abcdef01-2345-6789-abcd-ef0123456789 dynamically return generatedKey; }

Thoughts?

+4
source share
2 answers

Bad idea . The reason is the same as for hard-coded passwords . You can obfuscate and XOR the final password together from several places, but a capable hacker will monitor the device’s memory and reconstruct any smart protocol with sufficient time. It's him if he just steals the phone. Or it can mount side channel attacks and measure runtime or energy consumption, so guessing a key similar to safecrackers in movies will include bit by bit for bit and "listen" if they are closer to their target.

Thus, you can make it more difficult, but without a hardware protected storage mechanism (which will protect memory access and deceive power consumption, runtime, etc., like smart cards or hardware security modules), there is no chance to do it is safe.

The password must remain out of the band of information separated from the device. Ideally, the user enters it whenever necessary. Of course, this is tedious from the user's point of view - but at least it is safe.

+1
source

One possible way is to use two or three byte arrays, such as key[i] = ary1[i] ^ ary2[i] ^ ary3[i] . You must initialize them in three separate places. You do not have XOR then in the same cycle, or two, maybe XOR'ed first, and the third later. It depends on how inconvenient you want to do this for any attacker.

It will not be completely safe, but it will deter a random intruder. For a random attacker, you will need a cryptography specialist that I do not know. How much you can pay for a consultant will depend on how much it will cost you if the data is stolen.

Oh, and never name your key key[] , but just ask for problems. :)

0
source

More articles:


All Articles