데이터 보호 및 암호화

iOS의 데이터 보호

import Foundation
// File-level protection ties decryption to lock state.
// Set a protection class when writing sensitive files.

보호 클래스

import Foundation
// FileProtectionType:
//   .complete
//   .completeUnlessOpen
//   .completeUntilFirstUserAuthentication (default)
//   .none
let level = FileProtectionType.complete
_ = level

보호된 파일 쓰기

import Foundation
func writeSecure(_ data: Data, to url: URL) throws {
    try data.write(
        to: url,
        options: [.completeFileProtection])
}

기존 파일에 보호 설정하기

import Foundation
func protect(_ url: URL) throws {
    try FileManager.default.setAttributes(
        [.protectionKey: FileProtectionType.complete],
        ofItemAtPath: url.path)
}

앱 내 암호화를 위한 CryptoKit

import CryptoKit
// CryptoKit offers hashing, symmetric & public-key
// crypto with safe, hard-to-misuse APIs.

SHA-256으로 해시하기

import CryptoKit
import Foundation
func fingerprint(_ data: Data) -> String {
    let digest = SHA256.hash(data: data)
    return digest.map { String(format: "%02x", $0) }
        .joined()
}

대칭 키

import CryptoKit
let key = SymmetricKey(size: .bits256)
// Persist this key in the Keychain, not in a file.
_ = key

AES-GCM으로 암호화하기

import CryptoKit
import Foundation
func encrypt(_ data: Data, key: SymmetricKey)
    throws -> Data {
    let sealed = try AES.GCM.seal(data, using: key)
    return sealed.combined! // nonce + ciphertext + tag
}

복호화 및 검증하기

import CryptoKit
import Foundation
func decrypt(_ combined: Data, key: SymmetricKey)
    throws -> Data {
    let box = try AES.GCM.SealedBox(combined: combined)
    return try AES.GCM.open(box, using: key)
}

암호에서 키 도출하기

import CryptoKit
import Foundation
func deriveKey(from secret: Data, salt: Data)
    -> SymmetricKey {
    return HKDF<SHA256>.deriveKey(
        inputKeyMaterial: SymmetricKey(data: secret),
        salt: salt,
        outputByteCount: 32)
}

방어 계층화하기

import CryptoKit
import Foundation
// 1. Key lives in Keychain (biometric-gated)
// 2. Plaintext file written with .completeFileProtection
// 3. Uploads encrypted with AES.GCM before leaving device
let layers = "defense in depth"
_ = layers

빠른 확인

복습