Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

first of all I'm sorry for my bad English!

I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework (https://developer.apple.com/library/mac/#documentation/Cocoa/Reference/Foundation/Classes/NSKeyedArchiver_Class/Reference/Reference.html)

In my Apps, for management of the Apple Leaderboard I used ABGameKitHelper by Alexander Blunck (https://github.com/ablfx/ABGameKitHelper). I have notice that this helper uses AES encryption to save scores in local when the Apple Leaderboard is not accessible (for example there's no network, etc) with the NSKeyedArchiver class.

So, my question: is there a real possibility that an attacker can decode the data written without encryption using NSKeyedArchiver, and understand the key-value pairs? And also modify the score data, reconnect to the network and waiting for automatic Leaderboard update from ABGameKitHelper?

Thanks in advance, Alesanco

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Any NSKeyedArchiver object can be unarchived by anyone if it is not encrypted, since it does not encrypt anything by itself. All NSKeyedArchiver does is, from the Documentation:

NSKeyedArchiver, a concrete subclass of NSCoder, provides a way to encode objects (and scalar values) into an architecture-independent format that can be stored in a file. When you archive a set of objects, the class information and instance variables for each object are written to the archive. NSKeyedArchiver’s companion class, NSKeyedUnarchiver, decodes the data in an archive and creates a set of objects equivalent to the original set.

So, in other words, it creates a structure where each object's content is stored with an identification of its original Class, so the original object can be decoded later. Think of it as a kind of binary XML.

What I recommend you to do is take the NSData created by [NSKeyedArchiver archivedDataWithRootObject:(id)rootObject] and encrypt it using any method you prefer. If data is really secret I recommend using AES256 or Blowfish. When you need to use it, decrypt the data first and then put it in [NSKeyedUnarchiver unarchiveObjectWithData:(NSData *)data].

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.