I've been told that iOS Keychain has a bug where it sometimes returns null values. The dev who encountered this issue suggested rolling out our own password storage solution instead of using Keychain, so that we can bypass the bug. He was thinking of storing passwords encrypted with RNCryptor. Is this safe to do? More specifically, is it as safe as storing the passwords in Keychain? If so, where should it be stored, and what encryption password or key should be used?
1 Answer
Rule number one with crypto systems is don't re-invent the wheel. Yes, you could implement a secure password store with RNCryptor, but you would need an expert to audit your code to make sure the proper protocol was followed. That could get expensive.
If what you're seeing with the iOS keychain truly is a bug, it will likely be patched. Check out these posts to see if they might be related to your problem:
https://stackoverflow.com/questions/10536859/ios-keychain-not-retrieving-values-from-background/10583042#10583042 https://forums.developer.apple.com/thread/26168
