0

When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite database on iOS and it is retrieved from the database when you make API requests. However, I'm not sure how safe this is. On the backend, the user and backend team have the ability to delete the API key and we are using SSL.

I've thought about keychains, but I was told it doesn't really protect much.

https://stackoverflow.com/questions/14778429/secure-keys-in-ios-app-scenario-is-it-safe/14865695#14865695

1

The answer you linked, from 2013, is out of date. You can have secure enclave-backed Keychain private keys now. See Apple's article on how to store private keys in Keychain.

You will have to re-architect your API to use a public key scheme, but there is no way around this, since any fixed API key will require the key to be in memory at some point anyway.

2
  • The keychain won't be able to protect my API key because it will be in memory at some point, is that correct?
    – Curt Rand
    Sep 13 '18 at 16:32
  • @CurtRand That is correct. Your API will have to be changed so that it verifies a public key signature instead or in addition.
    – user71659
    Sep 13 '18 at 16:48
0

If I understand it correctly, in your use case, the user is "given a unique API key" (generated somewhere outside the keychain?). In that case, your use case is not supported by the Secure Enclave-backed keychain. As Apple's article says,

Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security.

Let's say, however, you do want to use an API key generated within the Secure Enclave, then it'd have to be a 256-bit elliptic curve key, and can only be used in certain supported ways (also in the same Apple article):

Stores only 256-bit elliptic curve private keys. These keys can only be used for creating and verifying cryptographic signatures, or for elliptic curve Diffie-Hellman key exchange (and by extension, symmetric encryption).

Furthermore, no matter how such an API key is protected within the Secure Enclave, it still has a vulnerability with access control. As Apple's design relies on entitlements to control access. So only a legitimately authorised app should have the right entitlements to access its own keys. But with privilege escalation or jailbreak, entitlements can be set for other apps to access your apps keys as well. See the Keychain Dumper project for a proof of concept.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.