可以有一个“秘密”吗？已编译的 Obj-C 应用程序中的字符串会被发现吗？
我需要将数据从我的 iPhone 应用程序发送到我的网络服务器，然后返回。为了安全地做到这一点，我使用了加密算法。它需要服务器和用户都必须知道的密钥才能进行解密。我当时正在考虑在我的应用程序和服务器上使用一个简单的静态字符串作为密钥，但后来我想起编译后的代码仍然可以反汇编和查看，但只能在一定程度上进行。
那么，通过将加密方法和“秘密”字符串放入应用程序的源代码中，我的安全性如何？还有其他方法可以安全地完成应用程序和服务器之间的通信吗？
谢谢。
I need to send data from my iPhone application to my webserver, and back. To do this securely, I'm using an encryption algorithm. It requires a key that must be known by both the server and the user so that decryption can take place. I was thinking about just using a simple static string in my app and on the server as the key, but then I remembered that compiled code can still be disassembled and viewed, but only to a certain extent.
So, how safe would I be by placing the encryption methods and "secret" string in the source code of my app? Are there any other ways to accomplish communication between an app and server securely?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
是的，可以很容易地找到它。在可执行文件上运行
strings程序，您可能会找到它。此外，程序中的任何内容都可以“找到”，因为它必须开放供阅读。使用 SSL 进行安全连接。它使用非对称加密，这意味着加密数据的密钥与解密数据所需的密钥不同。这样，即使攻击者发现了您的加密密钥，他们仍然无法使用它进行解码。所有主要的 HTTP 服务器和客户端库都支持 HTTPS，这就是它的作用。
Yes, it can be found rather easily. Run the
stringsprogram on your executable and you'll probably find it. Besides, anything in your program can be "found", since it's necessarily open for reading.Use SSL for secure connections. It uses asymmetric encryption, which means the key to encrypt the data is not the same that will be required to decrypt it. That way, even if attackers find out your encryption key, they still can't use it to decode. All major HTTP servers and client libraries support HTTPS, and that's what it does.
您认为“一定程度”具体是指什么？您的应用程序包含的每条指令和每条数据都可供查看。此外，对每个设备使用相同的密钥是加密疯狂的终极表现。
只需使用 HTTPS。 SSL/TLS 是一种安全、经过验证的技术，内置于每个主要 HTTP 服务器和每个主要 HTTP 客户端库中。
What "certain extent" do you think that is exactly? Every instruction and every piece of data your application contains is open to possible viewing. Besides, using the same key for every device is the ultimate in cryptographic insanity.
Just use HTTPS. SSL/TLS is a secure, proven technology built into every major HTTP server and every major HTTP client library.
您使用对称算法。如果您需要高安全性，也许您应该考虑采用非对称方法。这样，您甚至可以在每次会话时重新创建密钥，并且只需要交换公钥。
这里有一些例子：
You use a symmetric algorithm. Maybe you should consider to have an unsymetric method if you need a high security. That way you could even recreate the keys at i.e. every session and only need to exchange the public key.
Here some examples:
iOS 具有钥匙串服务，用于安全且（相对）轻松地存储加密密钥等内容。查看 钥匙串服务编程。
您可能需要的所有加密 API 也可以在 libSystem 中包含的 CommonCrypto 库中找到。简而言之，在保护 iOS 应用程序时无需走捷径。
iOS has Keychain Services for storing things like encryption keys securely and (relatively) easily. Check out Keychain Services Programming.
All of the crypto APIs you're likely to need are also available in the CommonCrypto library included in libSystem. In short, there is no need to take shortcuts when it comes to securing your iOS applications.
正如其他人所说，您的提议是完全不安全的。如果有人关心您的应用程序，他们会在发布后 10 分钟内将密钥发布到互联网上。
您需要研究的内容包括：
（注意 - 我并不是说这些是您问题的解决方案，但了解它们将使您了解所涉及的问题，并更好地准备您选择解决方案）
另外一点，为什么不能只使用 HTTPS 连接？
最后，如果此加密方案正在保护关键数据，那么您可能最好聘请顾问来帮助您，因为作为该主题的新手，您肯定会犯一些基本错误。
As others have said, what you're proposing is completely insecure. If anyone cares about your app, they'll publish the secret key on the Internet within 10 minutes of its release.
Things you need to research are:
(Note - I'm not saying those are the solution to your problem, but learning about them will educate you in the issues involved and better prepare you to pick a solution)
On an additional note, why can't you just use an HTTPS connection?
Finally, if this encryption scheme is protecting critical data, you'd probably be well served to hire a consultant to help you, since as a newbie to the subject, you're sure to make basic mistakes.