iOS 上特定于应用程序的数据保护
我在 WWDC 上看过一些有关 iOS5 中数据保护的文档和视频，它看起来非常好，因为它可以加密您的所有应用程序数据，并在您的设备锁定时保持数据受到保护。然而，我发现系统范围的数据保护机制有两个主要问题：
1-如果有人在我的 iPhone 未锁定的情况下偷走它（这通常发生在“偷窃并逃跑”的情况下），它可以可能会将我的 iPhone 插入笔记本电脑并访问未加密的数据
2 - 它迫使我定义一个系统范围的密码，这对某些用户来说似乎很自然，但对很多用户来说仍然很麻烦。我强迫用户定义系统级密码，这似乎是一种滥用行为，尽管我的应用程序是唯一可能真正需要加密的应用程序。而且它的滥用性更大，因为四位密码并不能很好地防止暴力攻击。
所以我的问题如下。是否有任何简单的方法可以使用特定于我的应用程序的密码来加密我的数据，以便用户每次启动应用程序时都必须输入密码，但不必在系统级别定义密码？如果没有，我至少可以使用此类特定于应用程序的密码插入标准数据保护 API 吗？如果不是，是否值得在核心数据之上编写自己的加密层来实现这种情况？或者它是否可能会添加到 iOS 的未来版本中（在这种情况下，我可能会暂时坚持使用系统范围的密码，稍后再升级）？
I've seen some documentation and videos from WWDC about data protection in iOS5 and it seems very nice since it can encrypt all your application data and keep it protected as long as your device is locked. However, I see 2 main problems with that system-wide data protection mechanism:
1- if somebody manages to steal my iPhone while it is not locked (which is typically what happens on a "steal-and-run" case), it can potentially plug my iPhone into a laptop and access my data unencrypted
2- it forces me to define a system-wide passcode, which seems natural to some users but is still cumbersome to a lot of users. And it seems abusive that I force my users to define a system-level passcode even though my app is the only one where encryption might really require it. And it's even more abusive as a four-digit password is not such a good protection against brute force attacks.
So my question is the following. Is there any simple way to encrypt my data with a passcode specific to my application, so that every time a user launches the app, they have to enter the passcode, but they don't have to define one on the system level? If not, can I at least plug into standard data protection API's with such an application-specific passcode? If not, is it worth it to write my own encryption layer on top of core data to enable such a scenario? Or is it something that might be added to future versions of iOS (in which case I'll probably stick with system-wide passcodes for now and upgrade it later)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
其他操作系统上的多个数据保护 API（例如 Windows 上的 DPAPI）允许开发人员为用于保护数据的密钥派生过程提供补充熵。在这些系统上，您可以轻松地从密码中获取该数据。如果没有该引脚，您将无法生成密钥并读取数据。
我在 iOS 上查看并找不到任何与此效果相关的内容，但坦白说，我不是一个客观的 C 程序员，阅读苹果的文档对我来说是一种痛苦，而且我并没有太努力地寻找。
Several data protection api's on other operating systems (e.g. DPAPI on windows) allow developers to provide supplemental entropy for the key derivation process used to protect the data . On those systems, you could easily derive that data from a pin number. Without that pin, then you can't generate the key and read the data.
I looked and couldn't find anything to this effect on iOS, but I am not an objective c programmer so frankly , reading apple's documentation is a pain for me, and I didn't look too hard.
根据您的使用案例，您可能希望在应用程序中启用数据保护，但如果用户不使用密码，则不会为您提供太多保护。我不知道启用该权利是否会强制使用密码。
您可以采取这样的方式：要求应用程序在启动时具有 PIN 码，然后使用该 PIN 码以及其他一些数据数据来生成常见加密功能的密钥。
https://developer.apple.com/reference/security
Depending on your use case you may want to enable data protection in your app, but if the user doesn't use a passcode it won't give you much protection. I don't know if enabling that entitlement will force a passcode.
You could take the path to require that the app have a pin code at launch and then use that pin code along with some other data data to generate a key for the common crypto functions.
https://developer.apple.com/reference/security