4

I am trying to use the iPhone's PKI libraries to encrypt a short string (12345678), but I keep getting the error -9809 (i.e. errSSLCrypto) whenever I try to use SecKeyEncrypt. The SecureTransport.h header file describes this error simply as "underlying cryptographic error", which wasn't very meaningful.

My code is as follows:

- (NSData *)encryptDataWithPublicKey:(NSString *)plainText {

    OSStatus result = -1;

    NSData *plainTextData = [plainText dataUsingEncoding:NSASCIIStringEncoding];
    size_t plainTextLength = [plainTextData length];

    SecTrustRef trustRef;
    SecTrustResultType trustResult;

    SecPolicyRef policy = SecPolicyCreateBasicX509();

    result = SecTrustCreateWithCertificates(m_oCert, policy, &trustRef);

    if (result != errSecSuccess) {
        NSLog(@"Trust create failed with code: %d",result);
        return nil;
    }

    result = SecTrustEvaluate(trustRef, &trustResult);

    if (result != errSecSuccess) {
        NSLog(@"Trust eval failed with code: %d",result);

        CFRelease(trustRef);
        return nil;
    }

    SecKeyRef publicKey = SecTrustCopyPublicKey(trustRef);

    uint8_t *cipherTextBuf = NULL;
    size_t cipherTextLen = 0;

    size_t keyBlockSize = SecKeyGetBlockSize(publicKey);
    int maxInputSize = keyBlockSize - 11; //If using PKCS1 Padding, else keyBlockSize

    if (plainTextLength > maxInputSize) {
        //Fail
        NSLog(@"Data size is larger than max permitted!");

        CFRelease(trustRef);
        CFRelease(publicKey);
        CFRelease(policy);

        return nil;
    }

    cipherTextBuf = malloc(sizeof(uint8_t)*keyBlockSize);
    memset(cipherTextBuf,0,keyBlockSize);

    //result = SecKeyEncrypt(publicKey, kSecPaddingPKCS1, plainTextBuf, plainTextLength, cipherTextBuf, &cipherTextLen);
    result = SecKeyEncrypt(publicKey, kSecPaddingNone, (const uint8_t *)[plainTextData bytes], plainTextLength, cipherTextBuf, &cipherTextLen);

    NSData *cipherText = nil;
    if (result == errSecSuccess) {

        cipherText = [NSData dataWithBytes:cipherTextBuf length:cipherTextLen];

    } else {
        NSLog(@"Error detected: %d",result);
    }

    free(cipherTextBuf);
    cipherTextBuf = NULL;

    CFRelease(trustRef);
    CFRelease(publicKey);
    CFRelease(policy);

    return cipherText;
}

It does not matter what padding I use, they both give the same error. The public key is derived from a certificate supplied by my client, and I've checked to make sure that the key is valid. What am I doing wrong and how do I use the function properly?

3
  • Thax for Your function it helped me to encrypt. But I am getting weird characters in encrypted string while encrypting. Any idea ? Aug 13, 2012 at 11:28
  • Make a new question and post your code sample, and add the link as a comment. I will take a look at it. Aug 13, 2012 at 11:49
  • what is m_oCert here?
    – user5180348
    Jul 10, 2017 at 10:13

1 Answer 1

7

When using SecKeyEncrypt, the input cipherTextLength should be the the size of the output buffer. Setting

size_t cipherTextLen = keyBlockSize;

solved the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.