1

I'm building an iOS app but my app binary shows all my NSStrings that I've. Is there a way to encrypt it ? I want to hide all my NSStrings from my app binary file.

4

2 Answers 2

2

You would not be able to encrypt your app binary in an secure way. You would at least need to pass the key next to the application bundle so the operating system would be able to encrypt the application before running it. And when you pass the key next to the application somebody interested in your application would be able to decrypt it too. So encrypting the whole binary file would be useless.


Do you ship passwords or API keys with your app bundle?

The best deal would be to redesign your application so such stuff isn't needed. You could try to prevent user from reading them directly out of your binary file, but they would always be able to get them. A couple of very smart guys have already tried that and failed, so don't waste your time trying to be better then them. So don't ship passwords or API keys!


If you still want to ship sensitive data in your binary:

You could give the following a try:

NSString *encryptedSensitiveString = @"mysensitivdatapreviosulyencpryted"; // <- this will be stored in your binary since it's a constant string

NSString *sensitiveString = [someHiddenKey decryptString:encryptedSensitiveString];
// Now you can use your sensitive string which is decrypted at runtime

If you are looking for some cryptography library for Objective-C you can use MIHCrypto framework based on OpenSSL.

7
  • How would you redesign your application so API keys aren't needed in the binary?
    – Andrew
    May 18, 2014 at 21:34
  • 3
    @Santa First answer these questions: What are you protecting? Who want's it and how much are they willing to pay or do to get it. What is the value to the person who owns it. For example if you are trying to protect against a government and they really want it: give up. If you are protecting against a nosy kid, obfuscate.
    – zaph
    May 18, 2014 at 21:49
  • 1
    @Santa By limiting the API to only allow the same actions the user could do via the user interface anyway. For example: Don't grant access to an database from app and instead provide an web service which interface only allows expected actions will prevent you from shipping database credentials. This example is adoptable for most other security problems too.
    – miho
    May 18, 2014 at 22:07
  • There isn't just a simple way of encrypting string ? May 18, 2014 at 23:13
  • No need to import a third-party cryptographic library; Apple has included CommonCrypto in iOS since iOS 5. Link to cryptographic services guide: developer.apple.com/library/mac/documentation/security/… May 19, 2014 at 0:36
1

As someone already stated, building or decrypting the strings dynamically is one choice.

Another is to use a 3rd party app protection system, like Arxan. I have never personally used it so can't really recommend it, but it does all sorts of obfuscation to prevent users from peeking into your app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.