Illustration of cybersecurity concepts: a shield protecting data flows
Encryption keeps secrets secretFig. 01

Introduction

In an era where data breaches are becoming increasingly common, encrypting user data in your iOS app is not just a best practice—it's essential. In this post, we'll explore the fundamental concepts of data encryption on iOS, dive into the technical details, and provide practical examples you can implement right away.

What is Data Encryption?

Data encryption is the process of converting readable data (plaintext) into an unreadable format (ciphertext) using an algorithm and an encryption key. Only those with the decryption key can revert the ciphertext back to its original form. This ensures that even if the data is intercepted, it cannot be understood by unauthorized parties.

Types of Encryption in iOS

iOS supports several types of encryption, and it's important to know when and how to use each one:

  • File-Level Encryption: Encrypts files on the device using the Data Protection API.
  • Keychain Encryption: Stores sensitive data like passwords securely in the iOS Keychain.
  • Custom Encryption: For highly sensitive data, you can implement custom encryption using the Security framework by Apple.

File-Level Encryption Using Data Protection API

iOS provides built-in support for file-level encryption through the Data Protection API. By enabling Data Protection, you ensure that files are encrypted automatically when the device is locked.

Enabling Data Protection

To use Data Protection, your app must be configured to support it. This is done by setting the appropriate file protection level when saving files:

Swift code sample showing how to save a file with a data protection level
Saving a file with protectionListing 1

Understanding File Protection Levels

iOS offers several file protection levels, each with different security guarantees:

  • .completeFileProtection: Files are encrypted and inaccessible when the device is locked.
  • .completeUntilFirstUserAuthentication: Files are encrypted until the device is unlocked for the first time after a restart.
  • .completeUnlessOpen: Files are encrypted unless they are open when the device is locked.

Storing Sensitive Data in the Keychain

The Keychain is a secure storage service provided by iOS for storing small amounts of sensitive data, such as passwords, encryption keys, and certificates. Data stored in the Keychain is encrypted and can only be accessed by your app.

Using the Keychain

Storing data in the Keychain is straightforward, but requires careful management to avoid issues such as data loss or unauthorized access. Here's how you can securely store a password:

Swift code sample for saving a password to the Keychain
Saving to the KeychainListing 2
Swift code sample for reading a password from the Keychain
Reading from the KeychainListing 3

In this example, savePassword securely stores a password in the Keychain, and getPassword retrieves it when needed.

Implementing Encryption with the Security Framework

For scenarios where you prefer to use high-level APIs for cryptographic operations, Swift's native Security framework is an excellent choice. Below is an example of securely encrypting and decrypting data using the Security framework:

Encrypting Data

The following example demonstrates how to encrypt data using a public key. This is commonly used for scenarios such as securely transmitting data:

Swift code sample for encrypting data with a public key
Encrypting with a public keyListing 4

Decrypting Data

To decrypt data, you would use the private key corresponding to the public key. Below is an example:

Swift code sample for decrypting data with a private key
Decrypting with the private keyListing 5

Securing User Input and Clipboard Data

Another important aspect of data protection is ensuring that sensitive user input is handled securely and that data isn't inadvertently exposed through the clipboard or screenshots.

Securing Text Input

When dealing with sensitive information, such as passwords or personal data, it's important to use secure text input fields. For instance, setting the isSecureTextEntry property on a UITextField ensures that the input is not displayed as plain text:

Swift code sample enabling secure text entry on a text field
Masking sensitive inputListing 6

This simple step prevents sensitive information from being exposed on the screen.

Protecting Clipboard Data

The iOS clipboard is shared across all apps, which means that any data copied to the clipboard can potentially be accessed by other apps. To protect sensitive data, avoid copying it to the clipboard. If you must use the clipboard, consider clearing it immediately after use:

Swift code sample clearing the clipboard after copying sensitive data
Clearing the clipboardListing 7

Preventing Screenshots

To prevent sensitive information from being captured in screenshots or recorded by screen recording, you can use the isScreenCaptured property and handle it accordingly. Additionally, you can obscure sensitive data when the app is backgrounded:

Swift code sample obscuring app views when the app is backgrounded
Hiding views in the app switcherListing 8

This technique places an overlay on top of your app's UI or applies a blur effect to hide any sensitive content when the app is sent to the background.

Conclusion

Encrypting data in your iOS apps is a crucial step toward ensuring user privacy and security. By using built-in iOS features like the Data Protection API, Keychain, and Security framework, you can protect your users' sensitive information and reduce the risk of data breaches. Additionally, securing user input, clipboard data, and preventing unauthorized screenshots are essential practices to prevent unintended data exposure.

Remember, security is an ongoing process. Always stay updated with the latest best practices and iOS security features to keep your apps secure.

If you found this article helpful, check out the rest of the series on iOS security. Together, we can build safer, more trustworthy apps for everyone.