在iOS应用程序中存储包含的AWS凭证的最佳位置 [英] Best Place to Store Included AWS Credentials in an iOS Application

问题描述

我计划在即将进行的项目中使用适用于iOS的AWS开发工具包.我需要使用打包的应用程序存储AWS的凭证.最安全的放置位置在哪里?我知道将它们存储在pList中将是一个坏主意.仅将其硬编码"为将要编译的类是否更好?那里有风险吗?

I plan on using the AWS SDK for iOS for an upcoming project. I need to store credentials for AWS with the packed application. Where is the most secure place to place them? I know that storing them in a pList would be a bad idea. Is it better to just 'hard-code' it into a class that will be compiled? Is there any risk there?

推荐答案

我认为从理论上讲完全隐藏凭据是不可能的.也就是说，如果您的编译代码可以读取它们，那么从理论上讲，有权访问编译代码的任何人也可以读取它们.但是不完善的安全性仍然值得.我猜想大多数攻击者只会浏览二进制文件中看起来像秘密密钥的字符串，而不会去麻烦地反编译代码并试图解释其工作原理，因此隐藏凭据的一种方法是存储以编码形式对其进行解码，然后根据需要对其进行解码.这样，解码算法就成为您的密钥，攻击者必须找到并理解它才能提取您的凭据.

I believe that completely hiding the credentials is theoretically impossible. That is, if your compiled code can read them, then in theory so can anyone with access to the compiled code. But imperfect security is still worth something. I'd guess that most attackers would just look through the binary for strings that look like secret keys, and not go to the trouble of decompiling the code and trying to interpret how it works, so one way to hide the credentials would be to store them in an encoded form, then decode them as needed. This way the decoding algorithm becomes your key, and an attacker would have to find and understand it to extract your credentials.

这是使用随机XOR掩码的一种非常简单的方法.将以下伪造的密码替换为您的伪造密码，并记住将NULL终止符(\ 0)保留在适当的位置.将此代码作为独立程序编译并运行:

Here's a fairly simple way to do it using a random XOR mask. Replace the following bogus password with yours, and remember to keep the NULL terminator (\0) in place. Compile and run this code as a standalone program:

#include <stdio.h>

#define PAD_LENGTH 32

int main() {
  int i;
  char c;

  // start with the password
  char password[PAD_LENGTH] = "My AWS Password\0";

  // make a random pad to encrypt it
  printf("PAD:\n{");
  char pad[PAD_LENGTH];
  for (i = 0; i < PAD_LENGTH; i++) {
    c = arc4random() & 0xFF;
    pad[i] = c;
    printf("%#02x", c & 0xFF);
    if (i < PAD_LENGTH - 1) printf(",");
  }
  printf("}\n");

  // make an encrypted version of the password
  printf("KEY:\n{");
  for (i = 0; i < PAD_LENGTH; i++) {
    c = pad[i] ^ password[i];
    printf("%#02x", c & 0xFF);
    if (i < PAD_LENGTH - 1) printf(",");
  }
  printf("}\n");

  return(0);
}

然后将生成的键盘和键复制到这样的代码中(该代码实际上将包含在您的应用程序中):

Then copy the generated pad and key into code like this (which will actually get included with your app):

#define PAD_LENGTH 32

char pad[PAD_LENGTH] = {0x83,0x26,0x8a,0x8b,0xee,0xab,0x6,0xed,0x2e,0x99,0xff,0x23,0x7f,0xef,0xc8,0x8,0x6b,0x8e,0xa4,0x64,0x6d,0xb,0x7,0xd2,0x6a,0x39,0x60,0xa4,0xa9,0xad,0xea,0xb8};
char key[PAD_LENGTH] = {0xce,0x5f,0xaa,0xca,0xb9,0xf8,0x26,0xbd,0x4f,0xea,0x8c,0x54,0x10,0x9d,0xac,0x8,0x6b,0x8e,0xa4,0x64,0x6d,0xb,0x7,0xd2,0x6a,0x39,0x60,0xa4,0xa9,0xad,0xea,0xb8};
for (int i = 0; i < PAD_LENGTH; i++) {
  key[i] = key[i] ^ pad[i];
}
NSString *password = [NSString stringWithCString:key encoding:NSASCIIStringEncoding];

由于这是在公共论坛上，因此您可能需要更改一些内容，例如将键盘的长度更改为不同的长度，将其拆分并与代码重新结合，重新排序等.您还可以存储键盘和按键在代码的远处.一个真正熟练且专心的攻击者无论如何都将能够找到您的密码，但是基本思想是，大多数人扫描二进制文件查找密码都不会这样.

Since this is on a public forum, you might want to change a few things, like making the pads a different length, splitting them up and rejoining them with code, reordering them, etc. You could also store the pad and key in distant parts of the code. A truly skilled and dedicated attacker is going to be able to find your password no matter what, but the basic idea is that most people scanning the binary for a password will not find it as such.

这篇关于在iOS应用程序中存储包含的AWS凭证的最佳位置的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！