Hi Folks,
I have a need to create and store a 256 bit symmetric key that I use to encrypt and decrypt data stored on disk. There is also a need to continue to do this both in the backgroud and in the application extensions.
As far as I know, SE does not work with symmetric key, but there is an option to encrypt the symmetric key with an SE-protected asymmetric key. The question arises, how is this different from just storing the key in Keychain, since I can't take advantage of SE's main advantage of not storing the key in memory, even for a short time. (Anyway, I can't not store the key in memory anyway, because the key is used by a third-party framework.)
Should I also use SE for this purpose, decrypt my symmetric key, give the symmetric key to the framework for a short time and then zeroize it?
This isn’t the first time this issue has come up.
how is this different from just storing the key in Keychain
It isn’t, fundamentally. As you’ve noted, the key advantage of an SE-protected key is that the raw key bits never show up in your address space. That’s not an option when dealing with symmetric keys.
Anyway, I can't not store the key in memory anyway, because the key is used by a third-party framework.
OK.
Should I also use SE for this purpose, decrypt my symmetric key, give the symmetric key to the framework for a short time and then zeroize it?
That’s a question you’ll have to answer for yourself. I can explain how our APIs work, but what you should do depends on a variety of factors (your security goals, the complexity of adding more code, whether you’re subject to regulatory constraints, what you boss wants, and so on).
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
