Encrypt and decrypt data using RSA in iOS

RSA algorithm is an asymmetric encryption algorithm, which is often used for encrypting data transmission. If the number digest algorithm is combined, it can also be used for file signing.

This article discusses how to use RSA to transfer encrypted data in iOS.

This article environment

• Mac OS
• OPENSSL-1.0.1J, OpenSSL requires a 1.x version and is recommended for use with [homebrew] (http://brew.sh/) installation.
• Java 8

RSA Fundamentals

RSA encrypts the data using the "key pair". Before encrypting and decrypting data, you need to be a public key and private key.

• Public key: Used to encrypt data. Used for public, typically stored in data providers, such as iOS clients.
• Private key: Used to decrypt data. Must be kept secret and private key leaks can create security issues.

The Security.framework in iOS provides support for the RSA algorithm. This method requires the key pair to be processed, the certificate is generated according to public key, and the secret key of the P12 format is generated by private key.

In addition to Secruty.framework, the OpenSSL library can be compiled into an iOS project, which provides a more flexible way to use it.

This article uses the security.framework approach to RSA.

Using OpenSSL to generate a key pair

Github gist:https://gist.github.com/lvjian700/635368d6f1e421447680

Shell Code

2. #!/usr/bin/env Bash
4. echo "generating RSA key pair ..."
6. echo "1024x768 RSA Key:private_key.pem"
8. OpenSSL genrsa-out Private_key.pem 1024x768
12. echo "Create certification require FILE:RSACERTREQ.CSR"
14. OpenSSL Req-new-key private_key.pem-out RSACERTREQ.CSR
18. echo "Create certification using X509:RSACERT.CRT"
20. OpenSSL x509-req-days 3650-in rsacertreq.csr-signkey private_key.pem-out rsacert.crt
24. Echo "Create public_key.der for IOS"
26. OpenSSL x509-outform der-in rsacert.crt-out Public_key.der
30. Echo "Create private_key.p12 for IOS. Please remember your password. The password is used in IOS. "
32. OpenSSL pkcs12-export-out Private_key.p12-inkey private_key.pem-in rsacert.crt
36. Echo "Create Rsa_public_key.pem for Java"
38. OpenSSL rsa-in private_key.pem-out rsa_public_key.pem-pubout
40. Echo "Create Pkcs8_private_key.pem for Java"
42. OpenSSL pkcs8-topk8-in private_key.pem-out Pkcs8_private_key.pem-nocrypt
46. Echo "finished."

Tips:

• When the certificate is created, Terminal prompts for the certificate information. Enter the corresponding information according to the wizard OK.
• When you create a P12 key, you are prompted for a password, which must be remembered and then used.
• If there is a problem with the above instructions, please refer to the latest OpenSSL official documentation, whichever is official. Before searching for instructions on the Internet, after being caught in a lap, they would still be chewing on official documents. Each instruction document will have a few sample at the end, refer to sample.

How iOS loads Use certificates

Add the following code to the project:

https://gist.github.com/lvjian700/204c23226fdffd6a505d

The code relies on the BASE64 encoding library, and if you use Cocoapods, you can say the following dependencies added to Podfile:

Ruby Code

1. Pod ' base64nl ', ' ~> 1.2 '

Encrypt data

CPP Code

2. Rsaencryptor *rsa = [[Rsaencryptor alloc] init];
6. NSLog (@"encryptor using RSA");
8. NSString *publickeypath = [[NSBundle mainbundle] pathforresource:@"Public_key" oftype:@"der"];
10. NSLog (@"public key:%@", Publickeypath);
12. [RSA Loadpublickeyfromfile:publickeypath];
16. NSString *securitytext = @"Hello ~";
18. NSString *encryptedstring = [RSA Rsaencryptstring:securitytext];
20. NSLog (@"Encrypted data:%@", encryptedstring);

__[rsa rsaencryptstring:securitytext]__ returns the decrypted Base64 encoded string:

Console out wrote encrypted data:i1mnu33cu7qcgac9uo2bxv0vyfjsqawyc3dz+p8jm0g2emcclarrr5r2xlddxqvtkj+ujbes7tt+ Agkk1ndoqvojby+jkmrpachmrbv2jvi3cezyqg955jrdsau21nzqe8xwtec3yzp+tacpdp4b3cyy0u8n2rcsfwyxu0ykpxe=

Decrypt data

Decoding under iOS requires the private key to be loaded before decoding the data. Decode the time first Base64 decode, and then in the private key decrypt encrypted data.

CPP Code

1. NSLog (@"decryptor using RSA");
2. [RSA Loadprivatekeyfromfile:[[nsbundle Mainbundle] pathforresource:@"Private_key" oftype:@"P12"] password:@  "123456"];
3. NSString *decryptedstring = [RSA rsadecryptstring:encryptedstring];
4. NSLog (@"decrypted data:%@", decryptedstring);

The decrypted data is then output:

Console writes decryptor using RSA
Decrypted Data:hello ~

Decoding data on the server side (Java)

Decoding in Java requires the PKCS8 private key generated using the following instructions:

Gen Shell wrote the OpenSSL pkcs8-topk8-in private_key.pem-out pkcs8_private_key.pem-nocrypt

Specific decoding steps:

1. Load PKCS8 private key:
1. Read private key file
2. Remove the "-----begin private Key-----" and "-----begin private Key-----" from the private key tail
3. Remove a line break from private key
4. BASE64 decoding of processed data
5. Generates a private key using the decoded data.
2. Decrypt data:
1. BASE64 Decoding of data
2. Use RSA decrypt data.

Here I decode "Hello ~" encrypted data from iOS in Java:

Java code

2. Import javax.crypto.BadPaddingException;
4. Import Javax.crypto.Cipher;
6. Import javax.crypto.IllegalBlockSizeException;
8. Import javax.crypto.NoSuchPaddingException;
10. Import java.io.IOException;
12. Import Java.nio.charset.Charset;
14. Import Java.nio.file.Files;
16. Import java.nio.file.Paths;
18. Import java.security.InvalidKeyException;
20. Import Java.security.KeyFactory;
22. Import java.security.NoSuchAlgorithmException;
24. Import Java.security.PrivateKey;
26. Import java.security.spec.InvalidKeySpecException;
28. Import Java.security.spec.PKCS8EncodedKeySpec;
30. Import java.util.Base64;
34. Import static Java.lang.String.format;
38. Public class Encryptor {
42. public static void Main (string[] args) throws IOException, NoSuchAlgorithmException, Invalidkeyspecexception, Nosuchpaddingexception, InvalidKeyException, Badpaddingexception, illegalblocksizeexception {
44. Privatekey Privatekey = Readprivatekey ();
48. String message = "afppafptbmbomzd55cjcfrvawuw7+hzkaq16od+6fp0lwz/yc+rshb/ 8cf5bpbluao2eunchnzekxzpipqtcccitkvk6hcfkzs0sn9wohlqfyt+i4f/czitwbvajaldz7mkyoiuvm+raxmwrs+  7mlkgyxkd5cfpxestxpmsa5nk= ";
50. SYSTEM.OUT.PRINTLN (Format ("-Decrypt RSA encrypted base64 message:%s", message));
52. //Hello ~, encrypted and encoded with BASE64:
54. byte[] data = encrypteddata (message);
56. String Text = Decrypt (privatekey, data);
58. System.out.println (text);
60. }
64. private static String decrypt (Privatekey Privatekey, byte[] data) throws NoSuchAlgorithmException, Nosuchpaddingexception, InvalidKeyException, Illegalblocksizeexception, badpaddingexception {
66. Cipher Cipher = cipher.getinstance ("rsa/ecb/pkcs1padding");
68. Cipher.init (Cipher.decrypt_mode, Privatekey);
70. byte[] Decrypteddata = cipher.dofinal (data);
74. return new String (Decrypteddata);
76. }
80. private static byte[] EncryptedData (String base64text) {
82. return Base64.getdecoder (). Decode (Base64text.getbytes (Charset.forname ("UTF-8"));
84. }
88. private static Privatekey Readprivatekey () throws IOException, NoSuchAlgorithmException, invalidkeyspecexception {
90. byte[] Privatekeydata = files.readallbytes (
92. Paths.get ("/users/twer/macspace/ios_workshop/security/securitylogin/tools/pkcs8_private_key.pem"));
96. byte[] Decodedkeydata = Base64.getdecoder ()
98. . Decode (new String (privatekeydata)
100. . ReplaceAll ("-----\\w+ PRIVATE KEY-----", " ")
102. . replace ("\ n", "" ")
104. . GetBytes ());
108. return Keyfactory.getinstance ("RSA"). Generateprivate (new Pkcs8encodedkeyspec (Decodedkeydata));
110. }
112. }

The console will output "Hello ~" after the line succeeds.

Summarize

This encrypted transmission will be used in the online banking app. Although the net bank will use the whole station HTTPS scheme, but in the secure login this block will use another certificate to encrypt the login information, so that the double-layer to ensure data security.

Based on RSA encryption and decryption algorithm, it can also be used in digital signature scenarios. I'll be free later. How to use the RSA algorithm to implement the digital signature of the file.

Resources

• Openssl Document
• Load Private Key in Java
• Cryptographic Services Guide

Encrypt and decrypt data using RSA in iOS