iOS Development Web chapter-Data security

In the network application, the time to ensure that the user data security, so to encrypt. The MD5 algorithm is used in many countries. features of the MD5 algorithm: * The same data encryption results are the same. (32 characters) * irreversible. (Cannot reverse decrypt) * Can be used for file check/fingerprint identification. The MD5 algorithm is public, and the MD5 algorithm is already packaged in iOS. It can be written as a string classification: [OBJC]View Plaincopy

2. -(NSString *) MD5String
4. {
6. Const Char char*string = self.  utf8string;
8. int length = (int) strlen (string);
10. unsigned char bytes[cc_md5_digest_length];
12. CC_MD5 (string, length, bytes);
14. return [self stringfrombytes:bytes length:cc_md5_digest_length];
16. }

It is important to encrypt the user's login data in an iOS program. To do so, even if the data is hijacked, the original data can not be restored to the point. one, ordinary MD5 encryptionToo simple MD5 encryption can easily be cracked. Typically used when MD5 encryption is performed "Add Seasoning"The method. Simple MD5 can be cracked on this website: www.cmd5.com The following is the method for MD5 encryption: tokenA string that is added, which can be a grotesque string of any length. [OBJC]View Plaincopy

2. -(ibaction) Login: (UIButton *) Sender {
4. [self postlogin];
6. }
10. /** when submitting user data, it is relatively safe to post. Convert user data into a model at the same time * *
12. -(void) Postlogin {
14. //1.url
16. nsstring *urlstr = [NSString stringwithformat:@ "http://localhost/login.php"];
18. Nsurl *url = [Nsurl urlwithstring:urlstr];
20. //2. Establishing Mutablerequest
22. nsmutableurlrequest *request = [nsmutableurlrequest requestwithurl:url];
26. //3. Setting
28. Request.  HttpMethod = @ "POST";
30. //Request body can be found in Firebug
34. NSString *pwd = self. userpwd. Text;
36. //Add salt First, encrypt with MD5.  (The server simply stores salt and encryption to save the line).  In reality there is a public/private key, and the server is not simply storing the password.
38. PWD = [pwd stringbyappendingstring:token];
40. PWD = [pwd md5string];
42. NSLog (@ "%@", PWD);
46. nsstring *body = [NSString stringwithformat:@ "username=%@&password=%@", self. Username.  Text, pwd];
48. Request.  Httpbody = [Body datausingencoding:nsutf8StringEncoding];
52. //4. Establish a connection. (data is the fetch, same as Get)
54. [Nsurlconnection sendasynchronousrequest:request queue:[[nsoperationqueue alloc] init] Completionhandler: ^ (nsurlresponse *response, nsdata *data, nserror *connectionerror) {
56. nsstring *str = [[NSString alloc] initwithdata:data encoding:nsutf8StringEncoding];
58. NSLog (@ "%@,%@", [Nsthread CurrentThread], str);
62. //update display needs to be in the main thread
64. [[Nsoperationqueue Mainqueue] addoperationwithblock: ^{
66. self. Label. Text = str;
68. NSLog (@ "%@,%@", [Nsthread CurrentThread], str);
70. }];
72. }];
74. }

Ii. A more advanced approachUse the concept of public and private keys. A public key (known to all), a private key (known only to the server). The password should be changed dynamically. * User: Encrypt with token+ time, send to Server * Server: Remove user password (with private key when storing), use time + public key to compare with the password sent by the client. (The server also to check the time difference between sending passwords, less than 1 minutes) detailed notes: from Lao Liu. [OBJC]View Plaincopy

2. -(ibaction) Login: (ID) Sender
4. {
6. NSString *pwd = self. Pwdtext. Text;
8. //For MD5 encryption
10. PWD = [pwd stringbyappendingstring:token];
12. //Every time is the same! Example: A hacker intercepts data from a router
14. //You will be able to obtain the password after encryption!
16. PWD = [pwd md5string];
20. //In the server background, a MD5 cipher string that is stored with a private key and is treated with salt
22. PWD = [NSString stringwithformat:@ "%@%@%@", pwd, PublicKey, @ "2014062914:14:30"];
24. //Use date to ensure that the strings generated by the encryption are not the same
26. PWD = [pwd md5string];
30. //content submitted to the server: new password, event that generated the password ,
32. /** 
34. Processing of the server:
38. 1. Remove the user's password from the server (encrypted with the private key)
40. 2. The server knows the shared key and compares it to the client-submitted password based on a given time (dynamically generating a new password)
42. 3. The server also needs to check the event difference of the submitted password, which is within 1 minutes of the date submitted by the client.
44. */
46. NSLog (@ "%@", PWD);
50. [self postlogonwithusername:selfusernametext. Text password:pwd];
52. }
56. #pragma mark-post Login
58. -(void) Postlogonwithusername: (nsstring *) userName Password: (nsstring *) password
60. {
62. //1. URL
64. nsstring *urlstr = @ "http://192.168.25.2/login.php";
66. Nsurl *url = [Nsurl urlwithstring:urlstr];
70. //2. Request,post method, need to establish a mutable request
72. nsmutableurlrequest *request = [nsmutableurlrequest requestwithurl:url];
76. //1> post method, all data transfer involving user's privacy, all need to submit by post!
78. Request.  HttpMethod = @ "POST";
82. //2> Data Body
84. nsstring *bodystr = [NSString stringwithformat:@ "username=%@&password=%@", username, password];
88. //Convert string to binary data
90. Request.  Httpbody = [Bodystr datausingencoding:nsutf8StringEncoding];
94. //3. Send "asynchronous" requests, work on other threads, do not block current thread execution
96. [Nsurlconnection sendasynchronousrequest:request queue:[[nsoperationqueue alloc] init] completionhandler:^ (nsurlresponse *response, nsdata *data, nserror *connectionerror) {
100. //1> JSON, format is and nsdictionary Fast packaging format very
102. //Convert JSON into a dictionary serialization
104. nsdictionary *dict = [nsjsonserialization jsonobjectwithdata:data options:1 error:NULL];
108. czuserinfo *userinfo = [Czuserinfo userinfowithdict:dict];
112. NSLog (@ "%@%@", UserInfo. UserId, UserInfo. userName);
114. }];
118. NSLog (@ "=======");
120. }

Reprint Please specify source: http://blog.csdn.net/xn4545945

iOS Development Web chapter-Data security