iPhone Security: Understanding the KeyChain Nicholis Bufmack and Ryan Thomas CS 691 Summer 2009

Presentation Outline Mobile security issues The iPhone KeyChain Authentication Certificate storage Code signing and publisher verification Final Comments References

Mobile Security Issues: The Problem Mobile devices can connect to the internet. This brings with it the same problems as more traditional computing. Additionally, more and more mobile devices allow users to download and install custom applications. With both issues in mind, the developer must have a clear security solution in mind while simultaneously considering issues of limited processing power and memory.

Mobile Security Issues: The Problem (continued) Traditional approach includes authentication services, keys, and certificates, as well as traditional shared key encryption. Different developers using custom mechanisms leads to potential security gaps and management problems. Most efficient approach is to have a shared repository for security tokens and a API for interfacing with the token library.

The iPhone Keychain 13.7 million iPhones sold in 2008 iPhone OS is based on the Mac OS X Security is handled by the Security Framework The storage for passwords, accounts, certificates, and keys is called the Keychain. On the Mac, the Keychain can be easily accessed to add, delete, and modify security tokens.

The iPhone Keychain (continued)

Security tokens are stored by Keychain Keychains allow security tokens to be stored in logical groupings Everyone has a login, system, and system store Keychain One Keychain must be the default. This is the first place an application usually looks for a security token. Within a Keychain, tokens are categorized.

Authentication The Keychain can act as a simple password/username repository keyed on the application or service. The Keychain can also act as an intermediary agent presenting authentication credentials on behalf of a user, service, or application. Authentication tokens within the Keychain are encrypted.

Certificate Storage The Keychain supports X.509 certificate storage. RSA encryption Key storage and use Many helper functions exist to ease development Root certificates are stored enabling verification of certificate chains.

Code Signing and Publisher Verification Code signing allows a software publisher to sign code for installation. Users of the software can then validate the identity of the publisher before installation. Useful for controlling proliferation of malware. Signing is based on presentation of a developer's certificate. Extra steps for Apple developers if they want to test on a device!

Final Comments The Keychain API is powerful and robust, but may be daunting to the novice. Those familiar with the OpenSSL library will have an easier time of it. In fact, it's easy to port algorithms from OpenSSL to the Keychain API. Implementations are somewhat different from platform to platform: what works on the Mac may need to be modified slightly for the iPhone.

References Apple Developer Connection. Talukder, Asoke and Roopa Yavagal Mobile Computing. New York: McGraw-Hill Professional