13

我有一个快速的问题:

我下载了一个 iOS 应用程序,它使用 NSFileProtectionComplete 类来保护包含敏感信息的 sqlite 文件。

根据 iOS 安全文档 ( http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf ),当设备 (iPhone/iPad) 与笔记本电脑配对时,笔记本电脑会从移动设备 。密钥包包含解密设备信息所需的所有类密钥。

但是,我注意到当我将设备与笔记本电脑配对并使用 iExplorer 浏览文件系统时,sqlite 文件仅在设备解锁时可用。当手机被锁定(仍然配对)时,文件不可读。未使用 NSFileProtectionComplete 的文件可以在设备锁定时查看。

如果托管密钥包包含解密信息的所有类密钥,为什么我必须解锁设备才能通过 iExplorer 访问它?

我在 iPad3 上使用 iOS 6.0 并使用 ios-dataprotection 工具 ( https://github.com/ciso/ios-dataprotection ) 来确定文件使用的数据保护类。

iOS 应用程序:AccountVault
文件:PointMinder.sqlite

任何帮助将不胜感激。

谢谢。

4

2 回答 2

7

From documentation file you've linked:

Complete Protection (NSFileProtectionComplete): The class key is protected with a key derived from the user passcode and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again.

So device should be unlocked if you want to access that files. That is how Apple made it.

Edit: Found in "Hacking and Securing iOS Applications":

Protection class keys are master encryption keys used to unlock files based on their access policy. Protection classes are the encryption mechanism used to enforce the access policies of files.

Some files are so important that the operating system should be able to decrypt them only when the device’s user interface is unlocked. These files’ encryption keys are wrapped with a class key that is available only after the user has entered his passcode. When the device locks again, the key is wiped from memory, making the files unavailable again.

Protection class master keys are stored in an escrow known as a keybag. The keybag contains the encrypted protection class master keys, as well as other keys to system files on the device. The system keybag is encrypted using another encryption key named BAGI, which is also stored in the effaceable storage of the NAND. Whenever the user authenticates to meet a specific security protection policy, the encrypted keys in the keybag can be decrypted.

So keys for that files are transferred, but are encrypted. When you enter your passcode, OS decrypt that key and it can then be used to decrypt files protected with it.

于 2013-03-21T10:43:19.900 回答
0

这仅适用于我的应用程序中的 SQLite 数据库,而不适用于我希望的其他资源。但是,在锁定设备并等待几分钟 iExplore 仍然打开并且设备仍然连接后,我仍然能够访问数据库。如果我断开 iPad 并重新连接,我猜 iExplore 会强制刷新,然后我就无法访问数据库。所以不确定它是否只是在内存中具有旧的“未加密”数据库信息或什么。

于 2013-04-02T19:00:12.663 回答