Question

I have to send a username and password from my iphone app to a ASP server page, and I will encrypt them using: http://iphonedevelopment.blogspot.com/2009/02/strong-encryption-for-cocoa-cocoa-touch.html. What is the best way to decrypt these strings on the ASP page? I found some examples, but since the encryption will happen on two completely unrelated sides, I think I need to hard code the key in on both sides, and I can’t find any examples that don’t have use generated keys.

Thanks!

Answer 1

Yes, key management is a big problem. You will have to have the keys on both sides, on iOS you can save the key in the Keychain, that is secure but the process to get it there securely is more difficult.

The other main issue is getting all the parameters the same on both sides. Of particular interest are

1. encryption key value and size
2. mode: CBC, ECB, etc. (you should probably be using CBC)
3. initialization vector (iv) is needed for most modes
4. padding method: PKCS7, etc. (AES is a block cypher and needs input
   in a multiple of block size)