MYCrypto

Version 0.51 — 12 May 2012

By Jens Alfke

Introduction

MYCrypto is a high-level cryptography API for Mac OS X and iPhone. It's an Objective-C wrapper around the system Keychain and CSSM APIs, which are notoriously hard to use, as well as CommonCrypto, which is easier but quite limited.

MYCrypto gives you easy object-oriented interfaces to:

• Symmmetric cryptography (session keys and password-based encryption)
• Asymmetric cryptography (public and private keys; digital signatures)
• Creating and managing X.509 certificates (for use with SSL, S/MIME and CMS)
• Cryptographic digests/hashes (effectively-unique IDs for data)
• The Keychain (a secure, encrypted storage system for keys and passwords)
• Cryptographic Message Syntax [CMS] for signing/encrypting data
• Parsing and generating ASN.1, BER and DER (the weird binary data formats used by crypto standards)

It's open source, released under a friendly BSD license.

Setup

Kindly direct your eyes to the Setup page...

Overview

The class hierarchy of MYCrypto looks like this:

• MYKeychain
• MYKeychainItem
  • MYKey
    • MYSymmetricKey
    • MYPublicKey
    • MYPrivateKey
    • MYCertificate
    • MYIdentity
• MYDigest
  • MYSHA1Digest
  • MYSHA256Digest
• MYCryptor
• MYEncoder
• MYDecoder
• MYSigner
• MYCertificateInfo
  • MYCertificateRequest

(Italicized classes are abstract.)

Examples

Please see the Examples page.

Current Limitations

• Certificate generation only supports self-signed certs, not cert requests sent to an external signer.
• Some functionality doesn't work on iPhone. The security APIs in iOS are new and rather poorly documented and poorly understood by me. Specifically, anything involving keys not stored in a keychain is unlikely to work. This is mostly an issue with symmetric session keys.

Current API limitations, to be remedied in the future:

• No API for accessing Keychain passwords; fortunately there are several other utility libraries that provide this. And if your code is doing cryptographic operations, it probably needs to store the keys themselves, not passwords.
• Error reporting is too limited. Most methods indicate an error by returning nil, NULL or NO, but don't provide the standard "out" NSError parameter to provide more information. Expect the API to be refactored eventually to remedy this.
• Some functionality is not available on iOS, generally because there is no underlying API for it on that platform, or because the API is different from the Mac OS API and I haven't written wrapper code for it yet.

References

• Security Overview (Apple)

• Secure Coding Guide (Apple)

• Common Security: CDSA and CSSM, Version 2 (The Open Group)

• RFC 3280: Internet X.509 Certificate Profile

• A Layman's Guide to a Subset of ASN.1, BER, and DER (Burton S. Kaliski Jr.)

• X.509 Style Guide (Peter Gutmann)

• Practical Cryptography (Ferguson and Schneier)

• Handbook of Applied Cryptography (Menezes, van Oorschot, Vanstone) — free download!

• The Devil's InfoSec Dictionary (CSO Online)