The droid you’re looking for here is
AES.GCM.SealedBox
. This will take data and encrypt it using AES-GCM, our recommended form of symmetric encryption (critically, it’s authenticated encryption).
The encryption key is represented by a
SymmetricKey
value. Unfortunately there is no easy way to derive this directly from a password. The standard way to do this,
PBKDF2, isn’t supported in Apple CryptoKit (r. 51744434).
This means you have to use CommonCrypto to do the key derivation. This is a lot less pleasant than CryptoKit. To get you started I’ve pasted in a wrapper below.
IMPORTANT Make sure you supply salt and choose the rounds wisely. See the Wikipedia article for some advice on that front.
Also, there are better key derivation algorithms you might use for this problem — things like scrypt — but none of those have APIs in the Apple SDKs. You might want to look into third-party implementations.
Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"
func pbkdf2SHA256Key(size: Int, from password: String, salt: Data, rounds: Int) throws -> Data {
precondition(size != 0) // Otherwise `baseAddress` could be `nil`.
let rounds32 = UInt32(rounds) // We trap if you ask for way too many.
return try password.withCString { passwordPtr in
return try salt.withUnsafeBytes { saltBuf in
var output = [UInt8](repeating: 0, count: size)
let err = CCKeyDerivationPBKDF(
CCPBKDFAlgorithm(kCCPBKDF2),
passwordPtr, strlen(passwordPtr),
saltBuf.baseAddress!.assumingMemoryBound(to: UInt8.self),
saltBuf.count,
CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
rounds32,
&output, output.count
)
guard err == 0 else {
throw NSError(domain: NSOSStatusErrorDomain, code: Int(err), userInfo: nil)
}
return Data(output)
}
}
}
