Search code examples
iossecuritynsdocumentdirectory

How do I secure data downloaded from a server on the user's device?


I am developing an App which will download some images from a server and save it on user's device. But what I am really concerned about is that these images should not be easily accessible by other apps or THE USER.

One approach could be that my App encrypts the images and saves them in the documents directory and decrypts them when required, but I think that it would make loading the images into UIImageView considerably slow.

There are many games which don't include large resources into their App-bundle to keep the App-size small and download the heavy resources later.

Where exactly do they save those resources?

And how do they secure them from being copied very easily from the directory where they are stored?


Solution

  • Probably because of trying to secure the files from the user the best option is to encrypt them with AES and saving them in the user area, Documents or Library directory or subdirectory thereof.

    You are better off using Common Crypto. If RNCryptor suits you needs use it, it uses Common Crypto under the hood. Otherwise there is plenty of sample code for encrypting using Common Crypto here on SO.

    Key the key should be random bytes as is the iv, save the key in the Keychain. Use AES in CBC mode with PKCS7 padding.

    If you really want good security hire a cryptographic domain expert, the overall security is not trivial to get right. Don't forget the server and at a minimum use two factor authentication to it.

    The decryption time should not be a problem, much faster that coming from a server.