CODEWITHSUNDEEP
swiftencryptionrealm
joanna cheung
joanna cheung

Reputation: 161

Realm Encryption - How does it work when shipped with prepopulated data?

I utilized the realm encryption example to make a Key and encrypt the Realm database. Then I used the Realm().writeCopyToPath(_:encryptionKey:) to make a copy to ship with my app as indicated by the documentation. I believe its my lack of knowledge in encryptions, but how does a shipped app know the encryptionKey when the user downloads the application for the first time as the key was stored in the keyChain. I assume that hardcoding the encryptionKey is a bad idea so I was wondering what the correct approach to doing this was. Thank you for your time.

Upvotes: 2

Views: 369

Answers (1)

marius
marius

Reputation: 7806

It's the lack of general technical feasibility, which makes it hard to come up with a solution. When you ship encrypted prepopulated data, you have to include the encryption key as well, which means in effect that the data is not secure anymore because security by obscurity doesn't really work.

If you have some data to prepopulate, which you wouldn't consider to be sensitive, but want to store sensitive user data in your Realm, then I'd recommend loading the plain bundled data from a separate read-only Realm instance and use writeCopyToPath(_:encryptionKey:) at runtime, with a randomly generated key, you can place in the user's keychain.

While if you're afraid that e.g. your level data for your game will be stolen on a jailbroken device, where you can't count on the FairPlay encryption, bundling an encrypted Realm gives you another level of hardening for a possible "attacker". But you should make sure that you obfuscate the encryption key when you integrate it.

Depending on your use-case, you can use one of both ways or combine them both.

Beside that there is a CocoaPods plugin cocoapods-keys, which is a popular way with some great ideas how to manage encryption keys while development.

Upvotes: 4

Related Questions