ios - 解密保存在钥匙串(keychain)中的字符串

Question

在我的应用程序中，我使用这种方法在钥匙串(keychain)中存储了一个加密的 NSString

NSUInteger fieldHash = [myStringToSave hash];
        // Encrypt
        NSString *fieldString = [KeychainWrapper securedSHA256DigestHashForPIN:fieldHash];
        // Save in Keychain
        if ([KeychainWrapper createKeychainValue:fieldString forIdentifier:PASSWORD]) {
            [[NSUserDefaults standardUserDefaults] setBool:YES forKey:PASSWORD];
            [[NSUserDefaults standardUserDefaults] synchronize];

在KeychainWrapper.m中有这个方法

+ (BOOL)createKeychainValue:(NSString *)value forIdentifier:(NSString *)identifier
{

    NSMutableDictionary *dictionary = [self setupSearchDirectoryForIdentifier:identifier];
    NSData *valueData = [value dataUsingEncoding:NSUTF8StringEncoding];
    [dictionary setObject:valueData forKey:(__bridge id)kSecValueData];

    // Protect the keychain entry so it's only valid when the device is unlocked.
    [dictionary setObject:(__bridge id)kSecAttrAccessibleWhenUnlocked forKey:(__bridge id)kSecAttrAccessible];

    // Add.
    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)dictionary, NULL);

    // If the addition was successful, return. Otherwise, attempt to update existing key or quit (return NO).
    if (status == errSecSuccess) {
        return YES;
    } else if (status == errSecDuplicateItem){
        return [self updateKeychainValue:value forIdentifier:identifier];
    } else {
        return NO;
    }
}

还有这个

+ (NSString *)securedSHA256DigestHashForPIN:(NSUInteger)pinHash
{
    // 1
    NSString *name = [[NSUserDefaults standardUserDefaults] stringForKey:USERNAME];
    name = [name stringByAddingPercentEscapesUsingEncoding:NSUTF8StringEncoding];
    // 2
    NSString *computedHashString = [NSString stringWithFormat:@"%@%i%@", name, pinHash, SALT_HASH];
    // 3
    NSString *finalHash = [self computeSHA256DigestForString:computedHashString];
    //NSLog(@"** Computed hash: %@ for SHA256 Digest: %@", computedHashString, finalHash);
    return finalHash;
}

+ (NSString*)computeSHA256DigestForString:(NSString*)input
{

    const char *cstr = [input cStringUsingEncoding:NSUTF8StringEncoding];
    NSData *data = [NSData dataWithBytes:cstr length:input.length];
    uint8_t digest[CC_SHA256_DIGEST_LENGTH];

    CC_SHA256(data.bytes, data.length, digest);

    // Setup our Objective-C output.
    NSMutableString* output = [NSMutableString stringWithCapacity:CC_SHA256_DIGEST_LENGTH * 2];

    // Parse through the CC_SHA256 results (stored inside of digest[]).
    for(int i = 0; i < CC_SHA256_DIGEST_LENGTH; i++) {
        [output appendFormat:@"%02x", digest[i]];
    }

    return output;
}

为了获取存储在钥匙串(keychain)中的值，我正在使用它

+ (NSString *)keychainStringFromMatchingIdentifier:(NSString *)identifier
{
    NSData *valueData = [self searchKeychainCopyMatchingIdentifier:identifier];
    if (valueData) {
        NSString *value = [[NSString alloc] initWithData:valueData
                                                encoding:NSUTF8StringEncoding];
        return value;
    } else {
        return nil;
    }
}

像这样传递标识符 PASSWORD

NSString *myNewString = [KeychainWrapper keychainStringFromMatchingIdentifier:PASSWORD];

问题是它会输出一个我无法使用的加密字符串。关于如何解密它的任何建议？提前致谢

Answer 1

上面的代码没有加密任何东西。您似乎正在通过 NSString hash 然后通过 SHA-256 运行您的值。这两个都是单向哈希。按照设计，它们无法逆转。

总的来说，这段代码非常困惑，不清楚您要实现什么。您通常不会对放入钥匙串(keychain)的数据进行加密。

请注意，您的哈希函数将截断多字节字符串(例如中文)。

const char *cstr = [input cStringUsingEncoding:NSUTF8StringEncoding];
NSData *data = [NSData dataWithBytes:cstr length:input.length];

这应该是:

NSData *data = [input dataUsingEncoding:NSUTF8StringEncoding];