Networking security

Although intercepted and tampered data may not always be harmful, it can reveal aspects of the app’s workings and behaviors, which can aid in reverse engineering – end-to-end encryption and SSL pinning are two very effective protection techniques against this.

End-to-end encryption (E2EE) is a secure communication method that prevents third parties and intermediaries, including the service provider itself, from accessing data while it is transferred between an app and a server. End-to-end encryption is based on public key infrastructure (PKI) and uses asymmetric encryption to protect data as it travels back and forth between the app and the server.

1. Both the app and the server generate a pair of keys: one public and one private. The public key is used to encrypt data, while the private key is used to decrypt it.

2. The app and server exchange public keys with each other. Public keys can be shared openly without compromising the security of their corresponding private keys.

3. Before sending data to the server the app encrypts it using the server’s public key. Since only the server holds its unique private key, only it can decrypt this data.

4. Similarly, when the server sends data back to the app, it uses the app's public key to encrypt the data, ensuring that only the app can decrypt it using its private key.

The exchange of public keys is crucial for secure end-to-end encrypted communication, as it enables each endpoint to encrypt messages in such a way that only the intended recipient with the matching private key is capable of decrypting and thus understanding them.

SSL pinning is a security process that ensures an app can only communicate with a specific server whose SSL certificate details are stored in the app. This adds an extra layer of security to protect against man-in-the-middle (MITM) attacks, which occur when the real server's public key is replaced during a handshake process. Such manipulation of the public key infrastructure (PKI) allows for secure and encrypted communication to be intercepted and decrypted.

SSL pinning includes two common techniques:

1. Certificate pinning: The app stores the complete certificate of a known server. During the SSL handshake, if the server's certificate does not match the stored one, the connection is terminated.

2. Public key pinning: The app stores only the public key from the certificate, rather than the whole certificate. To establish trust, the app verifies that the public key embedded in the server's certificate matches the locally stored one.

The difference between the two approaches comes down to flexibility. Public key pinning offers more flexibility by allowing you to replace certificates as long as they are signed with the same private key. In contrast, certificate pinning requires updating the app with a new certificate every time the server's certificate changes.

SSL pinning can be easily implemented in Swift using either the popular TrustKit framework or by configuring Alamofire, which you might already be using.

import Alamofire
import Foundation
import Security
// 1. Obtain the public key for the cat-fact.herokuapp.com server using OpenSSL:
// ```
// openssl s_client -servername cat-fact.herokuapp.com -connect cat-fact.herokuapp.com:443 | openssl x509 -pubkey -noout
// ```
let publicKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqg+OEpiG/p3j7WkF+oF370r9SaZpWhwyOV7vdhXFhapCZYbnaOuJL7UWT4l27AoRq2O6+6k9zLa6M8atwFs/VGFT3L+GEC7y5+W0q8D/Q031fmvKIIsBP/NFeNd4vVM/l6EfcgEtrghwqgPl8gmt5DQhWYFHQY85owIaoHFqy3eFAhLcORoFedW/MmjpQ27QR7T3h1/hxgPDEp+wxfTCmn1OCUT7g6RUd8Ya08jDPF/g6Vf1Qmu4+GrHa2xdWxOS7+158TFv1A9wcMDb1HC16zHvQA+T8a+ebpErXiBWmUNzvhYknNJXLfJWiT///9eXm3c6zzdmrWUoKuGegd+1kQIDAQAB"
guard let data = Data(base64Encoded: publicKey) else {
  fatalError("Can't decode public key data: \(publicKey)")
}
// 2. Create SecKey from the public key.
let attributes = [kSecAttrKeyType: kSecAttrKeyTypeRSA, kSecAttrKeyClass: kSecAttrKeyClassPublic]
guard let key = SecKeyCreateWithData(data as CFData, attributes as CFDictionary, nil) else {
  fatalError("Can't create SecKey with the public key: \(publicKey)")
}
// 3. Create associated `host: publicKey` evaluator dictionary.
let evaluators = [
  "cat-fact.herokuapp.com": PublicKeysTrustEvaluator(keys: [key]),
]
// 4. Set up Alamofire trust manager and session.
let serverTrustManager = ServerTrustManager(evaluators: evaluators)
let session = Session(serverTrustManager: serverTrustManager)
// 5. Fetch and print cat facts!
print("😺 Loading cat facts with SSL pinning…")
let result = try await withCheckedThrowingContinuation({ continuation in
  session.request(URL(string: "https://cat-fact.herokuapp.com/facts")!).response { response in
    do {
      let json = try JSONSerialization.jsonObject(with: response.data!)
        continuation.resume(returning: json)
      } catch {
        continuation.resume(throwing: error)
      }
    }
  }
})
print(result)