Apple Opens Cryptographic Libraries to Third-Party Developers to Encourage Security

by

Apple announced yesterday that the company has opened up its cryptographic libraries so that third-party developers can build more "advanced security features" into their apps (via VentureBeat). The cryptographic libraries being opened to developers are the same ones Apple uses to protect iOS and OS X, as Apple notes on its updated site.

crypto libraries
Developers will have access to two of the company's advanced security features, including Security Framework and Common Crypto. Security Framework gives developers tools for organizing certificates, public and private keys, and trust policies, ensuring that all sensitive information is stored privately in a "secure repository for sensitive user data." Common Crypto library provides additional support for symmetric encryption, hash-based message authentication codes, and digests.

Both Security Framework and Common Crypto rely on the corecrypto library to provide implementations of low level cryptographic primitives. This is also the library submitted for validation of compliance with U.S. Federal Information Processing Standards (FIPS) 140-2 Level 1. Although corecrypto does not directly provide programming interfaces for developers and should not be used by iOS or OS X apps, the source code is available to allow for verification of its security characteristics and correct functioning.

Check out Apple's official website for reference sheets, service guides, and links to the open source releases for Security Framework and Common Crypto libraries.

Top Rated Comments

SpinThis! Avatar
68 months ago

That was my thought as well. Plus, could this knowledge enable a small "back door" that the government has been pestering Apple about?

No. It doesn't matter. Good security isn't based on obscurity. The current security we have is based on our collective knowledge of mathematics. It's good that Apple is opening this up. If developers need to do secure hashing or what not, it's better to use a tried and tested crypto algorithm than trying to roll your own.
Score: 5 Votes (Like | Disagree)
RabidMacFan Avatar
68 months ago
This seems misreported. The only thing new here is the source code for corecrypto. This does not appear to be made to allow third-party-developers to implement new security API's. From the page itself:

Both Security Framework and Common Crypto rely on the corecrypto library to provide implementations of low level cryptographic primitives. This is also the library submitted for validation of compliance with U.S. Federal Information Processing Standards (FIPS) 140-2 Level 1. Although corecrypto does not directly provide programming interfaces for developers and should not be used by iOS or OS X apps, the source code is available to allow for verification of its security characteristics and correct functioning.

(emphasis is mine)

From what I can understand, there are no new usable libraries or API's here. OS X and iOS developers can use Apple's existing Security Framework and Common Crypto services like they have always done.

Whats new is that the source code for the CoreCrypto library that Security Framework and Common Crypto use is available. This allows developers and security professionals to better understand what the existing frameworks were already doing in the background.

One of the benefits of this release is to allow auditing of the source code, and to give assurance to developers with a "trust no one" attitude that the built-in libraries are secure and safe to use.
Score: 4 Votes (Like | Disagree)
Bob Zimmerman Avatar
68 months ago

No, as others said, security comes from having good practices, not by keeping your practices secret.

Linux is generally regarded as the most secure platform, even though it's completely open source. Lots of people have read through the code looking for weaknesses, and lots of people have contributed fixes for any weaknesses they find.

Linux's security reputation is actually pretty bad. BSDs and UNIX variants have a good reputation. OpenBSD in particular is highly-regarded, in part because they audit changes rather stringently. Windows is getting better, and Linux is getting significantly worse.

OpenSSL is an extremely strong proof against the idea that open source is inherently more secure. It had tremendous numbers of very serious flaws that had been in it for years. Just because people can look at the code doesn't mean that they do. That's why the OpenBSD foundation forked OpenSSL, removed tons of options, and started developing it with their audit model as LibreSSL. It's why the OpenBSD guys recently replaced sudo with a new tool called doas that has far fewer options and as a result, far less that can go wrong.

In my experience, much software developed for Linux is built on the platform because it's free and it lets the developers work very quickly. Tons of open-source code runs on Linux, so you just have to download a bunch of libraries and write glue code to get them to do what you want. Unfortunately, many don't take the time to set up their application to run properly under a non-root user account. For that matter, the recommended installation method for a lot of software now is to run curl to fetch a URL, then pipe the output to a root-level bash shell. That is literally telling your system to do whatever some web server or anything claiming to be that server tells it to do.
Score: 3 Votes (Like | Disagree)
ChrisA Avatar
68 months ago

What could go wrong?

:apple:

Not much. Even if the code were kept closed, people can look at the running binary code. It is not that hard to read. In the old days I used to write in Cobol for IBM mainframes and it was common to get a "core dump". This was a printed hexadecimal dump of the computer's RAM to paper. We'd plow through it with a pencil and figure out what went wrong. We did not have debuggers. Anyone can still do this if they take the time. The Intel instruction set is more complex than was IBM360 but not by much.

Certainly the average user can't read a hex dump of a closed source crypto library but many people can. So closing it just makes it harder to read, not impossible.

That said, there are systems were the executable code itself is encrypted. These are completely unreadable and I'd worry there are backdoors and whatever in there
Score: 2 Votes (Like | Disagree)
ArtOfWarfare Avatar
68 months ago

That was my thought as well. Plus, could this knowledge enable a small "back door" that the government has been pestering Apple about?

No, as others said, security comes from having good practices, not by keeping your practices secret.

Linux is generally regarded as the most secure platform, even though it's completely open source. Lots of people have read through the code looking for weaknesses, and lots of people have contributed fixes for any weaknesses they find.
Score: 2 Votes (Like | Disagree)
.max Avatar
68 months ago

This seems misreported.

I agree. The misinterpretation is in this phrase in the article: "Developers will have access to two of the company's advanced security features". Developers have had access to these features for years.

What's different is that now, for example, they can use the open source code and be sure that there are no backdoors. If Apple has (or would be forced in the future to have) backdoors in the system, apps compiled with the open source code would be at less risk.
Score: 1 Votes (Like | Disagree)

Top Stories

iphone 5s black slate

Images of Unreleased iPhone 5s in Black and Slate Shared Online

Sunday January 17, 2021 9:47 am PST by
Twitter user @DongleBookPro has today shared images of a prototype iPhone 5s in an unreleased Black and Slate color. The iPhone 5s was launched in September 2013. The device featured Touch ID, a 64-bit processor, and a True Tone LED flash for the first time. Other new features included a five-element lens with an f/2.2 aperture, a 15 percent larger camera sensor, Burst Mode, and Slo-Mo...
iP12 charge airpods feature 2

Hidden iPhone 12 Hardware Feature Could Still be Unlocked

Thursday January 14, 2021 2:51 am PST by
All iPhone 12 and iPhone 12 Pro models purportedly have a hidden reverse wireless charging feature, according to an FCC filing. The feature has not yet been activated, but could yet be unlocked for an upcoming Apple accessory. The FCC filing suggests that iPhone 12 models contain the hardware for Wireless Power Transfer (WPT) to accessories: In addition to being able to be charged by a...
google maps detailed street level e1611052089473

Google Maps Gains Enhanced Street-Level Detail in Four Major Cities

Tuesday January 19, 2021 2:34 am PST by
Google Maps has quietly been updated to include significantly more detailed street-level information in a handful of key cities around the world. Upon zooming in, Google's maps for Central London, Tokyo, San Francisco, and New York now benefit from shapes and widths that match the scale of roads more accurately. Meanwhile, enhanced graphical representations of sidewalks, crosswalks,...
macbook pro flexgate

Apple Extends 13-Inch MacBook Pro Backlight Repair Program

Sunday January 17, 2021 10:31 am PST by
Apple this week extended its worldwide 13-inch MacBook Pro Display Backlight Service Program, authorizing coverage for eligible notebooks for up to five years after the original purchase date or up to three years after the start date of the program, whichever is longer. The previous cutoff was four years after the original purchase date. Apple launched the program on May 21, 2019 after...
lg wing

LG Considering Exit From Smartphone Business, Halts LCD Production for iPhone

Wednesday January 20, 2021 5:38 am PST by
LG is considering exiting the smartphone business entirely amid declining shipments and accrued losses of $4.5 billion over the past five years (via The Korea Herald). LG CEO Kwon Bong-Seok cautioned staff earlier today that the company is re-evaluating its presence in the smartphone industry: Since the competition in the global market for mobile devices is getting fiercer, it is about...
airpods max sim ejector

AirPods Max Headband Removable With Just a SIM Ejector Tool, Hinting at Interchangeable Headbands

Tuesday January 19, 2021 8:25 am PST by
It is possible to remove the headband of AirPods Max with just a standard SIM card ejector tool, hinting at the possibility of interchanging headbands to achieve a different colorway. Image via Prelook In December, MacRumors revealed the large variety of AirPods Max ear cushion color combinations when it became clear that they were magnetically attatched and available for sale separately....
macbook pro screensaver table

Some M1 Macs Affected By Fast User Switching Screensaver Bug

Monday January 18, 2021 1:57 am PST by
A growing number of user reports online suggest some of Apple's M1 Mac models are susceptible to a Fast User Switching bug that spontaneously activates the screensaver and leaves the user unable to dismiss it. In macOS Big Sur, Fast User Switching allows users to quickly switch between user accounts without having to completely log out. Based on posts in the MacRumors forums, Apple...
Top Stories 43 Feature

Top Stories: MacBook Pro, iMac, Mac Pro, and iPhone Rumors, Best of CES 2021

Saturday January 16, 2021 6:00 am PST by
This week was sure a busy one in the Apple world, with a flurry of announcements out of CES early in the week followed by a rash of Mac- and iPhone-related rumors later in the week. The new rumors this week included details on updated MacBook Pro, iMac, and Mac Pro models, as well as a few other tidbits, so make sure to read on below to get caught up! Kuo: New MacBook Pro Models to...
shot on iphone 12 apple

Apple Highlights Photos Shot by iPhone 12 Users: Portraits, Cityscapes, and More

Tuesday January 19, 2021 6:05 am PST by
Apple today shared a gallery of photos shot by customers using the iPhone 12 mini, iPhone 12, iPhone 12 Pro, and iPhone 12 Pro Max, with scenes including cityscapes, landscapes, portraits of people, and more at day and night. Shot on iPhone 12 Pro Max by "NKCHU" in China (top) and shot on iPhone 12 Pro Max by Rohit Vohra in India (bottom) iPhone 12 mini and iPhone 12 models have a dual camera ...
Apple and Hyundai feature

Apple Car Production Again Linked to Kia Motor's US Plant in Georgia

Tuesday January 19, 2021 4:19 am PST by
Hyundai intends to transition the company's Apple Car involvement to its Kia brand as part of an internal arrangement that could see production move to the U.S., according to a new report today. On Sunday, Korea IT News reported that Apple and Hyundai are seeking a partnership agreement for the upcoming Apple Car by March, and that the electric vehicles could be made at a Georgia factory...