Apple announced yesterday that the company has opened up its cryptographic libraries so that third-party developers can build more "advanced security features" into their apps (via VentureBeat). The cryptographic libraries being opened to developers are the same ones Apple uses to protect iOS and OS X, as Apple notes on its updated site.

crypto libraries
Developers will have access to two of the company's advanced security features, including Security Framework and Common Crypto. Security Framework gives developers tools for organizing certificates, public and private keys, and trust policies, ensuring that all sensitive information is stored privately in a "secure repository for sensitive user data." Common Crypto library provides additional support for symmetric encryption, hash-based message authentication codes, and digests.

Both Security Framework and Common Crypto rely on the corecrypto library to provide implementations of low level cryptographic primitives. This is also the library submitted for validation of compliance with U.S. Federal Information Processing Standards (FIPS) 140-2 Level 1. Although corecrypto does not directly provide programming interfaces for developers and should not be used by iOS or OS X apps, the source code is available to allow for verification of its security characteristics and correct functioning.

Check out Apple's official website for reference sheets, service guides, and links to the open source releases for Security Framework and Common Crypto libraries.

Top Rated Comments

SpinThis! Avatar
97 months ago
That was my thought as well. Plus, could this knowledge enable a small "back door" that the government has been pestering Apple about?
No. It doesn't matter. Good security isn't based on obscurity. The current security we have is based on our collective knowledge of mathematics. It's good that Apple is opening this up. If developers need to do secure hashing or what not, it's better to use a tried and tested crypto algorithm than trying to roll your own.
Score: 5 Votes (Like | Disagree)
RabidMacFan Avatar
97 months ago
This seems misreported. The only thing new here is the source code for corecrypto. This does not appear to be made to allow third-party-developers to implement new security API's. From the page itself:

Both Security Framework and Common Crypto rely on the corecrypto library to provide implementations of low level cryptographic primitives. This is also the library submitted for validation of compliance with U.S. Federal Information Processing Standards (FIPS) 140-2 Level 1. Although corecrypto does not directly provide programming interfaces for developers and should not be used by iOS or OS X apps, the source code is available to allow for verification of its security characteristics and correct functioning.

(emphasis is mine)

From what I can understand, there are no new usable libraries or API's here. OS X and iOS developers can use Apple's existing Security Framework and Common Crypto services like they have always done.

Whats new is that the source code for the CoreCrypto library that Security Framework and Common Crypto use is available. This allows developers and security professionals to better understand what the existing frameworks were already doing in the background.

One of the benefits of this release is to allow auditing of the source code, and to give assurance to developers with a "trust no one" attitude that the built-in libraries are secure and safe to use.
Score: 4 Votes (Like | Disagree)
Bob Zimmerman Avatar
96 months ago
No, as others said, security comes from having good practices, not by keeping your practices secret.

Linux is generally regarded as the most secure platform, even though it's completely open source. Lots of people have read through the code looking for weaknesses, and lots of people have contributed fixes for any weaknesses they find.
Linux's security reputation is actually pretty bad. BSDs and UNIX variants have a good reputation. OpenBSD in particular is highly-regarded, in part because they audit changes rather stringently. Windows is getting better, and Linux is getting significantly worse.

OpenSSL is an extremely strong proof against the idea that open source is inherently more secure. It had tremendous numbers of very serious flaws that had been in it for years. Just because people can look at the code doesn't mean that they do. That's why the OpenBSD foundation forked OpenSSL, removed tons of options, and started developing it with their audit model as LibreSSL. It's why the OpenBSD guys recently replaced sudo with a new tool called doas that has far fewer options and as a result, far less that can go wrong.

In my experience, much software developed for Linux is built on the platform because it's free and it lets the developers work very quickly. Tons of open-source code runs on Linux, so you just have to download a bunch of libraries and write glue code to get them to do what you want. Unfortunately, many don't take the time to set up their application to run properly under a non-root user account. For that matter, the recommended installation method for a lot of software now is to run curl to fetch a URL, then pipe the output to a root-level bash shell. That is literally telling your system to do whatever some web server or anything claiming to be that server tells it to do.
Score: 3 Votes (Like | Disagree)
ChrisA Avatar
96 months ago
What could go wrong?

:apple:
Not much. Even if the code were kept closed, people can look at the running binary code. It is not that hard to read. In the old days I used to write in Cobol for IBM mainframes and it was common to get a "core dump". This was a printed hexadecimal dump of the computer's RAM to paper. We'd plow through it with a pencil and figure out what went wrong. We did not have debuggers. Anyone can still do this if they take the time. The Intel instruction set is more complex than was IBM360 but not by much.

Certainly the average user can't read a hex dump of a closed source crypto library but many people can. So closing it just makes it harder to read, not impossible.

That said, there are systems were the executable code itself is encrypted. These are completely unreadable and I'd worry there are backdoors and whatever in there
Score: 2 Votes (Like | Disagree)
ArtOfWarfare Avatar
97 months ago
That was my thought as well. Plus, could this knowledge enable a small "back door" that the government has been pestering Apple about?
No, as others said, security comes from having good practices, not by keeping your practices secret.

Linux is generally regarded as the most secure platform, even though it's completely open source. Lots of people have read through the code looking for weaknesses, and lots of people have contributed fixes for any weaknesses they find.
Score: 2 Votes (Like | Disagree)
.max Avatar
97 months ago
This seems misreported.
I agree. The misinterpretation is in this phrase in the article: "Developers will have access to two of the company's advanced security features". Developers have had access to these features for years.

What's different is that now, for example, they can use the open source code and be sure that there are no backdoors. If Apple has (or would be forced in the future to have) backdoors in the system, apps compiled with the open source code would be at less risk.
Score: 1 Votes (Like | Disagree)

Popular Stories

iPhone 15 Pro Buttons CAD Leak

iPhone 15 Pro Leak Reveals Unified Volume Button and Mute Button

Monday March 20, 2023 8:33 am PDT by
As previously rumored, the next-generation iPhone 15 Pro and iPhone 15 Pro Max will feature a unified volume button and a mute button, according to leaked CAD images shared in a video on the Chinese version of TikTok and posted to Twitter by ShrimpApplePro. Instead of separate buttons for volume up and volume down, the iPhone 15 Pro models are expected to have a single elongated button for...
original iphone auction

Factory-Sealed Original iPhone Sells for $55,000 at Auction

Friday March 17, 2023 1:08 pm PDT by
A first-generation iPhone still sealed inside its box sold for $54,904 at auction, which is more than $54,000 over the original $599 price tag of the device when it was released in 2007. The original iPhone was put up for sale by RR Auction on behalf of a former Apple employee who purchased it back when it first came out. Back in February, an original, sealed iPhone sold for over $63,000,...
iPhone 12 Pro vs iPhone 15 Pro Feature

iPhone 12 Pro vs. 15 Pro: New Features to Expect if You've Waited to Upgrade

Friday March 17, 2023 10:29 am PDT by
While year-over-year iPhone upgrades are not always groundbreaking, new features can begin to stack up over multiple generations. For example, the iPhone 15 Pro will be a notable upgrade for those who still have a three-year-old iPhone 12 Pro. If you are still using an iPhone 12 Pro and are considering upgrading to the iPhone 15 Pro when it launches later this year, we have put together a...
top stories 18mar2023

Top Stories: iPhone 15 Pro Pricing, New iOS 16.4 Beta, Siri vs. ChatGPT, and More

Saturday March 18, 2023 6:00 am PDT by
Apple's high-end iPhone models have started at $999 in the U.S. since they first launched back in 2017 with the iPhone X, but could this finally be the year that starting price sees an increase? This week also saw some more rumors about Apple's upcoming headset and the company's explorations in the booming AI industry as well as the release of a new round of beta updates, so read on for all...
iPhone 15 Pro Mock Feature Buttonless

iPhone 15 Pro Max to 'Break Record' for Thinnest Bezels on a Smartphone

Friday March 17, 2023 2:59 am PDT by
The iPhone 15 Pro Max will have the thinnest bezels of any smartphone, beating the record currently held by the Xiaomi 13. That's according to the leaker known as "Ice Universe," who has divulged accurate information about Apple's plans in the past. Both iPhone 15 Pro models are expected to have thinner, curved bezels compared to the iPhone 14 Pro, potentially resulting in an Apple...
iphone 14 pro max deep purple feature purple

iPhone 15 Pro Launching This Year With These 11 New Features

Monday March 13, 2023 6:47 am PDT by
While the iPhone 15 lineup is around six months away, there have already been plenty of rumors about the devices. Many new features and changes are expected for the iPhone 15 Pro models in particular, including a titanium frame and more. Below, we have recapped 11 features rumored for iPhone 15 Pro models that are not expected to be available on the standard iPhone 15 and iPhone 15 Plus:A17...
iOS 16

iOS 16.4 for iPhone Nearing Launch With These 5 New Features

Monday March 20, 2023 11:50 am PDT by
Apple continues to test iOS 16.4, which includes a handful of new features and changes for the iPhone. Below, we have recapped five new features coming with the software update, including new emoji, push notifications from websites, and more. Apple says iOS 16.4 will be available in the spring, which begins today. In his newsletter this weekend, Bloomberg's Mark Gurman said the update should ...