security-crypto

安全与加密

安全分层

层级	威胁	防护手段
传输层	中间人攻击、流量劫持	HTTPS + Certificate Pinning
存储层	数据泄露、越狱读取	Keychain + Data Protection
代码层	逆向工程、注入	混淆 + App Attest
认证层	Token 窃取、重放攻击	JWT + 短有效期 + PKCE
API 层	滥用、爬虫	速率限制 + 签名验证

---

CryptoKit

哈希

import CryptoKit

func sha256(_ data: Data) -> String {
    let hash = SHA256.hash(data: data)
    return hash.compactMap { String(format: "%02x", $0) }.joined()
}

func sha256(_ string: String) -> String {
    guard let data = string.data(using: .utf8) else { return "" }
    return sha256(data)
}

HMAC（消息认证码）

func hmac(key: Data, message: Data) -> String {
    let key = SymmetricKey(data: key)
    let signature = HMAC<SHA256>.authenticationCode(for: message, using: key)
    return signature.compactMap { String(format: "%02x", $0) }.joined()
}

AES 加解密

func encrypt(plaintext: Data, key: SymmetricKey) throws -> Data {
    let sealedBox = try AES.GCM.seal(plaintext, using: key)
    return sealedBox.combined!
}

func decrypt(ciphertext: Data, key: SymmetricKey) throws -> Data {
    let sealedBox = try AES.GCM.SealedBox(combined: ciphertext)
    return try AES.GCM.open(sealedBox, using: key)
}

func generateAESKey() -> SymmetricKey {
    SymmetricKey(size: .bits256)
}

签名验证

func sign(data: Data, privateKey: P256.Signing.PrivateKey) throws -> Data {
    let signature = try privateKey.signature(for: data)
    return signature.rawRepresentation
}

func verify(data: Data, signature: Data, publicKey: P256.Signing.PublicKey) -> Bool {
    guard let sig = try? P256.Signing.ECDSASignature(rawRepresentation: signature) else {
        return false
    }
    return publicKey.isValidSignature(sig, for: data)
}

Key Agreement（密钥协商）

func sharedSecret(privateKey: P256.KeyAgreement.PrivateKey, publicKey: P256.KeyAgreement.PublicKey) throws -> SharedSecret {
    return try privateKey.sharedSecretFromKeyAgreement(with: publicKey)
}