Public-key cryptography with CryptoKit for iOS

Public-key cryptography, also known as asymmetric cryptography, is a cornerstone of modern security. It ensures secure communication, authentication, and data integrity across IT systems and networks.

For iOS developers, Apple provides built-in security with TLS encryption and digital signing when communicating over HTTPS. However, when dealing with sensitive user data, authentication, or offline encryption, additional layers of security might be necessary.

In this article, we'll explore how public-key cryptography works and how CryptoKit simplifies its implementation in iOS applications.

Architecture & Design Patterns for iOS

This book is a practical guide to essential architectural principles and design patterns for iOS development. It covers strategies for building maintainable apps with Swift and SwiftUI, including dependency injection, navigation, common patterns, and modularization.

LEARN MORE

Public-key cryptography basics

Public-key cryptography is based on a pair of linked keys:

• A public key (which can be freely shared)
• A private key (which must remain secret)

Anyone can use the public key to encrypt messages, but only the holder of the private key can decrypt them. This makes it ideal for secure messaging, authentication, and digital signatures.

A crucial aspect of public-key cryptography is that deriving the private key from the public key is computationally infeasible. This ensures secure communication even if an attacker intercepts the public key.

Public-key cryptography use cases

Common public-key cryptography use cases are encryption and digital signatures.

Use case: Digital signatures

A digital signature proves that a message was sent by a specific party and has not been altered. This is essential for secure messaging, online transactions, and authentication systems.

In more detail, it works as follows:

1. The sender hashes the message to create a message digest (a fixed-length fingerprint of the data).
2. The digest is then encrypted with the sender's private key, creating a digital signature.
3. The recipient decrypts the signature with the sender's public key to retrieve the digest.
4. The recipient hashes the original message and compares the digests.
5. If they match, the message is authentic and untampered.

Use case: Encryption

Although public keys can be used to encrypt messages, they are typically used for secure key exchange in combination with symmetric encryption which is faster and more efficient for large data.

For example, when a user connects to a secure server, public-key cryptography is used to securely exchange a symmetric key that is then used for encrypting communication.

Public-key algorithms supported by CryptoKit

CryptoKit supports Elliptic Curve Cryptography (ECC), which is more efficient than traditional RSA encryption.

• P256/P384/P521 (NIST curves) – Widely used, standardized, and compliant with government security standards.
• Curve25519 – More efficient and resistant to certain attacks (e.g., side-channel attacks). It's often recommended for modern applications due to its performance and simplicity.

For most applications, Curve25519 is the best choice unless compliance with NIST standards is required.

Using CryptoKit

Now, let's see how to implement public-key cryptography in Swift using CryptoKit.

1. Creating a key pair with CryptoKit

Creating a private-public key pair with CryptoKit is as simple as:

let privateKey = Curve25519.Signing.PrivateKey()
let publicKey = privateKey.publicKey

To send the public key, we can convert it to Data by using its rawRepresentation property:

let publicKeyData = publicKey.rawRepresentation

If we want to use P256 instead of Curve25519, we simply swap the algorithm:

let privateKey = P256.Signing.PrivateKey()

2. Signing with CryptoKit

We can create a digital signature using the private key:

let signature = try privateKey.signature(for: messageDigest)

On signature, we can again use its rawRepresentation property to get a Data type for server communication.

Verifying a received signature is similarly simple:

let isValid = publicKey.isValidSignature(signature, for: messageDigest)

Conclusion

With just a few lines of Swift code, CryptoKit allows us to generate key pairs, create digital signatures, and verify them, all while benefiting from Apple's optimized and secure cryptographic implementations.