Mobile App Data Encryption: Protecting Sensitive Data (20...

import Foundation
import Security
import CryptoKit

/// Production-ready data encryption manager for iOS
/// Uses AES-256-GCM with secure key management
class DataEncryptionManager {
    
    enum EncryptionError: LocalizedError {
        case keyGenerationFailed
        case encryptionFailed(Error)
        case decryptionFailed(Error)
        case keychainError(OSStatus)
        
        var errorDescription: String? {
            switch self {
            case .keyGenerationFailed:
                return "Failed to generate encryption key"
            case .encryptionFailed(let error):
                return "Encryption failed: \(error.localizedDescription)"
            case .decryptionFailed(let error):
                return "Decryption failed: \(error.localizedDescription)"
            case .keychainError(let status):
                return "Keychain error: \(status)"
            }
        }
    }
    
    private let keychainService = "com.yourapp.encryption"
    private let keyName = "data_encryption_key"
    
    /// Generate and store encryption key in Keychain
    private func getOrCreateKey() throws -> SymmetricKey {
        // Try to retrieve existing key from Keychain
        if let existingKey = try? retrieveKeyFromKeychain() {
            return existingKey
        }
        
        // Generate new key
        let key = SymmetricKey(size: .bits256)
        
        // Store in Keychain
        try storeKeyInKeychain(key)
        
        return key
    }
    
    private func storeKeyInKeychain(_ key: SymmetricKey) throws {
        let keyData = key.withUnsafeBytes { Data($0) }
        
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: keychainService,
            kSecAttrAccount as String: keyName,
            kSecValueData as String: keyData,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        
        // Delete existing item
        SecItemDelete(query as CFDictionary)
        
        // Add new item
        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else {
            throw EncryptionError.keychainError(status)
        }
    }
    
    private func retrieveKeyFromKeychain() throws -> SymmetricKey {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: keychainService,
            kSecAttrAccount as String: keyName,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        
        guard status == errSecSuccess,
              let keyData = result as? Data else {
            throw EncryptionError.keychainError(status)
        }
        
        return SymmetricKey(data: keyData)
    }
    
    /// Encrypt data using AES-256-GCM
    func encrypt(_ data: Data) throws -> Data {
        do {
            let key = try getOrCreateKey()
            let sealedBox = try AES.GCM.seal(data, using: key)
            
            // Combine nonce, ciphertext, and tag
            var encryptedData = sealedBox.nonce.withUnsafeBytes { Data($0) }
            encryptedData.append(sealedBox.ciphertext)
            encryptedData.append(sealedBox.tag)
            
            return encryptedData
        } catch {
            if let encryptionError = error as? EncryptionError {
                throw encryptionError
            }
            throw EncryptionError.encryptionFailed(error)
        }
    }
    
    /// Decrypt data using AES-256-GCM
    func decrypt(_ encryptedData: Data) throws -> Data {
        do {
            let key = try getOrCreateKey()
            
            // Extract nonce (12 bytes), ciphertext, and tag (16 bytes)
            let nonceSize = 12
            let tagSize = 16
            
            guard encryptedData.count > nonceSize + tagSize else {
                throw EncryptionError.decryptionFailed(NSError(domain: "Encryption", code: -1, userInfo: [NSLocalizedDescriptionKey: "Invalid encrypted data"]))
            }
            
            let nonceData = encryptedData.prefix(nonceSize)
            let tagData = encryptedData.suffix(tagSize)
            let ciphertextData = encryptedData.dropFirst(nonceSize).dropLast(tagSize)
            
            let nonce = try AES.GCM.Nonce(data: nonceData)
            let sealedBox = try AES.GCM.SealedBox(nonce: nonce, ciphertext: ciphertextData, tag: tagData)
            
            let decryptedData = try AES.GCM.open(sealedBox, using: key)
            return decryptedData
        } catch {
            if let decryptionError = error as? EncryptionError {
                throw decryptionError
            }
            throw EncryptionError.decryptionFailed(error)
        }
    }
}

// Usage example
let encryptionManager = DataEncryptionManager()

// Encrypt sensitive data
let sensitiveData = "Secret information".data(using: .utf8)!
do {
    let encrypted = try encryptionManager.encrypt(sensitiveData)
    // Store encrypted data
    UserDefaults.standard.set(encrypted, forKey: "encrypted_data")
} catch {
    print("Encryption failed: \(error)")
}

// Decrypt data
if let encrypted = UserDefaults.standard.data(forKey: "encrypted_data") {
    do {
        let decrypted = try encryptionManager.decrypt(encrypted)
        let plaintext = String(data: decrypted, encoding: .utf8)
        print("Decrypted: \(plaintext ?? "")")
    } catch {
        print("Decryption failed: \(error)")
    }
}

import XCTest
@testable import YourApp

class DataEncryptionManagerTests: XCTestCase {
    var manager: DataEncryptionManager!
    
    override func setUp() {
        super.setUp()
        manager = DataEncryptionManager()
    }
    
    func testEncryptionDecryption() throws {
        let originalData = "Test data".data(using: .utf8)!
        let encrypted = try manager.encrypt(originalData)
        let decrypted = try manager.decrypt(encrypted)
        XCTAssertEqual(originalData, decrypted)
    }
    
    func testEncryptionProducesDifferentOutput() throws {
        let data = "Test".data(using: .utf8)!
        let encrypted1 = try manager.encrypt(data)
        let encrypted2 = try manager.encrypt(data)
        // Should be different due to random nonce
        XCTAssertNotEqual(encrypted1, encrypted2)
    }
}

// DataEncryptionManager.kt
// Production-ready data encryption for Android

import android.content.Context
import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec
import android.util.Base64

class DataEncryptionManager(private val context: Context) {
    
    companion object {
        private const val KEYSTORE_ALIAS = "app_encryption_key"
        private const val ANDROID_KEYSTORE = "AndroidKeyStore"
        private const val TRANSFORMATION = "AES/GCM/NoPadding"
        private const val GCM_IV_LENGTH = 12
        private const val GCM_TAG_LENGTH = 16
    }
    
    private val keyStore: KeyStore = KeyStore.getInstance(ANDROID_KEYSTORE).apply {
        load(null)
    }
    
    /**
     * Get or create encryption key
     */
    private fun getOrCreateKey(): SecretKey {
        val existingKey = keyStore.getKey(KEYSTORE_ALIAS, null) as? SecretKey
        if (existingKey != null) {
            return existingKey
        }
        
        // Generate new key
        val keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE)
        val keyGenParameterSpec = KeyGenParameterSpec.Builder(
            KEYSTORE_ALIAS,
            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
        )
            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
            .setKeySize(256)
            .build()
        
        keyGenerator.init(keyGenParameterSpec)
        return keyGenerator.generateKey()
    }
    
    /**
     * Encrypt data
     */
    fun encrypt(data: ByteArray): ByteArray {
        val key = getOrCreateKey()
        val cipher = Cipher.getInstance(TRANSFORMATION)
        cipher.init(Cipher.ENCRYPT_MODE, key)
        
        val iv = cipher.iv
        val encrypted = cipher.doFinal(data)
        
        // Combine IV and encrypted data
        val encryptedWithIv = ByteArray(iv.size + encrypted.size)
        System.arraycopy(iv, 0, encryptedWithIv, 0, iv.size)
        System.arraycopy(encrypted, 0, encryptedWithIv, iv.size, encrypted.size)
        
        return encryptedWithIv
    }
    
    /**
     * Decrypt data
     */
    fun decrypt(encryptedData: ByteArray): ByteArray {
        val key = getOrCreateKey()
        
        // Extract IV
        val iv = ByteArray(GCM_IV_LENGTH)
        System.arraycopy(encryptedData, 0, iv, 0, GCM_IV_LENGTH)
        
        // Extract encrypted data
        val encrypted = ByteArray(encryptedData.size - GCM_IV_LENGTH)
        System.arraycopy(encryptedData, GCM_IV_LENGTH, encrypted, 0, encrypted.size)
        
        val cipher = Cipher.getInstance(TRANSFORMATION)
        val spec = GCMParameterSpec(GCM_TAG_LENGTH * 8, iv)
        cipher.init(Cipher.DECRYPT_MODE, key, spec)
        
        return cipher.doFinal(encrypted)
    }
}

// Usage
val encryptionManager = DataEncryptionManager(context)
val plaintext = "Sensitive data".toByteArray()
val encrypted = encryptionManager.encrypt(plaintext)
val decrypted = encryptionManager.decrypt(encrypted)

//
// KeyManagementSystem.swift
// Production-ready encryption key management
//

import Foundation
import Security
import CryptoKit

class KeyManagementSystem {
    private let keychainService = "com.yourapp.keys"
    
    /// Generate and store encryption key
    func generateAndStoreKey(keyName: String) throws -> SymmetricKey {
        // Check if key exists
        if let existingKey = try? retrieveKey(keyName: keyName) {
            return existingKey
        }
        
        // Generate new key
        let key = SymmetricKey(size: .bits256)
        
        // Store in Keychain
        try storeKey(key, keyName: keyName)
        
        return key
    }
    
    private func storeKey(_ key: SymmetricKey, keyName: String) throws {
        let keyData = key.withUnsafeBytes { Data($0) }
        
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: keychainService,
            kSecAttrAccount as String: keyName,
            kSecValueData as String: keyData,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        
        SecItemDelete(query as CFDictionary)
        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else {
            throw NSError(domain: "KeyManagement", code: Int(status))
        }
    }
    
    private func retrieveKey(keyName: String) throws -> SymmetricKey {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: keychainService,
            kSecAttrAccount as String: keyName,
            kSecReturnData as String: true
        ]
        
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        
        guard status == errSecSuccess,
              let keyData = result as? Data else {
            throw NSError(domain: "KeyManagement", code: Int(status))
        }
        
        return SymmetricKey(data: keyData)
    }
    
    /// Rotate encryption key
    func rotateKey(keyName: String) throws -> SymmetricKey {
        // Delete old key
        let deleteQuery: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: keychainService,
            kSecAttrAccount as String: keyName
        ]
        SecItemDelete(deleteQuery as CFDictionary)
        
        // Generate and store new key
        return try generateAndStoreKey(keyName: keyName)
    }
}

import XCTest
@testable import YourApp

class DataEncryptionManagerTests: XCTestCase {
    var manager: DataEncryptionManager!
    
    override func setUp() {
        super.setUp()
        manager = DataEncryptionManager()
    }
    
    func testEncryptionDecryption() throws {
        let plaintext = "Test data".data(using: .utf8)!
        let encrypted = try manager.encrypt(plaintext)
        let decrypted = try manager.decrypt(encrypted)
        
        XCTAssertEqual(plaintext, decrypted)
    }
    
    func testKeyManagement() throws {
        let keyManager = KeyManagementSystem()
        let key1 = try keyManager.generateAndStoreKey(keyName: "test_key")
        let key2 = try keyManager.generateAndStoreKey(keyName: "test_key")
        
        // Should retrieve same key
        XCTAssertEqual(key1.withUnsafeBytes { Data($0) }, key2.withUnsafeBytes { Data($0) })
    }
}

//
// Cleanup.swift
// Production-ready cleanup for encryption
//

extension DataEncryptionManager {
    /// Clear encryption keys (use with caution - only for testing)
    func clearKeys() {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: keychainService,
            kSecAttrAccount as String: keyName
        ]
        SecItemDelete(query as CFDictionary)
    }
}

// Usage
deinit {
    // Keys remain in Keychain for security
    // Only clear in development/testing scenarios
}

Real-World Case Study

Challenge: A healthcare app stored patient data unencrypted:

• Patient records accessible if device compromised
• HIPAA compliance violations
• Data breach risk high
• Regulatory fines possible

Solution: Implemented comprehensive encryption:

• AES-256 encryption for all patient data
• Keychain/Keystore for key storage
• HTTPS with certificate pinning
• Database encryption for local storage
• Key rotation and management

Results:

• 100% data encryption: All sensitive data encrypted
• HIPAA compliance: Passed security audits
• Zero data breaches: Encryption effective
• User trust increased: Security transparency appreciated
• Regulatory compliance: No violations

FAQ

Q: What encryption algorithm should I use?

A: Use AES-256 for symmetric encryption, RSA-2048 or ECC-256 for asymmetric encryption. Avoid weak algorithms (DES, MD5, SHA1).

Q: How do I manage encryption keys securely?

A: Use platform secure storage (Keychain/Keystore), derive keys from user credentials, implement key rotation, and never hardcode keys.

Q: Does encryption impact app performance?

A: Modern encryption has minimal performance impact (<5%). Use hardware acceleration when available and encrypt only sensitive data.

Code Review Checklist for Mobile Data Encryption

Encryption Implementation

• Encryption algorithms appropriate (AES-256)
• Encryption properly implemented
• Encryption at rest implemented
• Encryption in transit implemented

Key Management

• Encryption keys stored securely (Keychain/Keystore)
• Key derivation functions used
• Key rotation implemented
• Key backup and recovery tested

Data Protection

• Sensitive data identified and encrypted
• Encryption performance acceptable
• Encryption overhead minimized
• Encrypted data properly managed

Security

• No weak encryption algorithms used
• Encryption keys not hardcoded
• Key management secure
• Encryption properly tested

Testing

• Encryption/decryption tested
• Key management tested
• Performance impact validated
• Security testing performed

Conclusion

Data encryption is essential for protecting sensitive user data. Implement encryption at rest and in transit with proper key management.

Action Steps

1. Identify sensitive data
2. Implement encryption at rest
3. Implement encryption in transit
4. Secure key management
5. Test encryption thoroughly
6. Monitor encryption performance
7. Document encryption practices

Related Topics

• Mobile App Secure Storage
• Mobile App Security Best Practices

Educational Use Only: This content is for educational purposes. Implement encryption to protect user data.