(Objective-C) Generate Encryption Key

Discusses symmetric encryption key generation techniques for block encryption algorithms such as AES, Blowfish, and Twofish, or for other algorithms such as ChaCha20.

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <CkoCrypt2.h>
#import <CkoPrng.h>
#import <NSString.h>

// Symmetric encryption algorithms are such that the encryptor and decryptor
// share a pre-known secret key.  This could be a "single-use" key that is 
// derived from a secure key exchange algorithm using RSA, ECC, or Diffie-Hellman,
// or it could be a password known to both sides, or
// it could simply be the binary bytes of the secret key known in advance on both
// sides.

// A secret key has no structure.  It's nothing more than N bytes of data.
// It should typically be random data, or bytes that resemble random data such
// as the hash of a password.

// The number of bytes in the secret key defines the bit-strength of an encryption
// algorithm.  For example, AES with a 32-byte key is 256-bit AES.  Most algorithms
// define restrictions on key sizes.  For example, AES has 3 choices: 128-bit, 192-bit,
// or 256-bit.  In the ChaCha20 algorithm, the key size must always be 256-bits (32-bytes).

// Both sides (encryptor and decryptor) must be in possession of the same secret key
// in order to communicate.   Whichever side generates the key, it must somehow
// deliver the key to the other side beforehand.  Key exchange algorithms, such as RSA, ECC,
// and Diffie-Hellman define secure ways of exchanging symmetric encryption keys.
// They do so using asymmetric encryption algorithms (public/private keys).  It is not
// required to use a key exchange algorithm to achieve the goal of having both sides
// in possession of the same secret key.  A long-living secret key could be exchanged
// via any secure out-of-band means.  For example, exchanging the information over a secure
// TLS (HTTPS) or SSH connection...

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

BOOL success;

CkoCrypt2 *crypt = [[CkoCrypt2 alloc] init];
crypt.CryptAlgorithm = @"aes";
crypt.KeyLength = [NSNumber numberWithInt:256];

// Generate a 32-byte random secret key,
// and use it in the crypt object.
CkoPrng *prng = [[CkoPrng alloc] init];
NSString *secretKeyHex = [prng GenRandom: [NSNumber numberWithInt: 32] encoding: @"hex"];
// It is important that the number of bytes in the secret key
// matches the value specified in the KeyLength property (above).
[crypt SetEncodedKey: secretKeyHex encoding: @"hex"];
NSLog(@"%@%@",@"randomly generated key: ",secretKeyHex);

// Alternatively, a password could be hashed using a hash algorithm
// the results in the desired key length.  Our desired key length
// in this case is 32 bytes, so we wouldn't want MD5 (16 bytes),
// nor would we want to use SHA-1 (20 bytes).  SHA256 would be the
// hash of choice because it results in 32-bytes of random-looking
// key material.
crypt.HashAlgorithm = @"SHA256";
crypt.EncodingMode = @"hex";
secretKeyHex = [crypt HashStringENC: @"mypassword"];
[crypt SetEncodedKey: secretKeyHex encoding: @"hex"];
NSLog(@"%@%@",@"password-based key: ",secretKeyHex);