IOS Signature Mechanism

★★ ★★ ★ tag: “iOS” “Apple” “Signature mechanism

In this article, QiShare compiled his knowledge of the iOS signature mechanism under the guidance of Bang’s blog. Thanks also to the original work of The God Bang.

Because of Apple’s security policy, the signature mechanism ensures that every App on the phone is authenticated by Apple. There are four ways to install the App:

1. throughApp StoreThe installation.
2. Developers can useXcodeThe installation.
3. Ad-HocTest certificate package App, limited to 100.
4. In-HouseEnterprise edition certificate package App, trust enterprise certificate can be used.

Install via the App Store

1. A pair of public and private keys is generated by Apple. The public key is embedded in the iOS device, and the private key is kept by Apple.
2. After the developer uploads the App to Apple for approval, Apple signs the App data with the private key and publishes it to the App Store.
3. After the App is downloaded on an iOS device, the public key is used to verify the App. If the public key is correct, the App is verified by Apple.

Ii. Installation by Xcode (real machine debugging)

There is no way for Apple to sign an App because it does not need to submit it to Apple for approval, so Apple uses a double signature mechanism. The Mac has a pair of public and private keys, and apple has the same pair of public and private keys.

1. When you need real machine testing during development, you need to create a certificate request file (CSR) from the certificate center in the keystring and upload it to the Apple server.
2. Apple uses the private key to sign the CSR, which generates a CER containing Mac public key information and Apple’s signature on it.
3. After compiling an App, the Mac signs the App using its private key.
4. When installing the App, package the CER certificate together with the App according to the current configuration.
5. IOS devices use Apple’s built-in public key to verify that the CER is correct. Certificate verification ensures that the Mac public key is authenticated by Apple.
6. Then use the Mac’s public key in the CER file to verify whether the App’s signature is correct and ensure that the installation behavior is approved by Apple.

Apple is only making sure that the installation is legal, not that the App content has been modified.

Note: the certificate request file (CertificateSigningRequest certSigningRequest), used for binding the computer, there should be a Mac public key file.

Three, through ad-hoc formal packaging installation

Xcode packages the App and generates an IPA file, which is installed on the phone through third-party distribution platforms such as iTunes or Dandelion. The process steps are basically the same as real machine debugging, the difference lies in step 4:

1. When testing needs to be packaged at development time or distributed, a certificate Request file (CSR) needs to be created from the certificate center in the keystring and sent to Apple servers.
2. Apple uses the private key to sign the CSR, which generates a CER containing Mac public key information and Apple’s signature on it.
3. After compiling an App, the Mac signs the App using its private key.
4. Compiled after signature, to export ipa file, export, the need to select a save method (App Store/Ad Hoc/Enterprise/Development), is to choose to step on to generate the CER bundled into the App.
5. IOS devices use Apple’s built-in public key to verify that the CER is correct. Certificate verification ensures that the Mac public key is authenticated by Apple.
6. Then use the Mac’s public key in the CER file to verify whether the App’s signature is correct and ensure that the installation behavior is approved by Apple.

Iv. In-house Enterprise Version certificate packaging

The enterprise certificate signature verification process is similar to ad-Hoc. The enterprise version does not limit the number of devices and requires users to manually click on trust certificates on iOS devices.

Add something

The software can only be installed on devices registered with Apple. The software can only be installed on devices registered with Apple. The software can only be installed on devices registered with Apple. The signature is only for one App.

In step 4 above, when the certificate is packaged into the App, data (Profile file) such as the DEVICE ID allowed to install and the corresponding APPID of the App should be added.

According to the principle of digital signature, as long as the digital signature is verified, the device IDs/AppID/Mac public keys in step 5 are authenticated by Apple and cannot be modified. In this way, Apple can restrict the devices and apps that can be installed to avoid abuse.

Apple also control iCloud/push/ background operation, etc., these require Apple authorization signature, Apple collectively call these permission switches: Entitlements, to Entitlements to Apple.

So a certificate can contain a lot of things that don’t meet the required format specification, so there’s a Provisioning Profile that contains the certificate and all the other information and the signatures of the information.

The differences between the four signature methods

Summarize the final process

1. The Mac and Apple have their own set of public and private keys. Apple’s private key is stored in the background, and the public key is stored on each iOS device. The Mac’s private key is stored on the computer, and the public key is sent to the Apple server.
2. The Mac generates a CSR from a key string (that is, or contains a public key) and uploads it to an Apple server.
3. The Apple server uses the private key to sign the CSR, yielding data that contains the Mac public key and its signature, called a certificate (Cer file).
4. Apply for an Appid from the Apple background, configure the device ID list and other permissions for the App, sign using Apple’s private key, create a Provisioning Profile, download the Cer certificate from Step 3 and install it on the Mac. The keystring automatically associates the Cer with the private key that previously generated the CSR file.
5. After compiling the App with a Mac, sign it with the Mac private key and package the description file into the App namedembedded.mobileprovision.
6. When installing the App, the iOS device obtains a certificate and uses the built-in Apple private key to verify the Cer andembedded.mobileprovisionFile.
7. Ensure the Cer andembedded.mobileprovisionAfter apple authenticates, the Mac public key is extracted from Cer to verify App signature, device ID list and permission switch.

1. What should other people do if they want to compile a signed App? Simply give him the private key. The private key is also exported from the key string, which is.p12File, other Mac import private key can be used normally.

2. Decompress the device ID registered in the IPA package. Ipa file, get the App package, display the package content, and findembedded.mobileprovisionDirectory where the file resides, run the commandsecurity cms -D -i embedded.mobileprovision

Reference article:

1. Principles of iOS App signature
   
   
2. bang’s blog

QiShare(Simple book) QiShare(digging gold) QiShare(Zhihu) QiShare(GitHub) QiShare(CocoaChina) QiShare(StackOverflow) QiShare(wechat public account)

IOS Bitcode iOS drawRect iOS to write high-quality Objective-C code (eight) strange dance weekly