iOS开发 - 网络数据安全加密(MD5)

转自：http://blog.csdn.net/wangzi11322/article/details/45581323

提交用户的隐私数据

一定要使用POST请求提交用户的隐私数据
GET请求的所有参数都直接暴露在URL中
请求的URL一般会记录在服务器的访问日志中
服务器的访问日志是黑客攻击的重点对象之一

用户的隐私数据
登录密码
银行账号
… …

数据安全

仅仅用POST请求提交用户的隐私数据，还是不能完全解决安全问题
可以利用软件（比如Charles）设置代理服务器，拦截查看手机的请求数据
因此：提交用户的隐私数据时，一定不要明文提交，要加密处理后再提交

常见的加密算法

<code class="hljs tex has-numbering">MD5 <span class="hljs-command">\ </span>SHA <span class="hljs-command">\ </span>DES <span class="hljs-command">\ </span>3DES <span class="hljs-command">\ </span>RC2和RC4 <span class="hljs-command">\ </span>RSA <span class="hljs-command">\ </span>IDEA <span class="hljs-command">\ </span>DSA <span class="hljs-command">\ </span>AES</code><ul style="display: block;" class="pre-numbering"><li>1</li></ul>

加密算法的选择
一般公司都会有一套自己的加密方案，按照公司接口文档的规定去加密

MD5加密

什么是MD5
全称是Message Digest Algorithm 5，译为“消息摘要算法第5版”
效果：对输入信息生成唯一的128位散列值（32个字符）

MD5的特点
输入两个不同的明文不会得到相同的输出值
根据输出值，不能得到原始的明文，即其过程不可逆

MD5的应用
由于MD5加密算法具有较好的安全性，而且免费，因此该加密算法被广泛使用
主要运用在数字签名、文件完整性验证以及口令加密等方面

MD5解密网站：http://www.cmd5.com

MD5改进

现在的MD5已不再是绝对安全，对此，可以对MD5稍作改进，以增加解密的难度
加盐（Salt）：在明文的固定位置插入随机串，然后再进行MD5
先加密，后乱序：先对明文进行MD5，然后对加密得到的MD5串的字符进行乱序
… …
总之宗旨就是：黑客就算攻破了数据库，也无法解密出正确的明文

网络数据加密方案

1> 加密对象：隐私数据，比如密码、银行信息
2> 加密方案
* 提交隐私数据，必须用POST请求
* 使用加密算法对隐私数据进行加密，比如MD5
3> 加密增强：为了加大破解的难度
* 对明文进行2次MD5 ： MD5(MD5( pass))∗先对明文撒盐，再进行MD5：MD5( pass.$salt)

2.本地存储加密
1> 加密对象：重要的数据，比如游戏数据

3.代码安全问题
1> 现在已经有工具和技术能反编译出源代码：逆向工程
* 反编译出来的都是纯C语言的，可读性不高
* 最起码能知道源代码里面用的是哪些框架

2> 参考书籍：《iOS逆向工程》

3> 解决方案：发布之前对代码进行混淆
* 混淆之前

<code class="hljs objectivec has-numbering"><span class="hljs-class"><span class="hljs-keyword">@interface</span> <span class="hljs-title">HMPerson</span> :<span class="hljs-title">NSObject</span></span>
- (<span class="hljs-keyword">void</span>)run;
- (<span class="hljs-keyword">void</span>)eat;
<span class="hljs-keyword">@end</span></code><ul style="display: block;" class="pre-numbering"><li>1</li><li>2</li><li>3</li><li>4</li></ul>

• 混淆之后

<code class="hljs objectivec has-numbering"><span class="hljs-class"><span class="hljs-keyword">@interface</span> <span class="hljs-title">A</span> :<span class="hljs-title">NSObject</span></span>
- (<span class="hljs-keyword">void</span>)a;
- (<span class="hljs-keyword">void</span>)b;
<span class="hljs-keyword">@end</span></code><ul style="display: block;" class="pre-numbering"><li>1</li><li>2</li><li>3</li><li>4</li></ul>

MD5加密实例

导入加密文件

<code class="hljs objectivec has-numbering"><span class="hljs-preprocessor">#import <span class="hljs-title">"ViewController.h"</span></span>
<span class="hljs-preprocessor">#import <span class="hljs-title">"MBProgressHUD.h"</span></span>
<span class="hljs-preprocessor">#import <span class="hljs-title">"NSString+Hash.h"</span></span>

<span class="hljs-class"><span class="hljs-keyword">@interface</span> <span class="hljs-title">ViewController</span> ()</span>
<span class="hljs-keyword">@property</span> (<span class="hljs-keyword">weak</span>, <span class="hljs-keyword">nonatomic</span>) <span class="hljs-keyword">IBOutlet</span> UITextField *username;
<span class="hljs-keyword">@property</span> (<span class="hljs-keyword">weak</span>, <span class="hljs-keyword">nonatomic</span>) <span class="hljs-keyword">IBOutlet</span> UITextField *pwd;
- (<span class="hljs-keyword">IBAction</span>)login;
<span class="hljs-keyword">@end</span>

<span class="hljs-class"><span class="hljs-keyword">@implementation</span> <span class="hljs-title">ViewController</span></span>

- (<span class="hljs-keyword">void</span>)viewDidLoad
{
    [<span class="hljs-keyword">super</span> viewDidLoad];
    <span class="hljs-comment">// Do any additional setup after loading the view, typically from a nib.</span>
}

- (<span class="hljs-keyword">void</span>)touchesBegan:(NSSet *)touches withEvent:(UIEvent *)event
{
    [<span class="hljs-keyword">self</span><span class="hljs-variable">.view</span> endEditing:<span class="hljs-literal">YES</span>];
}

- (<span class="hljs-keyword">IBAction</span>)login {
    <span class="hljs-comment">// 1.用户名</span>
    <span class="hljs-built_in">NSString</span> *usernameText = <span class="hljs-keyword">self</span><span class="hljs-variable">.username</span><span class="hljs-variable">.text</span>;
    <span class="hljs-keyword">if</span> (usernameText<span class="hljs-variable">.length</span> == <span class="hljs-number">0</span>) {
        [MBProgressHUD showError:@<span class="hljs-string">"请输入用户名"</span>];
        <span class="hljs-keyword">return</span>;
    }

    <span class="hljs-comment">// 2.密码</span>
    <span class="hljs-built_in">NSString</span> *pwdText = <span class="hljs-keyword">self</span><span class="hljs-variable">.pwd</span><span class="hljs-variable">.text</span>;
    <span class="hljs-keyword">if</span> (pwdText<span class="hljs-variable">.length</span> == <span class="hljs-number">0</span>) {
        [MBProgressHUD showError:@<span class="hljs-string">"请输入密码"</span>];
        <span class="hljs-keyword">return</span>;
    }

    <span class="hljs-comment">// 增加蒙板</span>
    [MBProgressHUD showMessage:@<span class="hljs-string">"正在拼命登录中...."</span>];

    <span class="hljs-comment">// 3.发送用户名和密码给服务器(走HTTP协议)</span>
    <span class="hljs-comment">// 创建一个URL ： 请求路径</span>
    <span class="hljs-built_in">NSURL</span> *url = [<span class="hljs-built_in">NSURL</span> URLWithString:@<span class="hljs-string">"http://218.83.161.124:8080/job/login"</span>];

    <span class="hljs-comment">// 创建一个请求</span>
    NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:url];

    <span class="hljs-comment">// 5秒后算请求超时（默认60s超时）</span>
    request<span class="hljs-variable">.timeoutInterval</span> = <span class="hljs-number">15</span>;

    request<span class="hljs-variable">.HTTPMethod</span> = @<span class="hljs-string">"POST"</span>;

<span class="hljs-preprocessor">#warning 对pwdText进行加密</span>
    pwdText = [<span class="hljs-keyword">self</span> MD5Reorder:pwdText];

    <span class="hljs-comment">// 设置请求体</span>
    <span class="hljs-built_in">NSString</span> *param = [<span class="hljs-built_in">NSString</span> stringWithFormat:@<span class="hljs-string">"username=%@&pwd=%@"</span>, usernameText, pwdText];

    <span class="hljs-built_in">NSLog</span>(@<span class="hljs-string">"%@"</span>, param);

    <span class="hljs-comment">// NSString --> NSData</span>
    request<span class="hljs-variable">.HTTPBody</span> = [param dataUsingEncoding:NSUTF8StringEncoding];

    <span class="hljs-comment">// 设置请求头信息</span>
    [request setValue:@<span class="hljs-string">"iPhone 6"</span> forHTTPHeaderField:@<span class="hljs-string">"User-Agent"</span>];

    <span class="hljs-comment">// 发送一个同步请求(在主线程发送请求)</span>
    <span class="hljs-comment">// queue ：存放completionHandler这个任务</span>
    NSOperationQueue *queue = [NSOperationQueue mainQueue];
    [<span class="hljs-built_in">NSURLConnection</span> sendAsynchronousRequest:request queue:queue completionHandler:
     ^(NSURLResponse *response, NSData *data, <span class="hljs-built_in">NSError</span> *connectionError) {
         <span class="hljs-comment">// 隐藏蒙板</span>
         [MBProgressHUD hideHUD];

        <span class="hljs-comment">// 这个block会在请求完毕的时候自动调用</span>
        <span class="hljs-keyword">if</span> (connectionError || data == <span class="hljs-literal">nil</span>) { <span class="hljs-comment">// 一般请求超时就会来到这</span>
            [MBProgressHUD showError:@<span class="hljs-string">"请求失败"</span>];
            <span class="hljs-keyword">return</span>;
        }

        <span class="hljs-comment">// 解析服务器返回的JSON数据</span>
        <span class="hljs-built_in">NSDictionary</span> *dict = [NSJSONSerialization JSONObjectWithData:data options:NSJSONReadingMutableLeaves error:<span class="hljs-literal">nil</span>];
        <span class="hljs-built_in">NSString</span> *error = dict[@<span class="hljs-string">"error"</span>];
        <span class="hljs-keyword">if</span> (error) {
            [MBProgressHUD showError:error];
        } <span class="hljs-keyword">else</span> {
            <span class="hljs-built_in">NSString</span> *success = dict[@<span class="hljs-string">"success"</span>];
            [MBProgressHUD showSuccess:success];
        }
     }];
}

<span class="hljs-comment">/**
 *  MD5($pass.$salt)
 *
 *  @param text 明文
 *
 *  @return 加密后的密文
 */</span>
- (<span class="hljs-built_in">NSString</span> *)MD5Salt:(<span class="hljs-built_in">NSString</span> *)text
{
    <span class="hljs-comment">// 撒盐：随机地往明文中插入任意字符串</span>
    <span class="hljs-built_in">NSString</span> *salt = [text stringByAppendingString:@<span class="hljs-string">"aaa"</span>];
    <span class="hljs-keyword">return</span> [salt md5String];
}

<span class="hljs-comment">/**
 *  MD5(MD5($pass))
 *
 *  @param text 明文
 *
 *  @return 加密后的密文
 */</span>
- (<span class="hljs-built_in">NSString</span> *)doubleMD5:(<span class="hljs-built_in">NSString</span> *)text
{
    <span class="hljs-keyword">return</span> [[text md5String] md5String];
}

<span class="hljs-comment">/**
 *  先加密，后乱序
 *
 *  @param text 明文
 *
 *  @return 加密后的密文
 */</span>
- (<span class="hljs-built_in">NSString</span> *)MD5Reorder:(<span class="hljs-built_in">NSString</span> *)text
{
    <span class="hljs-built_in">NSString</span> *pwd = [text md5String];

    <span class="hljs-comment">// 加密后pwd == 3f853778a951fd2cdf34dfd16504c5d8</span>
    <span class="hljs-built_in">NSString</span> *prefix = [pwd substringFromIndex:<span class="hljs-number">2</span>];
    <span class="hljs-built_in">NSString</span> *subfix = [pwd substringToIndex:<span class="hljs-number">2</span>];

    <span class="hljs-comment">// 乱序后 result == 853778a951fd2cdf34dfd16504c5d83f</span>
    <span class="hljs-built_in">NSString</span> *result = [prefix stringByAppendingString:subfix];

    <span class="hljs-built_in">NSLog</span>(@<span class="hljs-string">"\ntext=%@\npwd=%@\nresult=%@"</span>, text, pwd, result);

    <span class="hljs-keyword">return</span> result;
}
<span class="hljs-keyword">@end</span></code>