Working with sensitive data

The PowerAuth mobile SDK is using the PowerAuthSecureData object to manage the cryptographically sensitive data, such as encryption keys. You can encounter this object in several public API functions, such as functions for Secure Vault. This chapter explains how to use the PowerAuthSecureData object properly.

Create an instance of PowerAuthSecureData

If you need to provide cryptographically sensitive key material to PowerAuth mobile SDK, then use the following code:

let yourKey = "nbuSR123nbuSR123".data(using: .ascii)!
let secureData = PowerAuthSecureData(withData: yourKey)

The secureData object will keep copy of bytes. In case you also wants to destroy the content of source Data structure, then you can try an alternative constructor, that try to erase content of the source data in case the source data is instance of NSMutableData class:

let mutableKey = NSMutableData(data: "nbuSR123nbuSR123".data(using: .ascii)!) as Data
let secureData = PowerAuthSecureData(withDataAndClearSource: mutableKey)

As you can see, this unlikely happens in typical Swift projects, so you may ensure on your own that data is erased properly:

extension Data {
    mutating func secureErase() {
        resetBytes(in: 0..<count)   // Fill with zeroes
        removeAll(keepingCapacity: false) // Release memory
    }
}

var yourKey = "nbuSR123nbuSR123".data(using: .ascii)!
let secureData = PowerAuthSecureData(withData: yourKey)
yourKey.secureErase()

Using an instance of PowerAuthSecureData

To get reference to stored bytes, use the following code:

func processSecureData(secureData: PowerAuthSecureData) {
    doSomethingWitBytes(secureData.sensitiveData)
}

Read Next

• Biometry Setup