About 2 weeks ago, I showed a teaser for my new iPhone app, Lockbox. I was deliberately ambiguous, as I wanted to surprise everyone at WWDC with it. After getting some much-needed feedback on the app, I’d like to talk about what Lockbox actually is.
Lockbox is an app that lets you store encrypted photos and notes on your iPhone. Encryption requires that users enter some sort of key into the system, as a means of proving that the person who stored the data encrypted is the person trying to decrypt it. This has historically been done with passwords, which are easy to turn into a key. However, the iPhone’s screen doesn’t really lend itself to entering a complex password. The alternative that Apple has put forward is a 4-digit PIN number. This is too insecure; it would take at most 10,000 iterations to brute force the password, which is child’s play. Clearly, another system is needed.
Lockbox solves this problem with a very unique and innovative means of key entry. Rather than using a password or a PIN, Lockbox lets users draw a gesture with their finger on the screen. The gesture can be as long or as short as the user wants. In my tests, I’ve found the best gestures to be somewhere between 12 and 20 cells, which increases security over PIN numbers against brute forcing by 2 and 4 orders of magnitude respectively. And, as a bonus, gestures are much easier to remember and much faster to enter.
Lockbox will allow users to store encrypted versions of photos and notes. The raw key is never stored on disk, and is overwritten a few times when the application quits. Encryption and decryption is completely transparent and happens in the background. Furthermore, Lockbox is using industry-standard algorithms (specifically SHA-1 and AES). There are two advantages to this: first, the encryption algorithm currently has no known weaknesses; second, these algorithms are hardware-accelerated on the iPhone. Photos can be added from the photo library or the camera, and notes can be edited directly from within the app. Once you get past authentication, the user interface will be very familiar to users of the Photos and Notes apps already on the iPhone.
I’m currently working on getting the app finished, and will hopefully have it ready for the App Store on or near launch. Everyone who has seen it at WWDC has been completely blown away by how easy it is to enter these gestures. Furthermore, I’ll be exploring other options for key-entry. I already have a handful of ideas on other implementations, including one which I’m calling antigestures. However, I’m keeping that a secret for now. 🙂