0
votes

I'm using Parse as my backend for my iOS application and would like to encrypt all the data that's sent between Parse and my iOS device. As such, I'm using Parse Cloud Code in hopes of being able to perform server-side encryption & decryption to process all data it sends and receives.

Apparently Parse has a 'crypto' module by default, but since I've been unable to find any documentation for it, I've gone ahead and tried using crypto-js by copying the appropriate files for AES encryption + decryption into my Parse Cloud Code /cloud folder.

The issue I'm running into is that I'm not sure what class of object is being returned by crypto-js's AES encryption / decryption function. I *seem* to be getting back an NSDictionary object but have no idea what to do with it. I would have guessed that I would receive an NSString or NSData object, but I seem to have guessed wrong.

Please let me know what additional information I can provide or what incorrect assumptions I may have made.

2

2 Answers

2
votes

I needed to encrypt / decrypt on the server side, here is my cloud code which is similar to nodeJS code:

var crypto = require('crypto');
var cryptoAlgorithm = "aes-128-cbc"; //or whatever you algorithm you want to choose see http://nodejs.org/api/crypto.html
var cryptoPassword = "theLongAndRandomPassphrase";
var cipher = crypto.createCipher(cryptoAlgorithm,cryptoPassword);
var decipher = crypto.createDecipher(cryptoAlgorithm,cryptoPassword);
exports.myCiphering = {
    encrypt:function(text){
        var encrypted = cipher.update(text,'utf8','hex')
        encrypted += cipher.final('hex');
        return encrypted;
    },
    decrypt: function(text){
        var decrypted = decipher.update(text,'hex','utf8')
        decrypted += decipher.final('utf8');
        return decrypted;
    }
};

If this snippet has been saved in "cloud/ciphering.js", you can then use the ciphering tool like this anywhere in cloud code:

var text = "encryptMe";

var ciphering = require("cloud/ciphering.js").myCiphering;
var encrypted = ciphering.encrypt(text);
var decrypted = ciphering.decrypted(encrypted);

if (decrypted == text){
     //the "password" is correct
}
1
votes

Since Parse uses SSL all data is sent encrypted, SSL is enough to secure the communications.

You may want to encrypt the data so that it is protected on the server but unless you really understand cryptographic security don't.

Plain or encrypted passwords should never be stored, store a properly salted and hashed version of the password.

If you feel your data is substantially valuable enough have a security domain expert design it. Getting security right is hard, one mistake will invalidate it all.