CoreData & Data Protection

Question

So I am working on a app which stores user information with CoreData framework locally. The information can be sensitive, so I am thinking how to protect the information stored to the data base. In Xcode dashboard, under the capabilities tab, I found this Data Protection switch:

Anyone knows how this works? If I turn on the switch will Xcode encode my CoreData files automatically? Or how to implement this protection on my CoreData files? Appreciate your time and patient. Thank you!

Answer 1

You found the right spot, you have to turn on the Data Protection switch in your target's capabilities pane to signal that you want to use data protection. According to Apple's documentation, this should suffice:

The default level of protection is complete protection, in which files are encrypted and inaccessible when the device is locked. You can programmatically set the level of protection for files created by your app [...]

It states you can set the level of protection programmatically. If you want to do that (I still do that, to be save ;), you should use the appropriate option when creating the persistentStoreCoordinator:

NSDictionary *options = [NSDictionary dictionaryWithObjectsAndKeys:
                         @YES, NSMigratePersistentStoresAutomaticallyOption,
                         @YES, NSInferMappingModelAutomaticallyOption,
                         NSFileProtectionComplete, NSPersistentStoreFileProtectionKey, // <-- HERE
                         nil];
...

__persistentStoreCoordinator = [[NSPersistentStoreCoordinator alloc] initWithManagedObjectModel:[self managedObjectModel]];
if (![__persistentStoreCoordinator addPersistentStoreWithType:NSSQLiteStoreType configuration:nil URL:storeURL options:options error:&error]) {
...
}

NSFileProtectionComplete means

The file is stored in an encrypted format on disk and cannot be read from or written to while the device is locked or booting.

You could also use NSFileProtectionCompleteUnlessOpen, see the Xcode Quick Help for differences.

Answer 2

As per Apple documentation, the Data protection is enabled automatically when the user sets an active passcode for the device. The system encrypts and decrypts your content behind the scenes. These processes are automatic and hardware accelerated. But still we can set the file protection level options programmatically by using none, complete, completeUnlessOpen and completeUntilFirstUserAuthentication

let options = [NSMigratePersistentStoresAutomaticallyOption:true,
                           NSInferMappingModelAutomaticallyOption:true,
                           NSPersistentStoreFileProtectionKey: FileProtectionType.complete] as [String : Any]
            try persistantStoreCoordinator.addPersistentStore(ofType: NSSQLiteStoreType, configurationName: nil, at: storeURL, options: options)

Refer this link to know more information on different types of options.