Where would you store protected user data?

To store protected user data, I would use:

• Keychain Services: Ideal for storing small, sensitive data such as passwords, authentication tokens, encryption keys. Data is encrypted at the hardware level and accessible only when the device is unlocked.

• Entropy: For generating cryptographically strong keys and random data.

For large volumes of protected data:

• Core Data / Realm / SQLCipher: Using encryption at the database level.
  • Core Data and Realm can handle encryption, but this requires additional configuration and implementation.
  • SQLCipher is an extension of SQLite providing transparent encryption.

Example of using Keychain Services:

import Security

class KeychainManager {

    func save(key: String, data: Data) -> OSStatus {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecValueData as String: data
        ]

        SecItemDelete(query as CFDictionary) // Delete existing record if any
        return SecItemAdd(query as CFDictionary, nil) // Add new record
    }

    func load(key: String) -> Data? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecReturnData as String: kCFBooleanTrue!,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]

        var dataTypeRef: AnyObject? = nil
        let status: OSStatus = SecItemCopyMatching(query as CFDictionary, &dataTypeRef)

        if status == noErr {
            return dataTypeRef as? Data
        } else {
            return nil
        }
    }

    func delete(key: String) -> OSStatus {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key
        ]

        return SecItemDelete(query as CFDictionary)
    }
}

It is also important to consider:

• Access policy: Define what conditions must be met to access protected data (e.g., Face ID/Touch ID unlock).
• Invalidation: Procedure for deleting data when the user logs out or the app is deleted.
• Synchronization: If data needs to be accessible on multiple devices, consider secure synchronization methods using iCloud Keychain or proprietary encrypted cloud solutions.

The choice of specific storage method depends on the data type, size, security requirements, and ease of use. Keychain Services is the foundation for storing the most critical data.