davidmtamas

final class PublicKeyPinner {
    /// Stored public key hashes
    private let hashes: [String]

    public init(hashes: [String]) {
        self.hashes = hashes
    }

    /// ASN1 header for our public key to re-create the subject public key info
    private let rsa2048Asn1Header: [UInt8] = [

davidmtamas

return keyWithHeader.sha256().base64EncodedString()

davidmtamas

var hash = [UInt8](repeating: 0,  count: Int(CC_SHA256_DIGEST_LENGTH))
_ = keyWithHeader.withUnsafeBytes {
    CC_SHA256($0.baseAddress!, CC_LONG(keyWithHeader.count), &hash)
}
return Data(hash).base64EncodedString()

davidmtamas

import CryptoSwift
import CommonCrypto

#if canImport(CryptoKit)
import CryptoKit
#endif

public final class PublicKeyPinner {
  ...
  /// Creates a hash from the received data using the `sha256` algorithm.

davidmtamas

/// ASN1 header for our public key to re-create the subject public key info
private let rsa2048Asn1Header: [UInt8] = [
  0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
  0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00
]

davidmtamas

// For each certificate in the valid trust:
for index in 0..<SecTrustGetCertificateCount(serverTrust) {
  // Get the public key data for the certificate at the current index of the loop.
  guard let certificate = SecTrustGetCertificateAtIndex(serverTrust, index),
    let publicKey = SecCertificateCopyPublicKey(certificate),
    let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) else {
      return false
  }

  // Hash the key, and check it's validity.

davidmtamas

// Check if the trust is valid
var secResult = SecTrustResultType.invalid
let status = SecTrustEvaluate(serverTrust, &secResult)

guard status == errSecSuccess else { return false }

davidmtamas

if let domain = domain {
  let policies = NSMutableArray()
  policies.add(SecPolicyCreateSSL(true, domain as CFString))
  SecTrustSetPolicies(serverTrust, policies)
}

davidmtamas

public final class PublicKeyPinner {
  /// Stored public key hashes
  private let hashes: [String]

  public init(hashes: [String]) {
    self.hashes = hashes
  }

  /// Validates an object used to evaluate trust's certificates by comparing their public key hashes
  /// to the known, trused key hashes stored in the app.