Data security for the iPhone Application should be considered during storage on the iPhone and also during transit over the network.
Data protection during storage.
By default all the data (FDE – Full Disk Encryption) on the iPhone is encrypted using AES encryption algorithm. The key for the same is stored in the iPhone. This feature was introduced in iPhone 3GS and is based on the hardware based encryption. This feature was introduced to enable instantaneous wipeout of the data on the iPhone. By wiping out the key used for the encryption on the iPhone rather than overwriting every bit on the iPhone device, the data on the iPhone was made unusable.
The key used for encrypting the data on the iPhone is not encrypted. There were scenarios where people with knowledge of iPhone and encryption were able to retrieve the key from the iPhone and decrypt all the data on the iPhone (http://www.zdziarski.com/blog/?p=516). This was the weakness with the data encryption using FDE in iPhone 3GS.
With the release of iOS 4 Apple introduced Data Protection feature, a substantial improvement in the security design of iPhone. A combination of the Device Key, User Passcode Key, File System Key and File Key are used to protect the data on the iPhone. This can be called TFA (Two Factor Authentication). TFA is based on ‘what you know’ and ‘what you have’. In case of the Data Protection feature, ‘what you know’ is the User Passcode key and ‘what you have’ are the remaining keys.
