10 Lines of Encryption, 1500 Lines of Key Management
summary
A note-taking app implements per-note AES-256-GCM encryption with keys derived via PBKDF2 and additional app-level KDFs, while storing encrypted password blobs in iCloud Keychain Sync and using biometric-unlock wrapping without keeping a persistent master key. The engineering focuses less on the cryptographic primitives (the “10 lines of encryption”) and far more on ~1500 lines of key management code: versioned migration paths to upgrade ciphers, monotonic timers and RAM-cached keys for usability, encrypted hints, and multiple defense‑in‑depth controls and incident migration mechanisms.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:33GDPR data protection
- 7:07DoD encryption rules
- 13:00Security design process
- 14:27Defense in depth
- 20:40Bear app encryption
- 27:51Bear threat models
- 33:55Bear encryption architecture
- 41:21Bear layered protection
- 47:26Encryption updates
- 49:35Summary
- 53:07Q&A
related talks
58m10 Lines of Encryption, 1500 Lines of Key Management
41mNote encryption: 10 lines for encryption, 1500 lines for key management
23mKeeping secrets with JavaScript
24mEnd-to-End encryption for iOS Developer
52mBehind the Scenes of iOS Security
37mKeys from the castle: ancient art of managing keys and trust
41miOS App Integrity: Got Any?
23mData Encryption on Android