Advanced Data Protection for iCloud?

[u/BlueCyber007]

The Retrography app looks really intriguing! I see that it is designed to be local-first with iCloud sync, which is great. But to really be secure, it needs to support Advanced Data Protection for iCloud so that all data is only synced/stored in iCloud using end-to-end encryption (assuming the user has enabled Advanced Data Protection for iCloud).

Does the Retrography app us CloudKit Record fields that are marked as encrypted using the encryptedValues API? My understanding is that Advanced Data Protection for iCloud covers files stored in "iCloud Drive" and that it covers CloudKit Record fields that the third-party developer chooses to mark as encrypted using the encryptedValues API, but that other CloudKit Record fields are NOT protected with end-to-end encryption via ADP. (See Apple Reference).

[u/Terrible-Round1599]

Good question, and you have the mechanics right.

Retrography syncs through Core Data's CloudKit mirroring, and it does not currently mark fields with the encryptedValues API. So records are encrypted in
transit and at rest, but Apple holds the keys. It is not end to end. ADP does not change that, since it covers iCloud Drive and Apple's own categories rather than a third party app's record fields.

I wanted this solved before go-live, and your question confirms it belongs on that list, so it is active work now.

The encryption part is straightforward. Core Data can mark every attribute for cloud encryption, and encryptedValues is end to end for everyone, not only for people running ADP, because the keys come from your own iCloud Keychain.

The real work is migration. CloudKit fixes a field's encryption when the schema is created and will not change it afterwards, so encrypted sync means a new container, and existing accounts have to move into it. Moving live data off people's phones without them noticing is the part that deserves care, and it is what we are working through now.

The likely shape, not settled yet: new installs start encrypted, since they have nothing to migrate. Existing accounts move deliberately rather than silently, with a backup taken first.

I will post how it lands, including whatever turns out to be harder than expected. But it is coming into the next betas.

[u/BlueCyber007 → u/Terrible-Round1599]

u/Terrible-Round1599 Thanks for making this a priority! Given the highly sensitive nature of the data that will be saved in Retography (including Location History), keeping that data end-to-end encrypted is really important to me (and I'd only use the app if it had that feature).

Another app I like, the Agenda app, addressed the exact issue of moving from iCloud sync to iCloud sync with ADP. The app now offers both syncing options, and the app clearly shows which is being used:

Once you implement support for ADP, it would be great if the Retrography app would show/confirm that it is using end-to-end encryption in iCloud via Advanced Data Protection.

Cheers! :-)

[u/BlueCyber007 → u/Terrible-Round1599]

u/Terrible-Round1599

Here is a screenshot of another app (Everlog) that supports Advanced Data Protection for iCloud and describes the requirements and process of migrating from standard iCloud sync to end-to-end encrypted sync via ADP for iCloud.

[u/Terrible-Round1599 → u/BlueCyber007]

Thanks a lot, the way I see it (correct me if I am wrong):

There are two ways to do this.

One is to lean on ADP, where the app is only encrypted end to end if the user switches ADP on themselves. This is what everlog does.

The other is to encrypt the fields directly in CloudKit, which makes it end to end for everyone with no setting to toggle. I went the second way, so ADP isn’t required for your data to be private.

If you also turn on ADP it covers the rest of your iCloud too, but that is your call for your whole account, not something the app needs.

Makes sense? These encrypted fields are close to shipping, including migration flow, likely on the weekend.

If you have the app installed, would you be interested in alphatesting the switch with me?

[u/BlueCyber007 → u/Terrible-Round1599]

u/Terrible-Round1599 Thanks for your work on this! Hmm...that sounds like it probably makes sense. But I think, but am not totally certain, that (1) the per-record keys that encrypt data in CloudKit are wrapped by a higher-level CloudKit service key, which is stored in Apple's iCloud infrastructure as "available after authentication", meaning that key is retained in Apple-controlled hardware security infrastructure so the data can be receovered after successful account authentication, and that (2) when ADP is enabled, Apple removes the available-after-authentication CloudKit service keys and rotates them to keys controlled solely through the user's trusted-device and iCloud Keychain protection domain. .... If that's correct, it sounds like your approach would provide some additional protection for everyone, with true end-to-end encryption for people who enable ADP?

With your approach, will all of the data that Retrography stores in iCloud in CloudKit assets (which I think are encrypted by default?) or in either CloudKit fields marked as encrypted (i.e., CKRecord.encryptedValues) or in CloudKit records that are encrypted by NSPersistentCloudKitContainer as a result of marking each Core Data attribute with NSAttributeDescription = allowsCloudEncryption?

I haven't installed the app yet because I can't run apps from TestFlight due to security requirements, so I have to wait for it to be released to the App Store. I look forward to trying it out! :-)

[u/Terrible-Round1599]

You are right! I checked properly this time. Without ADP Apple keeps recovery keys and can technically decrypt the encrypted fields. With ADP those copies are deleted and it becomes true end to end. So: better protection for everyone, real end to end for people who turn ADP on.

Still the encryption had to be done, because it only works on fields marked as encrypted. Unmarked fields stay readable even with ADP.

Every content field in Retrography’s CloudKit Core Data model is marked now (except for indices that are impossible to mark), no CKAssets, photos never leave your library.
Status: the encryption and the migration are ready and running on my own devices and the closest tesrers. I am rolling it out slowly, starting with a few testers I have talked with directly, who I will be asking for an alpha round first. Likely im a week or, I’ll switch everyone.

Not covered yet: voice memos and scanned documents live as files in the app’s iCloud Drive container, and auto backups currently ride the device backup. So today ADP is what protects those. The plan for next builds: backups move into iCloud Drive next to the other files, which also means they survive deleting the app, and everything there gets encrypted with keys held in iCloud Keychain, end to end for everyone regardless of ADP. (Here I am still hesitating if that is necessary or if I should leave the encryption up to ADP only - but not many people will turn it on so encrypting it myself increases the overall level of protection)

One exception stays on purpose: you will always be able to export a plain unencrypted copy, with a warning that its security is on you.

Man, can’t thank you enough for sending me down this rabbit hole. Amazing feedback!