14.6 · CryptoKit in practice: AEAD, key agreement, signatures, one-time codes and tokens

The earlier questions explain which primitive to pick. These run the primitives and the standard formats built on them (TOTP, PKCE, JWT) against published test vectors, so you can say what really happens at the byte level.

Mental model. A primitive is only as safe as its inputs and its checks: the nonce, the associated data, the algorithm field and the comparison are where real bugs live.

Encryption and key agreement

What a nonce mistake leaks, what associated data binds, and how two parties agree a key.

  1. What does the associated data in AES-GCM bind, what exactly leaks when a nonce is reused, and which errors do you see when you open a box wrongly? 14.6.1 · L5
    Authenticated encryption with associated data (AEAD) protects two things: the secret plaintext, and extra context you send in the clear but want bound to the…
  2. How do two parties agree on a key with CryptoKit, why must the shared secret go through HKDF, and what does HPKE add? 14.6.2 · L5
    Key agreement (ECDH) lets two parties who each hold a private key and know the other’s public key compute the same shared secret without sending it…

Signatures and one-time codes

Signature encodings and randomness, and TOTP from first principles.

  1. How do P-256 and Ed25519 signatures differ in CryptoKit: sizes, encodings, determinism, and interoperating with other tools? 14.6.3 · L3
    Both algorithms produce a 64-byte signature in CryptoKit, but the encodings and the plumbing differ. A P-256 signature has a rawRepresentation (r then s, 64…
  2. How does a time-based one-time password (TOTP) work, and how would you compute one with CryptoKit? 14.6.4 · L3
    A TOTP code (the six digits in an authenticator app) is an HMAC of the current time step under a shared secret, truncated to a few digits. HOTP (RFC 4226)…

Tokens

PKCE and the checks a client should make on a JWT.

  1. How does PKCE protect an OAuth sign-in in an app, how is the code challenge computed, and what are state and nonce for? 14.6.5 · L3
    A native app cannot keep a client secret, and the redirect back to the app (a custom scheme or universal link) can be intercepted by another app or by a…
  2. What should code that reads a JWT check, why is a client usually not the one to trust it, and what is the “alg: none” trap? 14.6.6 · L3
    A JWT is three base64url parts, header.payload.signature, where the signature covers the first two. Anyone can read the payload (it is only encoded, not…

More in Security & privacy