In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below:
The Notes app includes a Secure Notes feature that allows users to protect the contents of specific notes. Secure notes are encrypted using a user-provided passphrase that is required to view the notes on iOS, macOS, and the iCloud website.
When a user secures a note, a 16-byte key is derived from the user’s passphrase using PBKDF2 and SHA256. The note’s contents are encrypted using AES-GCM. New records are created in Core Data and CloudKit to store the encrypted note, tag, and initialization vector, and the original note records are deleted; the encrypted data isn’t written in place. Attachments are also encrypted in the same way.
When a user successfully enters the passphrase, whether to view or create a secure note, Notes opens a secure session. While open, the user isn’t required to enter the passphrase, or use Touch ID, to view or secure other notes. However, if some notes have a different passphrase, the secure session applies only to notes protected with the current passphrase. The secure session is closed when the user taps the Lock Now button in Notes, when Notes is switched to the background for more than 3 minutes, or when the device locks.
How secure?
– As security can be interpreted in different ways (choice of well-vetted algos, correct implementation, securing against specific adversaries, etc.), what kind of scenario are you thinking about? Or do you simply want to know if the key derivation and AES-GCM encryption they use can be regarded as “cryptographically secure at the time of writing this”? $\endgroup$