Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

When I purchase an app in iTunes on my Windows computer, I get an *.ipa file that is a self-contained iOS application package. I can browse the contents of these IPA files with 7-Zip and even extract resources and other details, which suggests these IPA files aren't encrypted at all.

So if they aren't encrypted, how does DRM work? What's stopping me from copying an IPA file to someone else's computer and importing the IPA into iTunes and then installing it on someone else's device?

Also, can someone please confirm that so long as I keep the IPA file I will be able to install it to my iDevices (under the same Apple ID, of course)? I'm just concerned that in future an app might be updated to remove features or might even be pulled from the app store completely.

share|improve this question
1  
I don't know what stops you from doing that, but I know at least one way it could be done: Namely, by iOS refusing to run an app unless it has been paid for, a record of that payment being present in the form of some digital signature on a piece of data including a checksum of the app. –  Harald Hanche-Olsen Mar 8 '12 at 22:27

2 Answers 2

Actually, it works more like SSL. Upon signing up for an Apple account Apple generates a Public/Private Key pair for your username. It then gives you your private key and it keeps your public. (That's why when you first buy or when you restore your iDevice you must activate it with your iTunes account). Upon activation it transfers your private key to your iDevice. Basically what happens is when you buy an app (free or paid) Apple generate a 4196 byte long header that is encrypted with your public key.

If you have any understanding of Public/private keys, the public key can encrypt for it's private pair... For example I would use a servers public key to encrypt data to send to the server. The server would then use it's private key to decrypt it. When it wants to send data back, it uses my public key to encrypt the data and I use my private key to decrypt it! Public keys can only encrypt data and cannot decrypt and vice-versa for private keys.

When you download your app it has a header encrypted with your public key. Only your private key can decrypt the header embedded in the app. So for example, if I copied an IPA generated for you, and put it on my iDevice (this is assuming you can get It there, iTunes would refuse to sync it anyway), and then I tried to run it, it would simply crash because my private key wouldn't be able to decrypt the header! Also its worth noting that the IPA file (an IPA is essentially a zip file that's been renamed) doesn't have the header, if you take a look at the contents of an IPA you will realize that it contains an extension-less file, take Facebook's app for example, it would have a file named 'Facebook'. This is the app's binary, and this is the file that has the encrypted header in it.

Yes, as stated above your apps will continue to run so long as you can remember your Apple ID as the iDevice (and iTunes) does NO signature checking with iTunes what-so-ever! This means you can install removed apps and also sync older IPAs to your device so long as they are yours and you still have the IPA indefinitely!

share|improve this answer
1  
I would go into how to circumvent this, but I'd probably get into trouble! ^_^ to make a comment on Apples stupidity, I'll just say that a memory dump of the running app gives you a very interesting header ;) (NUDGE NUDGE THAT IS A VERY BIG HINT!) –  jduncanator Apr 10 '12 at 18:51

Each app has a "signature", a unique string assigned by Apple. Installing an app to an iOS device causes the device or iTunes (depending how you're installing it) to check in with Apple to make sure the signature is authorized to be used on iOS and that it's been purchased with the Apple ID in use.

While I haven't tried this personally, I assume the former means you can't install apps since removed form the App Store. (You can continue to use already-installed apps that have been removed, however.) The latter means you can't freely distribute apps.

As to the "removing features" of apps, you can restore an app to an earlier version, assuming you have its .ipa, though it takes several steps. Of course, if it's mentioned in the change log, you can just not update it in the first place.

share|improve this answer
    
This signature-checking is also being phased in on the Mac, with Gatekeeper on Mountain Lion. –  timothymh Mar 9 '12 at 1:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.