title: Understanding the certificate and provisioning profile, let me know if it is right
body: <p>Recently I was studying how certificate and provisioning profile work on iOS, I read the blog <a href="http://escoz.com/blog/demystifying-ios-certificates-and-provisioning-files/" rel="nofollow noreferrer">"demystifying-ios-certificates-and-provisioning-files"</a> more than once, it's terrific, I think I have got the main idea from .</p>
  
  <p>Now I want to make sure I have the correct comprehension about that, so I have drawn a picture which describes some important parts inside certificate and provisioning profile, it will help us understand how provisioning profile works.
  <img src="https://i.stack.imgur.com/I1fyK.jpg" alt="enter image description here"></p>
  
  <p><strong><em>My understanding on development certificate and provision profile.</em></strong></p>
  
  <p>I will omit the details about how I requested certificate, just say that I get my development certificate and provisioning profile on Apple's website. In the picture my certificate is a part of provisioning profile.</p>
  
  <p>Now I want to debug my project on my iPhone, I select the provisioning profile in Xcode and the certificate accordingly, then start to build and run the app, during this, Xcode copy the provisioning profile to the app's bundle, it will be used it to check if I have the right to debug the app in this device.</p>
  
  <p><strong><em>How to Apple check it ?</em></strong></p>
  
  <p>In my picture, the provisioning profile contains a device identifier list and app's bundle identifier, if the identifier of my iPhone is contained in the device identifier list and my app's bundle identifier is conform to that in the provisioning profile, Apple will let it run on the device.</p>
  
  <p>But Apple must make sure the provisioning profile is legal, it should be from Apple's development Website rather than a fake one, how can it achieve that ?</p>
  
  <p>First of all, we should know Apple has a key pair (public key and private key) and we never know the private key. You know the RSA Algorithm ? Explain it in one sentence: you have data A, then encrypt A with private key, get B. If you encrypt B with your public key, you get A.</p>
  
  <p>Then let go on the process, in the provisioning profile, there is a digital signature, it is generated with these steps.</p>
  
  <ol>
  <li>Select a Signature Algorithm(maybe SHA1) and generate hash of "data part" in the provisioning profile, we call the result <code>hashData1</code>. ("data part" here should be all the data of provisioning profile except Signature itself)</li>
  <li>Using Apple's private key to encrypt <code>hashData1</code>, we call the result <code>digitalSigData1</code>. <code>digitalSigData1</code> is the digital signature, it is kept in the provisioning profile.</li>
  </ol>
  
  <p><strong><em>Now how Apple check using the digital signature ?</em></strong></p>
  
  <ol>
  <li>Using the same Signature Algorithm to generate the hash of the provisioning profile, we call the result <code>hashData2</code>.</li>
  <li>Using Apple's public key to encrypt <code>digitalSigData1</code> so we get <code>hashData3</code>, then we compare <code>hashData3</code> with <code>hashData2</code>, if they are the same, it means the provisioning profile is authorized by Apple. (To understand why, we must talk about the <a href="http://en.wikipedia.org/wiki/Public-key_cryptography" rel="nofollow noreferrer">asymmetric cryptographic algorithm</a>)</li>
  </ol>
  
  <p>Then what the certificate do ? Well, it is used to make sure the files in app's bundle haven't been modified since the build. <a href="http://escoz.com/blog/demystifying-ios-certificates-and-provisioning-files/" rel="nofollow noreferrer">Referenced in that blog "demystifying-ios-certificates-and-provisioning-files"</a>:</p>
  
  <p><strong><em>A directory called "_CodeSignature". This is the interesting one. Inside it there's one file called "CodeResources"; it's a simple plist file, but it contains cryptographic hashes of all the other files in the solution.</em></strong></p>
  
  <p>These hashes are the same things as digital signature, but they are encrypted using my private key not Apple's. Apple will check if files have been modified in the same way I mentioned above but the public key is my public key stored in my certificate.</p>
  
  <p>Every time apple runs my app, it will check if files in my app's bundle have been modified, if someone has, the app would crash.</p>
  
  <p>I learned the process of certification from famous book named <strong><em>Computer Networking A Top-Down Approach Featuring the Internet</em></strong>, it talks about the digital signature and certification in chapter 7. All above is my comprehension on certificate and provisioning profile, I think there maybe something wrong in it, thanks to anyone who points it out.</p>