Develop Reference

String encryption using Jetpack Security in Android

Currently we are encrypting our String as:
import android.util.Base64;
import java.security.Key;
import java.util.Arrays;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
public class Cipher {
private static final String TEXT_ENCODING_TYPE = "UTF-8";
private static final String ALGO = "AES";
private static final String TYPE = ALGO + "/CBC/PKCS5Padding";
private static final String KEY = "MY_STATIC_KEY";
private static final String IV = "MY_STATIC_VECTOR";
private static final String IV_PADDING = " ";
public static String encrypt(String data) {
try {
if (!data.isEmpty()) {
javax.crypto.Cipher cipher = javax.crypto.Cipher.getInstance(TYPE);
cipher.init(javax.crypto.Cipher.ENCRYPT_MODE, getKey(), getIV());
return Base64.encodeToString(cipher.doFinal((IV_PADDING + data).getBytes()), Base64.NO_WRAP).trim();
} else {
return data;
}
} catch (Exception e) {
return data;
}
}
return new String(cipher.doFinal(data)).trim();
} else {
return encryptedData;
}
} catch (Exception e) {
LogUtils.log(e, Cipher.class);
return encryptedData;
}
}
private static Key getKey() throws Exception {
return new SecretKeySpec(KEY.getBytes(TEXT_ENCODING_TYPE), ALGO);
}
private static IvParameterSpec getIV() throws Exception {
return new IvParameterSpec(IV.getBytes(TEXT_ENCODING_TYPE));
}
private static IvParameterSpec getIV(byte[] iv) {
return new IvParameterSpec(iv);
}
}
But we have received Security alert from Google Play Console:
Your app contains unsafe cryptographic encryption patterns.
And then we were redirected to this link: Remediation for Unsafe Cryptographic Encryption.
However, this link recommends to use Jetpack Security package in which I couldn't find how to encrypt string and generate safe KEY and IV for each of our Server request.
All the examples and links I have visited points to save your sensitive data to encrypted files and SharedPreferences.
So, what should I do now? Do I have to find secure key generation mechanism that can also be decoded on Server side (Java) and save that key in Secured SharedPreferences? Jetpack Security package is still in Beta mode.
Open for more clarification.

I would take your signature:
public String encrypt(String data) and keep it that way but choose an approach:
Is the data small enough that using Secure Shared Preferences enough to store something? (not the best idea due to the issues with Shared Pref.)
Can you keep the data in a File (temporary) and then return that?
You can do either, the difference shouldn't be too big since you're likely going to have some form of class YourCryptoImplementation where you're going to perform all this...
Using Shared Preferences
You can have a couple of methods (sorry, In Kotlin because it's shorter and I've already used similar code):
private fun getEncryptedPreferences() =
EncryptedSharedPreferences.create("your_shared_preferences", advancedKeyAlias,
context, EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM)
You're going to wonder what advancedKeyAlias is. That's just a private var advancedKeyAlias: String but the actual value... will be something like:
init {
val advancedSpec = KeyGenParameterSpec.Builder("your_master_key_name",
KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT).apply {
setBlockModes(KeyProperties.BLOCK_MODE_GCM)
setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
setKeySize(256)
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
val hasStrongBox = context.packageManager.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)
if (hasStrongBox)
setIsStrongBoxBacked(true)
}
}.build()
advancedKeyAlias = MasterKeys.getOrCreate(advancedSpec)
}
So, now in your init() of this class, you ensure you have your key alias created.
You can use it to encrypt or decrypt.
Back to our SharedPref. example:
Let's say you want to store a string, you can offer:
fun encryptToSharedPref(String data) {
getEncryptedPrefs().edit().putString("the_key_you_want_to_use", data).apply()
}
And to "read" the value:
fun getValueFromSharedPreferencesWith(key: String) = getEncryptedPreferences().getString(key, null)
That would work, if the strings fit in SharedPref and if you don't care about other Shared Preferences issues...
What about FILES?
Not a huge difference, but assuming you're in the same class (that is, the advancedKeyAlias exists).
You're going to have a getEncryptedFile helper method:
private fun getEncryptedFile(file: File) = EncryptedFile.Builder(file, context, advancedKeyAlias,
EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB).build()
And you can decrypt a file like:
fun decryptFile(file: File): FileInputStream {
return getEncryptedFile(file).openFileInput()
}
Very simple, and you can obviously use it like
val rawData = yourCryptoClassAbove.decryptFile(File("path/to/file").readBytes()
val decryptedString = String(rawData)
Now to encrypt a file, you can use a FileOutputStream, that is a stream that outputs the bytes directly to a file... in our case, an encrypted file.
E.g.:
fun encryptFile(bytes: ByteArray, file: File) {
var outputStream: FileOutputStream? = null
try {
outputStream = getEncryptedFile(file).openFileOutput().apply {
write(bytes)
}
} catch (exception: IOException) {
Log.e(TAG, "output file already exists, please use a new file", exception)
} finally {
outputStream?.close()
}
}
You receive a ByteArray though, but that's not hard to obtain if you have a string...
var dataToEncrypt = ... //any "String"
yourCryptoClassAbove.encryptFile(File("path/to/file", dataToEncrypt.toByteArray())
And that's basically most of what you'd likely need. Obviously, you can have any method to generate your "advancedKey".
I don't know if this would help you, but it would certainly abstract the complexity of encrypting away from your code using it.
Disclaimer: some of these is code I've used, some is just "pseudo code" that gives you an Idea what I had in mind.

Base64-Encoded EC Private Key String to PrivateKey

I am trying to convert my private key string to a PrivateKey object in my Android application. I have read a lot of posts on StackOverflow about this topic, but I just can solve my issue.
I am using the following function to convert my key:
String privateKey = "MIGkAgEBBDCAHpFQ62QnGCEvYh/pE9QmR1C9aLcDItRbslbmhen/h1tt8AyMhskeenT+rAyyPhGgBwYFK4EEACKhZANiAAQLW5ZJePZzMIPAxMtZXkEWbDF0zo9f2n4+T1h/2sh/fviblc/VTyrv10GEtIi5qiOy85Pf1RRw8lE5IPUWpgu553SteKigiKLUPeNpbqmYZUkWGh3MLfVzLmx85ii2vMU=";
#Nullable
private static PrivateKey getKey(String key) {
try {
byte[] byteKey = Base64.decode(key.getBytes(), Base64.DEFAULT);
KeyFactory keyFactory = KeyFactory.getInstance("EC");
return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(byteKey));
} catch (Exception e) {
e.printStackTrace();
}
return null;
}
According to ASN.1 JavaScript decoder, I do have a valid private key.
Nonetheless, getKey() always fails with the following exception:
java.security.spec.InvalidKeySpecException: java.lang.RuntimeException: error:0c0000be:ASN.1 encoding routines:OPENSSL_internal:WRONG_TAG
I cannot make sense of this error message. Even after a lot of googling. Does anybody know, what I am doing wrong? Am I using the wrong key spec (though many of the answers here suggest the use of PKCS8EncodedKeySpec().
The private key you see in the code above was generated by jwt.io using an ES384 algorithm.

Strings protection in Android application

I want to protect some Strings in my Android application, it contain information that should not be viewed. The best idea I've had so far is to encrypt these strings using an AES algorithm or something and put the password in a Google Cloud Storage file that can only be viewed with authentication (by Firebase Auth), so in theory the application always accesses that file when need. This is a good idea?

I have already solved my question, I have these two methods that work very well:
public static String encrypt(String message, String key) {
String cipherText = null;
try {
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key.getBytes(), "AES"));
byte[] bytes = cipher.doFinal(message.getBytes("UTF-8"));
cipherText = Base64.encodeToString(bytes, Base64.DEFAULT);
} catch(Exception ex) {
ex.printStackTrace();
}
return cipherText;
}
public static String decrypt(String encoded, String key) {
String decryptString = null;
try {
byte[] bytes = Base64.decode(encoded, Base64.DEFAULT);
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key.getBytes(), "AES"));
decryptString = new String(cipher.doFinal(bytes), "UTF-8");
} catch(Exception ex) {
ex.printStackTrace();
}
return decryptString;
}
After the encrypt method encrypts the message in AES, it uses Base64 to make the byte[] into a readable String that can be stored in a strings.xml file or Java Class, and the decrypt method does the inverse. And my application only pick up the key online via Firebase Storage.
Now, if someone tries to reverse engineer my code, the only thing they can see is:
<string name="code_1">nuD559T1j8VSqjidiF3Yag==</string>
<string name="code_2">+4MTk9TaJJAJEV6D07K++Q==</string>
<string name="code_3">4GlPuHyAGhd48bjuSvcvQQ==</string>
<string name="code_4">yQnq3/tEIxJe67bhBuzoHw==</string>
<string name="code_5">p/sDptvxdi0ynsuybvfI+A==</string>
<string name="code_6">dE4aV0wG0aINh/dw0wwevQ==</string>
<string name="code_7">vxNaPmHvnbGsydOYXSOSUA==</string>
<string name="code_8">fClfcC/Eweh9tA8xz6ktGw==</string>
<string name="code_9">FxzAZpH+SJt5Lv6VFU/BEQ==</string>
<string name="code_10">qh3jFGHOGMzt50WOwTG4H4Y2Vbr7TzO433tbB3s6P34=</string>
<string name="code_11">u7kZjN/bxkMEqDws4nvbnQ==</string>
<string name="code_12">Ccf2u8FJGJ1lsiR7aX5OSw==</string>
<string name="code_13">E4XsWDHO28pOhV4ter/f2A==</string>
<string name="code_14">kgPr+Yz3t4S+Y5zQXjkvJA==</string>
<string name="code_15">19CpjUzKOw1fL8bZH8xkMg==</string>

You can refer about NDK :
Example:
#include <string.h>
#include <jni.h>
jstring Java_com_riis_sqlndk_MainActivity_invokeNativeFunction(JNIEnv* env,
jobject javaThis) {
return (*env)->NewStringUTF(env, "pass123");
}
And use in Android:
public class MainActivity extends Activity {
static {
System.loadLibrary("sqlndk"); // line 11
}
private native String invokeNativeFunction(); // line 14
#Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
String key = invokeNativeFunction(); // line 21
}
}
I hope it can help your problem!

It seems to be very good idea as long as you don't need this strings in offline mode. Otherwise use Keystore.
More information: https://developer.android.com/training/articles/keystore.html
Example: https://www.androidauthority.com/use-android-keystore-store-passwords-sensitive-information-623779/
In addition When you don't need this values in offline mode - You can store its in Keystore and store remotely only private key not all strings.

Realm Encryption with Android

Realm is using AES-256 for encryption and decryption. And, I am trying to use Android KeyStore to generate/store the keys, but as per this page - https://developer.android.com/training/articles/keystore.html#SecurityFeatures, Android supports this only on APIs 23 and above.
Can someone please point me to an example or any other related info on how I can use realm with encryption to support APIs 4.0 and above?
Thanks.

We recently ran into the same problem and decided to simply store the key in private Shared Preferences, because if the phone is not rooted, you will not be able to get it and if it is rooted, then there are some ways to get data even from secure keyStore.
We use next Realm configuration inside Application subclass:
RealmConfiguration config = new RealmConfiguration.Builder()
.deleteRealmIfMigrationNeeded()
.name(DB_NAME)
.encryptionKey(mKeyProvider.getRealmKey())
.build();
And mKeyProvider is our helper class that is used to get the key:
public class SharedPrefsKeyProvider implements KeyProvider {
private static final String REALM_KEY = "chats.realm_key";
SharedPreferences mAppSharedPrefs;
public SharedPrefsKeyProvider(SharedPreferences aAppSharedPrefs) {
mAppSharedPrefs = aAppSharedPrefs;
}
#Override
public byte[] getRealmKey() {
byte[] key;
String savedKey = getStringFromPrefs(REALM_KEY);
if (savedKey.isEmpty()) {
key = generateKey();
String keyString = encodeToString(key);
saveStringToPrefs(keyString);
} else {
key = decodeFromString(savedKey);
}
return key;
}
#Override
public void removeRealmKey() {
mAppSharedPrefs.edit().remove(REALM_KEY).apply();
}
#NonNull
private String getStringFromPrefs(String aKey) {
return mAppSharedPrefs.getString(aKey, "");
}
private void saveStringToPrefs(String aKeyString) {
mAppSharedPrefs.edit().putString(REALM_KEY, aKeyString).apply();
}
private String encodeToString(byte[] aKey) {
Timber.d("Encoding Key: %s", Arrays.toString(aKey));
return Base64.encodeToString(aKey, Base64.DEFAULT);
}
private byte[] decodeFromString(String aSavedKey) {
byte[] decoded = Base64.decode(aSavedKey, Base64.DEFAULT);
Timber.d("Decoded Key: %s", Arrays.toString(decoded));
return decoded;
}
private byte[] generateKey() {
byte[] key = new byte[64];
new SecureRandom().nextBytes(key);
return key;
}
}
A KeyProvider is just a custom interface. An example of KeyProvider can be:
package xxx.com;
interface KeyProvider {
byte[] getRealmKey();
void removeRealmKey();
}

AES 256 encryption is symmetric Encryption, try RSA encryption which is asymmetric. And if you are trying to encrypt sensitive user data to store in preferences or sqlite, i would suggest you try Android keystore system.
The Android Keystore system lets you store cryptographic keys in a container to make it more difficult to extract from the device. Once keys are in the keystore, they can be used for cryptographic operations with the key material remaining non-exportable.
check my sample gist to achieve this encryption and decryption here.
And better part is it works on android 18 and above.

SQLite Context.MODE_PRIVATE

I want to know:
Can we use Context.MODE_PRIVATE in SQLite while Database creating to protect from unwanted Database access.
I am not getting any example on google.
How to use this Context.MODE_PRIVATE in Database.
Please assist me. Provide any link or sample.
IN THIS LINK they are talking about file. so Database is also file.
How can i implement this?

As commonsware mentioned, SQLite databases on internal storage are private by default. But as mentioned by others rooted phone as always access to your file.
Rather you can use any encryption algorithm to save the data in DB which will help you to restrict the readability unless intruder know the encryption algorithm.
You cant set "Context.MODE_PRIVATE" flag in SQLite.

While creating database, following syntax is useful
openOrCreateDatabase(String path, int mode, SQLiteDatabase.CursorFactory factory)
For example,
openOrCreateDatabase("StudentDB",Context.MODE_PRIVATE,null);
See my tutorial on this site.

Option 1: Use SQLcipher.
Option 2: Secure Method Ever No Chance To Hack. It is not perfect, but it is better than nothing.
1) Insert data using this Function:
public static String getEncryptedString(String message) {
String cipherText = null;
try {
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(("YOUR-SECURE-PASSWORD-KEY").getBytes(), "AES"));
byte[] bytes = cipher.doFinal(message.getBytes());
cipherText = Base64.encodeToString(bytes, Base64.DEFAULT);
} catch(Exception ex) {
cipherText = "Error in encryption";
Log.e(TAG , ex.getMessage());
ex.printStackTrace();
}
return cipherText;
}
2) Get data from the database and pass into this function parameter:
//This function returns output string
public static String getDecryptedString(String encoded) {
String decryptString = null;
try {
byte[] bytes = Base64.decode(encoded, Base64.DEFAULT);
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(("YOUR-SECURE-PASSWORD-KEY").getBytes() , "AES"));
decryptString = new String(cipher.doFinal(bytes), "UTF-8");
} catch(Exception ex) {
decryptString = "Error in decryption";
ex.printStackTrace();
}
return decryptString;
}
3) Benefits of these methods:
- Not possible to decrypt without the right Key.
- AES Encryption is a very secure encryption method.
4) Store your AES key in the c++ file.