Realm is using AES-256 for encryption and decryption. And, I am trying to use Android KeyStore to generate/store the keys, but as per this page - https://developer.android.com/training/articles/keystore.html#SecurityFeatures, Android supports this only on APIs 23 and above.
Can someone please point me to an example or any other related info on how I can use realm with encryption to support APIs 4.0 and above?
Thanks.
We recently ran into the same problem and decided to simply store the key in private Shared Preferences, because if the phone is not rooted, you will not be able to get it and if it is rooted, then there are some ways to get data even from secure keyStore.
We use next Realm configuration inside Application subclass:
RealmConfiguration config = new RealmConfiguration.Builder()
.deleteRealmIfMigrationNeeded()
.name(DB_NAME)
.encryptionKey(mKeyProvider.getRealmKey())
.build();
And mKeyProvider is our helper class that is used to get the key:
public class SharedPrefsKeyProvider implements KeyProvider {
private static final String REALM_KEY = "chats.realm_key";
SharedPreferences mAppSharedPrefs;
public SharedPrefsKeyProvider(SharedPreferences aAppSharedPrefs) {
mAppSharedPrefs = aAppSharedPrefs;
}
#Override
public byte[] getRealmKey() {
byte[] key;
String savedKey = getStringFromPrefs(REALM_KEY);
if (savedKey.isEmpty()) {
key = generateKey();
String keyString = encodeToString(key);
saveStringToPrefs(keyString);
} else {
key = decodeFromString(savedKey);
}
return key;
}
#Override
public void removeRealmKey() {
mAppSharedPrefs.edit().remove(REALM_KEY).apply();
}
#NonNull
private String getStringFromPrefs(String aKey) {
return mAppSharedPrefs.getString(aKey, "");
}
private void saveStringToPrefs(String aKeyString) {
mAppSharedPrefs.edit().putString(REALM_KEY, aKeyString).apply();
}
private String encodeToString(byte[] aKey) {
Timber.d("Encoding Key: %s", Arrays.toString(aKey));
return Base64.encodeToString(aKey, Base64.DEFAULT);
}
private byte[] decodeFromString(String aSavedKey) {
byte[] decoded = Base64.decode(aSavedKey, Base64.DEFAULT);
Timber.d("Decoded Key: %s", Arrays.toString(decoded));
return decoded;
}
private byte[] generateKey() {
byte[] key = new byte[64];
new SecureRandom().nextBytes(key);
return key;
}
}
A KeyProvider is just a custom interface. An example of KeyProvider can be:
package xxx.com;
interface KeyProvider {
byte[] getRealmKey();
void removeRealmKey();
}
AES 256 encryption is symmetric Encryption, try RSA encryption which is asymmetric. And if you are trying to encrypt sensitive user data to store in preferences or sqlite, i would suggest you try Android keystore system.
The Android Keystore system lets you store cryptographic keys in a container to make it more difficult to extract from the device. Once keys are in the keystore, they can be used for cryptographic operations with the key material remaining non-exportable.
check my sample gist to achieve this encryption and decryption here.
And better part is it works on android 18 and above.
Related
Currently we are encrypting our String as:
import android.util.Base64;
import java.security.Key;
import java.util.Arrays;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
public class Cipher {
private static final String TEXT_ENCODING_TYPE = "UTF-8";
private static final String ALGO = "AES";
private static final String TYPE = ALGO + "/CBC/PKCS5Padding";
private static final String KEY = "MY_STATIC_KEY";
private static final String IV = "MY_STATIC_VECTOR";
private static final String IV_PADDING = " ";
public static String encrypt(String data) {
try {
if (!data.isEmpty()) {
javax.crypto.Cipher cipher = javax.crypto.Cipher.getInstance(TYPE);
cipher.init(javax.crypto.Cipher.ENCRYPT_MODE, getKey(), getIV());
return Base64.encodeToString(cipher.doFinal((IV_PADDING + data).getBytes()), Base64.NO_WRAP).trim();
} else {
return data;
}
} catch (Exception e) {
return data;
}
}
return new String(cipher.doFinal(data)).trim();
} else {
return encryptedData;
}
} catch (Exception e) {
LogUtils.log(e, Cipher.class);
return encryptedData;
}
}
private static Key getKey() throws Exception {
return new SecretKeySpec(KEY.getBytes(TEXT_ENCODING_TYPE), ALGO);
}
private static IvParameterSpec getIV() throws Exception {
return new IvParameterSpec(IV.getBytes(TEXT_ENCODING_TYPE));
}
private static IvParameterSpec getIV(byte[] iv) {
return new IvParameterSpec(iv);
}
}
But we have received Security alert from Google Play Console:
Your app contains unsafe cryptographic encryption patterns.
And then we were redirected to this link: Remediation for Unsafe Cryptographic Encryption.
However, this link recommends to use Jetpack Security package in which I couldn't find how to encrypt string and generate safe KEY and IV for each of our Server request.
All the examples and links I have visited points to save your sensitive data to encrypted files and SharedPreferences.
So, what should I do now? Do I have to find secure key generation mechanism that can also be decoded on Server side (Java) and save that key in Secured SharedPreferences? Jetpack Security package is still in Beta mode.
Open for more clarification.
I would take your signature:
public String encrypt(String data) and keep it that way but choose an approach:
Is the data small enough that using Secure Shared Preferences enough to store something? (not the best idea due to the issues with Shared Pref.)
Can you keep the data in a File (temporary) and then return that?
You can do either, the difference shouldn't be too big since you're likely going to have some form of class YourCryptoImplementation where you're going to perform all this...
Using Shared Preferences
You can have a couple of methods (sorry, In Kotlin because it's shorter and I've already used similar code):
private fun getEncryptedPreferences() =
EncryptedSharedPreferences.create("your_shared_preferences", advancedKeyAlias,
context, EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM)
You're going to wonder what advancedKeyAlias is. That's just a private var advancedKeyAlias: String but the actual value... will be something like:
init {
val advancedSpec = KeyGenParameterSpec.Builder("your_master_key_name",
KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT).apply {
setBlockModes(KeyProperties.BLOCK_MODE_GCM)
setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
setKeySize(256)
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
val hasStrongBox = context.packageManager.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)
if (hasStrongBox)
setIsStrongBoxBacked(true)
}
}.build()
advancedKeyAlias = MasterKeys.getOrCreate(advancedSpec)
}
So, now in your init() of this class, you ensure you have your key alias created.
You can use it to encrypt or decrypt.
Back to our SharedPref. example:
Let's say you want to store a string, you can offer:
fun encryptToSharedPref(String data) {
getEncryptedPrefs().edit().putString("the_key_you_want_to_use", data).apply()
}
And to "read" the value:
fun getValueFromSharedPreferencesWith(key: String) = getEncryptedPreferences().getString(key, null)
That would work, if the strings fit in SharedPref and if you don't care about other Shared Preferences issues...
What about FILES?
Not a huge difference, but assuming you're in the same class (that is, the advancedKeyAlias exists).
You're going to have a getEncryptedFile helper method:
private fun getEncryptedFile(file: File) = EncryptedFile.Builder(file, context, advancedKeyAlias,
EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB).build()
And you can decrypt a file like:
fun decryptFile(file: File): FileInputStream {
return getEncryptedFile(file).openFileInput()
}
Very simple, and you can obviously use it like
val rawData = yourCryptoClassAbove.decryptFile(File("path/to/file").readBytes()
val decryptedString = String(rawData)
Now to encrypt a file, you can use a FileOutputStream, that is a stream that outputs the bytes directly to a file... in our case, an encrypted file.
E.g.:
fun encryptFile(bytes: ByteArray, file: File) {
var outputStream: FileOutputStream? = null
try {
outputStream = getEncryptedFile(file).openFileOutput().apply {
write(bytes)
}
} catch (exception: IOException) {
Log.e(TAG, "output file already exists, please use a new file", exception)
} finally {
outputStream?.close()
}
}
You receive a ByteArray though, but that's not hard to obtain if you have a string...
var dataToEncrypt = ... //any "String"
yourCryptoClassAbove.encryptFile(File("path/to/file", dataToEncrypt.toByteArray())
And that's basically most of what you'd likely need. Obviously, you can have any method to generate your "advancedKey".
I don't know if this would help you, but it would certainly abstract the complexity of encrypting away from your code using it.
Disclaimer: some of these is code I've used, some is just "pseudo code" that gives you an Idea what I had in mind.
I have recently started to receive a Play Store warning like this: “Your app contains unsafe cryptographic encryption patterns” and in order try to get rid of it (and having no idea what does exactly means) I created a "complex" structure regarding encription in my app as follows:
1) This next method (located in a class different than Cryptography one just in case) stores cipher preferences in two places, the "real" values in SharedPreferences, and the "default" values in application class setter called AppSettings ("default" means the default value that is required in order to get a SharedPreference if it fails to find one).
public static void setCryptPreferences()
{
Context context = AppSettings.getContext();
AppSettings appSettings = AppSettings.getInstance();
String[] defCryptoValues = new String[]{ "AES", "AES/CBC/PKCS5Padding", "UTF-8"};
appSettings.setDefCryptValues(defCryptoValues);
AWUtils.setSharedPreference(context, "CRYPT_ALGORITHM", "AES");
AWUtils.setSharedPreference(context, "PADDING", "AES/CBC/PKCS5Padding");
AWUtils.setSharedPreference(context, "CHAR_ENCODING", "UTF-8");
}
And I set them with this function on app startup.
2) Then, whenever I need to encrypt, I use them with this next method:
public static String cipherText(String plainText)
{
AppSettings appSettings = AppSettings.getInstance();
Cryptography crypto = new Cryptography();
String[] defCryptoValues = appSettings.getDefCryptValues();
String[] cryptoParams = Cryptography.getCryptoParams(defCryptoValues);
return crypto.encrypt(plainText, cryptoParams);
}
And finally this is the real crypt method:
private String encrypt(String text, String[] cryptedParams)
{
checkKeys();
if (text == null) return null;
String retVal = null;
try {
final SecretKeySpec key = new SecretKeySpec(mCryptKey.getBytes(cryptedParams[2]), cryptedParams[0]);
final IvParameterSpec iv = new IvParameterSpec(mCryptIV.getBytes(cryptedParams[2]));
final Cipher cipher = Cipher.getInstance(cryptedParams[1]);
cipher.init(Cipher.ENCRYPT_MODE, key, iv);
final byte[] encrypted = cipher.doFinal(text.getBytes(cryptedParams[2]));
retVal = new String(encodeHex(encrypted));
} catch (Exception e) {
e.printStackTrace();
}
return retVal;
}
I don't understand very clearly the warning, and I thought I is related of having the encrypt params
"CRYPT_ALGORITHM", "AES"
"PADDING", "AES/CBC/PKCS5Padding"
"CHAR_ENCODING", "UTF-8"
as plain text in the Cryptography class and so I created all this thinking on "hiding" them and thinking it could help me to get rid of it, but it hasn't. I have recently uploaded a new version of my app and the warning still remains there and I don't know what to do.
Currently I'm using Algorithm to store data in Shared preference, It is okay for user security?. Below is the code,
private static SecretKey getSecretKey(Context context) throws NoSuchAlgorithmException {
String secretKeyString = PreferenceUtils.getSharedPreferences(context).getString(PreferenceUtils.SECRET_KEY, null);
if (secretKeyString != null) {
byte[] bytes = Base64.decode(secretKeyString, Base64.DEFAULT);
return new SecretKeySpec(bytes, AESEncryption.KEY_GENERATOR_ALGORITHM);
} else {
SecretKey secretKey = newSecretKey();
secretKeyString = Base64.encodeToString(secretKey.getEncoded(), Base64.DEFAULT);
PreferenceUtils.getSharedPreferences(context).edit().putString(PreferenceUtils.SECRET_KEY, secretKeyString).commit();
return secretKey;
}
}
No, its not safe to save sensitive data on shared preferences.Because Java code can be easily decompiled. C++ on the other hand can’t be decompiled but can be disassembled, which is slightly less trivial.So can store the static data like secret key, google api key or any other keys in c/c++ file using Android NDK. From here you can get the reference Android NDK
Question : When I try to open encrypted realm file in Realm Browser (windows) and it gives me following message.
Either this is not a Realm file or it's encrypted.
Enter: 128-character hex-encoded encryption key
Important -
I am closing my realm before saving on disk.
Code
RealmConfiguration config = new RealmConfiguration.Builder()
.name("w5uyqFyEDEK_OCWyl4123aa77")
.schemaVersion(2)
.encryptionKey(myClassObject.getRealmKey())
.deleteRealmIfMigrationNeeded()
.build();
Methods
public byte[] getRealmKey() {
byte[] key;
String savedKey = getStringFromPrefs(KEY);
if (savedKey.isEmpty()) {
key = generateKey();
String keyString = encodeToString(key);
saveStringToPrefs(keyString);
} else {
key = decodeFromString(savedKey);
}
return key;
}
private void saveStringToPrefs(String aKeyString) {
pref.edit().putString(KEY, aKeyString).apply();
}
private String encodeToString(byte[] aKey) {
AppLogger.d("Encoding Key: %s", Arrays.toString(aKey));
return Base64.encodeToString(aKey, Base64.DEFAULT);
}
private byte[] decodeFromString(String aSavedKey) {
byte[] decoded = Base64.decode(aSavedKey, Base64.DEFAULT);
AppLogger.d("Decoded Key: ", Arrays.toString(decoded));
return decoded;
}
private byte[] generateKey() {
byte[] key = new byte[64];
new SecureRandom().nextBytes(key);
return key;
}
I have tried to open encrypted realm file using key stored in preference and byte[] decodedKey but still I am not able to open realm file.
Am I missing something here?
You need to Hex encode your encryption key, not Base64 encode it.
You can see how to do it here: https://github.com/realm/realm-java/pull/5571
With Android 4.3, this code return null.
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
keyStore.load(null);
keyStore.setKeyEntry(alias, privateKey, null, certificateChain);
PrivateKeyEntry entry=(PrivateKeyEntry)keyStore.getEntry(alias, new PasswordProtection(password));
assert(entry.getPrivateKey().getEncoded()!=null);
How it's possible to get the encoded version of private key ?
Or, is it possible to transmit the private key handler to another application ?
Thank's
The Android KeyChain API prevents you from being able to get an encoded private key.
See the method at line 158 of OpenSSLRSAPrivateKey.java
#Override
public final BigInteger getPrivateExponent() {
if (key.isEngineBased()) {
throw new UnsupportedOperationException("private exponent cannot be extracted");
}
But the benefit of using the KeyChain API is that it provides system-wide credential storage. Any app should be able to retrieve the key pair and certificate by its alias. Refer to the KeyStore docs.