CODEWITHSUNDEEP
androidsqliteencryptionandroid-5.0-lollipopsqlite-cipher
Reaper
Reaper

Reputation: 516

Using Android SQLCipher securely in Lollipop without deriving passwords from user's input

I've implemented SQLCipher for Android.

SQLCipher takes as the AES encryption key an string or a byte array, and it's up to the developer to provide it securely.

To do so, I have used the Android KeyStore to generate a non-extractable AES key, using strongbox if supported. I use this AES key to encrypt the real, randomly generated password that I use to open the database in a separate file. More or less like this:

KeyGenerator.getInstance("AES", "AndroidKeyStore");
KeyGenParameterSpec.Builder builder = new KeyGenParameterSpec.Builder(sKeyAlias, KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
                    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                    .setRandomizedEncryptionRequired(true);
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
    PackageManager pm = context.getPackageManager();
    if (pm.hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE)) {
        builder.setIsStrongBoxBacked(true);
    }
}

Problem is, those APIs are not available on Android 5 Lollipop, and that's the minimum OS version I need to support. For now, I have a hardcoded password for those versions, but this is less than ideal for obvious reasons.

I can't derive the password from any user input, there is no login on this app. Is there a better way to do this in Lollipop?

Upvotes: 0

Views: 33

Answers (0)

Related Questions