Android encryption tool for beginners

Android encryption tool for beginners

More and more hackers are eyeing mobile apps, increasing every day because mobile apps are interested in things, such as user data. Hard-coded (Hard-coded, note, fixed write dead, cannot be modified) security key, personal information stored in plaintext in the SD card, username and password not encrypted in the database, the collected analysis (analytics) is sent to the remote server in plain text, which makes the attack easier ).

Correct use of Cryptography can protect our sensitive data and ensure privacy and data integrity. Encryption is hard to use and easy to misuse ). Note the cracking-prone encryption method (broken cryptography) (for example, using insecure algorithms or hard-coded keys to a Binary Package). Please refer to the list of 10 major risks in the mobile industry in 2014. So what lessons can be learned from this? Encryption is not required and cannot be properly encrypted (not to mention the time consumed ).

In order to develop a secure application on the Android platform, we will introduce how to encrypt the application in a simple and secure manner.

First, we will give a general introduction to some common encryption libraries that can be integrated into Android applications. An encryption library is a set of encryption tools including encryption algorithms, filling methods, and hash functions.

Bouncy Castle

The Legion of the Bouncy Castle is a nonprofit group from Australia that has compiled the widely used class library Bouncy Castle. This library provides both a lightweight cryptographic API and a Java cryptographic extension (JCE) Provider. The Android platform has built a simplified old version of Bouncy Castle (and some minor changes have been made to adapt to the Android platform ). The result is that any attempt to build and use the latest BouncyCastle class library in the application will cause a class loading conflict.

Spongy Castle

The motivation behind policgy Castle is to allow Android Developers to use any version of The BouncyCastle class library in their applications. The latest version of BouncyCastle is simply repackaged; All org. bouncycastle. * rename the package to org. spongycastle. * The names of all Java security API providers are changed from BC to SC.

OpenSSL

OpenSSL is an open-source toolkit that implements SSL and TLS protocols and a common keystore. OpenSSL has been transplanted to many platforms, including android. As an alternative, you can also build from the source code (using Android NDK) and then bind it to the application.

Now let's assume that you want to encrypt some data for the purpose of the application. Which encryption algorithm will you use, AES or DES? How long is your key, 128 or 256 bits? Which encryption mode will you use, ECB or CBC? If you have no answers or good reasons for all these questions, you may find that you are in a subtle position, although you have all the tools you want, but you are not sure which one to use or how to use it.

This is exactly the scenario where the cryptographic toolkit plays a role. These toolkit did not implement any peculiar encryption function, nor did they try to replace any of the above cryptographic libraries; instead, they were built based on these class libraries, the only purpose is to make encryption easier and safer.

Unlike General cryptographic libraries, these toolkits generally support only a portion of algorithms, patterns, structures, and parameters. The sdks provide you with reasonable default values for what you need to set for common encryption tools, in case you know what you want but do not know how to use them, or you only need to have a security solution. Let's check several of these toolkit types to better understand their operating rules.

Keyczar

Keyczar is an open-source toolkit that was initially developed by two members of the Google Security Team. It is implemented in Java, Python, and C ++. It supports symmetric encryption and heap encryption. Keyczar provides secure default settings, including algorithms, key length and mode, key loop and versioning, automatic generation of initial vectors and authorization codes, and support for internationalization. This toolkit is built based on JCE (here) and uses the security provider of javasgy Castle.

AeroGear Crypto

AeroGear Crypto is a small Java library provided by AeroGear. It supports verifiable symmetric encryption, elliptic curve encryption, and password-based key derivation. It also provides explicit algorithm settings. AeroGear Crypto depends on javasgy Castle on android and Bouncy Castle on other platforms. This library is also available on iOS, Windows Phone, and Cordova.

Conceal

Facebook developed Conceal to quickly encrypt and authenticate large files on the SD card with very little memory. Conceal supports both authentication and encryption, and also provides the key management function by default. It uses OpenSSL, but only contains the part that you need, so its size is only 85KB. The results published on the Conceal site show that it is better than Bouncy Castle.

The following table summarizes the encryption libraries described above. Note: all the databases described above allow new users in encryption to perform encryption securely. However, senior developers may not use these default practices, you can specify all the encryption details as you wish (just as they are using other cryptographic libraries ).

Encryption Library Development Company License AeroGear Crypto AeroGear Apache 2.0 Conceal Facebook BSD Keyczar-Apache 2.0 conclusion (To sum up)

If you are a mobile app developer, you have to spend time (energy) to make your apps easy to use, feature-rich, and eye-catching. However, do not forget to improve the security of your application. If you don't know how to start or worry about wrong operations, select one from the Toolkit mentioned in the article to start. No matter which encryption tool you choose, you should avoid implementing your own encryption algorithms and encryption protocols. You should only use widely-used, universally accepted, and tested algorithms and protocols.