[Fix][Android] Unsupported RSA key size for StrongBox #577
Conversation
androideveloper
force-pushed
the
frw/strongbox-key-size
branch
from
0e2d71c
to
ea6e3f7
Compare
| @@ -50,7 +50,7 @@ public class CipherStorageKeystoreRsaEcb extends CipherStorageBase { | |||
| public static final String TRANSFORMATION_RSA_ECB_PKCS1 = | |||
| ALGORITHM_RSA + "/" + BLOCK_MODE_ECB + "/" + PADDING_PKCS1; | |||
| /** Selected encryption key size. */ | |||
| public static final int ENCRYPTION_KEY_SIZE = 3072; | |||
| public static final int ENCRYPTION_KEY_SIZE = 2048; | |||
There was a problem hiding this comment.
This is indeed correct! I can confirm. What about the other scenarions with normal (non-strongbox) key generation? It will also change to 2048.
There was a problem hiding this comment.
The strength of RSA encryption is based on the difficulty of factoring large numbers that are the product of two large prime numbers. A 2048-bit RSA key is believed to be secure against foreseeable cryptographic attacks, including brute force attacks, with the computational power available today and in the near future. The National Institute of Standards and Technology (NIST) and other cryptographic authorities have provided guidelines indicating that 2048-bit RSA keys are expected to be secure until at least 2030.
There was a problem hiding this comment.
Although StrongBox is a little slower and resource constrained (meaning that it supports fewer concurrent operations) compared to TEE, StrongBox provides better security guarantees against physical and side-channel attacks. If you want to prioritize higher security guarantees over app resource efficiency, we recommend using StrongBox on the devices where it is available. Wherever StrongBox isn't available, your app can always fall back to TEE to store key materials.
There was a problem hiding this comment.
let's go for 2048 key size and fix the strongbox issue
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [react-native-keychain](https://togithub.com/oblador/react-native-keychain) | [`^8.1.2` -> `^8.1.3`](https://renovatebot.com/diffs/npm/react-native-keychain/8.1.2/8.1.3) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>oblador/react-native-keychain (react-native-keychain)</summary> ### [`v8.1.3`](https://togithub.com/oblador/react-native-keychain/releases/tag/v8.1.3) [Compare Source](https://togithub.com/oblador/react-native-keychain/compare/v8.1.2...v8.1.3) #### What's Changed - use setUserAuthenticationParameters for android >= 11 by [@​AntoineThibi](https://togithub.com/AntoineThibi) in [oblador/react-native-keychain#613 - \[Fix]\[Android] Bugfix for lambda functions not workin in older projects. by [@​sohail-shrestha](https://togithub.com/sohail-shrestha) in [oblador/react-native-keychain#585 - \[Fix]\[Android] Unsupported RSA key size for StrongBox by [@​frw](https://togithub.com/frw) in [oblador/react-native-keychain#577 #### New Contributors - [@​AntoineThibi](https://togithub.com/AntoineThibi) made their first contribution in [oblador/react-native-keychain#613 - [@​sohail-shrestha](https://togithub.com/sohail-shrestha) made their first contribution in [oblador/react-native-keychain#585 - [@​frw](https://togithub.com/frw) made their first contribution in [oblador/react-native-keychain#577 **Full Changelog**: oblador/react-native-keychain@v8.1.2...v8.1.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 5pm,every weekend" in timezone America/Los_Angeles, Automerge - "after 5pm,every weekend" in timezone America/Los_Angeles. 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/valora-inc/wallet). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yMDAuMCIsInVwZGF0ZWRJblZlciI6IjM3LjIwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: valora-bot <valorabot@valoraapp.com>
](https://renovatebot.com){kind=link}
Upon app startup, I'm noticing this error showing up
It seems like RSA 3072 is not supported for StrongBox but 2048 is (reference: https://developer.android.com/training/articles/keystore). Changing it to 2048 makes the error disappear.