Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encrypt Realm database #46

Closed
niqdev opened this issue Apr 19, 2016 · 3 comments
Closed

Encrypt Realm database #46

niqdev opened this issue Apr 19, 2016 · 3 comments

Comments

@niqdev
Copy link
Member

niqdev commented Apr 19, 2016

Implement a migration strategy to encrypt Realm database (version 0.87.5) and decide where and how to store the secure Key.

KeyStore is available only for API > 18 and currently minSdkVersion is 16, moreover KeyGenParameterSpec is available only on API > 23.

Below few useful links

http://stackoverflow.com/questions/34174113/updating-changing-realm-encryption-key
https://github.com/android/platform_development/tree/master/samples/Vault
http://android-developers.blogspot.it/2013/02/using-cryptography-to-store-credentials.html
https://medium.com/@vashisthg/android-secure-shared-preferences-10f8356a4c2b#.dw176v2cl

Example
https://github.com/googlesamples/android-BasicAndroidKeyStore

@niqdev
Copy link
Member Author

niqdev commented Apr 24, 2016

@niqdev
Copy link
Member Author

niqdev commented Apr 28, 2016

Unfortunately also other libraries like ophio/secure-preferences and Qlassified-Android are affected by this well known issue.
So also if for an attacker who has physical access to the device would be harder (not impossible) to retrieve the keystore, the app would crash and the user will lose all its configuration just changing for example screen lock from pattern to PIN.
For this reason I will use scottyab/secure-preferences to store the database encryption key.

@niqdev
Copy link
Member Author

niqdev commented Apr 28, 2016

App v2.2.0 has encrypted database

@niqdev niqdev closed this as completed Apr 28, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant