-
Notifications
You must be signed in to change notification settings - Fork 443
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement Encrypt and Decrypt in KeyStore [+more KeyStore support] #550
Implement Encrypt and Decrypt in KeyStore [+more KeyStore support] #550
Comments
I will contribute to this as much as I can; however, I am not an Android Engineer nor do I usually use Java, @agnostic-apollo would you be able to assist/refactor my code? As well so it fits nicely into |
Directly working on encryption seems like a great way to start learning! :D It's been a while since I looked/used keystore apis, so it will require me to research things as well. Encryption stuff needs to be handled with care and proper knowledge. It would also be good to have an external review as well from a good encryption apps dev as well, since its not my domain currently. But yes, I can try to assist. Any refactoring will have to be done after next termux-app release, since that's a priority right now. You can open a pull request and we can see. Thanks |
This comment was marked as resolved.
This comment was marked as resolved.
Apps should be built with For building in termux, check termux/termux-packages#7227 (comment). Some github release urls are inactive now. Some reference implementation I used many years ago is at |
This comment was marked as resolved.
This comment was marked as resolved.
Play button in android studio will build and install the app on your phone, then you can test however you like. Code will be similar since it would have been copied and modified a bit. |
This comment was marked as resolved.
This comment was marked as resolved.
Without more info on code content and design and how you building and running, can't comment. Any ECJ issues is not something I have time to deal with anyway. If you are using Github action builds or releases, all apps will have same key as local debug builds sourced from dev_keystore.jks. |
This comment was marked as resolved.
This comment was marked as resolved.
Click Welcome. |
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Different places like https://github.com/agnostic-apollo/FTP/blob/068f9d57247cc70609d612bd6272fcc916b5ffd4/app/src/main/java/com/allonsy/android/ftp/FTPListFragment.java#L170
Yes, you must use it. Rebase against
Yeah, do that. |
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Looks good, other than static constant. Also make sure to use space between
|
Code is available |
Any suggestions? Some of my references were @lokile, @nelenkov, @yakivmospan, and @WithSecureLabs has a Keystore Audit |
This comment was marked as resolved.
This comment was marked as resolved.
You would need to start
|
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
My responses often take days and weeks. I get requests from people everyday and have my own work as well, can't respond immediately to everyone. In
In
To receive result from
For Handle this case and any other potential ones in both apis. For reference, check https://github.com/termux/termux-tasker/blob/d52f84fa6759ba3efbf6d12c91fc1943b78d33a9/app/src/main/java/com/termux/tasker/PluginResultsService.java I haven't tested this, but should work. |
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Why do you need to wait at all? The shell command will keep on waiting if |
This comment was marked as resolved.
This comment was marked as resolved.
No need to create the cipher again, just send it in https://github.com/termux/termux-tasker#arguments-and-result-data-limits https://www.reddit.com/r/tasker/comments/prro8t/autoshare_crashed_when_i_pasted_the_file_path/
I see but there should be some extra seconds for intents overhead. There would also be issue of multiple commands requesting
Cool. I guess that will need to be handled as well as the comment or wait till screen is unlocked. |
This comment was marked as resolved.
This comment was marked as resolved.
I don't know if |
This comment was marked as resolved.
This comment was marked as resolved.
I am aware, but since android is passed the same object, there is risk of android calling it. A separate object would be safer.
That's in
Yeah, create a util class. |
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
@agnostic-apollo all done! I understand it will take some time to review but the interface is all in termux/termux-api-package#161 and thank you so much for all of your help, I learned a lot during this, it is greatly appreciated |
This comment was marked as resolved.
This comment was marked as resolved.
Calling
|
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Since the intent you are passing to Since following will not pass
Great. Will take a look when I get time to look into
You are very welcome. Good for you. :) |
if i understand correctly, this would allow setups for setting up remote decrypt-root-at-boot (e.g. through dropbear/initramfs) using fingerprint authentication without storing the key (or whatever secret) in regular termux storage. |
Feature description
Implement encrypt and decrypt in the
termux-keystore
(currently it only supports signing and verifying) via CipherThis would enable passcodes, secrets, et cetera to be stored in the Android KeyStore, an example would be for automatic decryption of an rclone config file without storing the password in a text file (e.g. encrypted by gpg) using rclone's
--password-command
, and would enable easy integration with theFingerprintAPI
/Biometric Authentication, which would resolve #246 and would also be more convenient than a passphrase or using pass (possibly more secure)Reference implementation
cipher.getIV()
which may be preferable so the IV is not stored separately. termux-keystore can also set a constant IV usingIVParameterSpec
but not preferable or derived from the alias, secret, such as what rclone doessetUserAuthenticationValidityDurationSeconds
withsetUserAuthenticationParameters
AUTH_DEVICE_CREDENTIAL
(see above)setInvalidatedByBiometricEnrollment
The text was updated successfully, but these errors were encountered: