Build with AGP 8.0 leads to crashes in runtime

Encrypted DataStore

Extensions to store DataStore in EncryptedFile.

Warning

This tiny library will be maintained until an official solution for DataStore encryption will be released by Google. Vote for this feature on issue tracker: b/167697691

Installation

Add the dependency:

repositories {
    mavenCentral()
    google()
}

dependencies {
    implementation("io.github.osipxd:security-crypto-datastore:1.0.0")
    // Or, if you want to use Preferences DataStore:
    implementation("io.github.osipxd:security-crypto-datastore-preferences:1.0.0")
}

Dependencies:

security-crypto 1.0.0

datastore 1.0.0

tink 1.13.0

Usage

To create encrypted DataStore, just use method encryptedDataStore instead of dataStore to create delegate:

// At the top level of your Kotlin file:
val Context.settingsDataStore: DataStore<Settings> by encryptedDataStore(
    fileName = "settings.pb",
    serializer = SettingsSerializer
)

Or, if you want full control over EncryptedFile creation

val settingsDataStore: DataStore<Settings> = DataStoreFactory.createEncrypted(SettingsSerializer) {
    EncryptedFile.Builder(
        context.dataStoreFile("settings.pb"),
        context,
        MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC),
        EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB
    ).build()
}

Similarly, you can create Preferences DataStore:

// At the top level of your Kotlin file:
val Context.dataStore by encryptedPreferencesDataStore(name = "settings")

Or, if you want full control over EncryptedFile creation

val dataStore: DataStore<Preferences> = PreferenceDataStoreFactory.createEncrypted {
    EncryptedFile.Builder(
        context.preferencesDataStoreFile("settings"),
        context,
        MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC),
        EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB
    ).build()
}

Then you can use the created encrypted DataStore just like simple DataDtore. Look at the DataStore docs for usage guide and examples.

Migration

Migrate from factory to delegate

If you have the following code:

val dataStore = DataStoreFactory.createEncrypted(serializer) {
    EncryptedFile.Builder(
        context.dataStoreFile("filename"),
        context,
        MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC),
        EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB
    ).build()
}

You can simplify it using delegate for DataStore creation.

// 1. Move the field to top level of you Kotlin file and turn it to an extension on Context
// 2. Replace `DataStoreFactory.createEncrypted` with `encryptedDataStore`
val Context.dataStore by encryptedDataStore(
    fileName = "filename", // Keep file the same
    serializer = serializer,
)

Note

This only will be interchangeable if you used context.dataStoreFile(...) to create datastore file. In case you have custom logic for master key creation, pass the created master key as a parameter masterKey to the delegate.

Migrate from `encrypted-datastore` to `security-crypto-datastore`

Change the dependency in build script:

 dependencies {
-    implementation("io.github.osipxd:encrypted-datastore:...")
+    implementation("io.github.osipxd:security-crypto-datastore:...")
 }

New library uses StreamingAead instead of Aead under the hood, so to not lose the previously encrypted data you should specify fallbackAead:

// This AEAD was used to encrypt DataStore previously, we will use it as fallback
val aead = AndroidKeysetManager.Builder()
    .withSharedPref(context, "master_keyset", "master_key_preference")
    .withKeyTemplate(KeyTemplates.get("AES256_GCM"))
    .withMasterKeyUri("android-keystore://master_key")
    .build()
    .keysetHandle
    .getPrimitive(Aead::class.java)

The old code to create DataStore was looking like this:

val dataStore = DataStoreFactory.create(serializer.encrypted(aead)) {
    context.dataStoreFile("filename")
}

The new code will look like this:

// At the top level of your Kotlin file:
val Context.dataStore by encryptedDataStore(
    fileName = "filename", // Keep file the same
    serializer = serializer,
    encryptionOptions = {
        // Specify fallback Aead to make it possible to decrypt data encrypted with it
        fallbackAead = aead
    }
)

Or, if you want full control over EncryptedFile creation

val dataStore = DataStoreFactory.createEncrypted(
    serializer = serializer,
    encryptionOptions = { fallbackAead = aead }
) {
    EncryptedFile.Builder(
        context.dataStoreFile("filename"), // Keep file the same
        context,
        MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC),
        EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB
    ).build()
}

Thanks

Artem Kulakov (Fi5t), for his example of DataStore encryption.
Gods of Kotlin, for posibility to hack internal visibility modifier

License

MIT

	internal fun Aead.newDecryptedStream(inputStream: InputStream): InputStream {
	return if (inputStream.available() > 0) {
	decrypt(inputStream.readBytes(), null).inputStream()
	} else {
	inputStream
	}
	}

	override fun read(b: ByteArray, offset: Int, length: Int): Int {
	return try {
	stream.read(b, offset, length)
	} catch (e: IOException) {
	if (!e.isProbablyEncryptedWithAeadException()) throw e
	stream = fallbackStream()
	// Try to read again from the new delegate
	stream.read(b, offset, length)
	}
	}

osipxd / encrypted-datastore Goto Github PK

encrypted-datastore's Introduction

Encrypted DataStore

Installation

Usage

Migration

Migrate from factory to delegate

Migrate from encrypted-datastore to security-crypto-datastore

Thanks

License

encrypted-datastore's People

Contributors

Stargazers

Watchers

Forkers

encrypted-datastore's Issues

Stacktrace

Workarounds

Recommend Projects

Recommend Topics

Recommend Org

Migrate from `encrypted-datastore` to `security-crypto-datastore`