[Android] [Beta] Version 10 - Full migration to custom implementation of SecureSharedPreferences

[juliansteenbakker]

A long outstanding problem with the Android part of this package is the deprecated usage of older cryptography usage (CBC with PKCS5/PKCS7 padding) for SDK < 23, and the already deprecated JetSec Crypto library that is being used for the current implementation of SecureSharedPreferences.

To fix these issues, i am moving to a custom implementation of the JetSec Crypto library, and removing all other deprecated methods of encrypting the shared preferences. This requires the minimum SDK to be raised from 21 to 23.

I am currently testing the new implementation in the branch version-10. Any help is greatly appreciated.

Affected issues:

512 #522 #562 #584 #627 #672 #694 #713 #729 #758 #759

[paulking86]

Hi @juliansteenbakker - Thanks for your work on this! 👏

Have just tested the version-10 branch using the override for flutter_secure_storage_web: ^2.0.0-beta.1.

When running the app on a device which has written to secure storage prior to this upgrade, my app crashes on startup (when I first call readAll()). Here is the traceback:

PlatformException(Exception encountered, readAll, java.lang.SecurityException: Could not decrypt key. decryption failed
    at com.it_nomads.fluttersecurestorage.crypto.EncryptedSharedPreferences.decryptKey(EncryptedSharedPreferences.java:566)
    at com.it_nomads.fluttersecurestorage.crypto.EncryptedSharedPreferences.getAll(EncryptedSharedPreferences.java:377)
    at com.it_nomads.fluttersecurestorage.FlutterSecureStorage.readAll(FlutterSecureStorage.java:54)
    at com.it_nomads.fluttersecurestorage.FlutterSecureStoragePlugin$MethodRunner.run(FlutterSecureStoragePlugin.java:156)
    at android.os.Handler.handleCallback(Handler.java:959)
    at android.os.Handler.dispatchMessage(Handler.java:100)
    at android.os.Looper.loopOnce(Looper.java:232)
    at android.os.Looper.loop(Looper.java:317)
    at android.os.HandlerThread.run(HandlerThread.java:85)
Caused by: java.security.GeneralSecurityException: decryption failed
    at com.google.crypto.tink.daead.DeterministicAeadWrapper$WrappedDeterministicAead.decryptDeterministically(DeterministicAeadWrapper.java:122)
    at com.it_nomads.fluttersecurestorage.crypto.EncryptedSharedPreferences.decryptKey(EncryptedSharedPreferences.java:557)
    ... 8 more

If I uninstall the previous version of my app (using 9.2.2) and perform a clean install (using version-10), then the app appears to work as expected.

This is using a physical Google Pixel 7 pro on Android 15, Flutter 3.22.3. Have yet to try on iOS but will do that later. If there is any other information you need or anything you want me to try, do let me know! :+1:

[paulking86]

Can confirm that this issue does not occur on iOS. This is also a physical device (iPhone 12), iOS 16, Flutter 3.22.3. version-10 appears to be behaving and I have yet to observe any keychain related errors. 💪

[juliansteenbakker]

This is using a physical Google Pixel 7 pro on Android 15, Flutter 3.22.3. Have yet to try on iOS but will do that later. If there is any other information you need or anything you want me to try, do let me know! 👍

Did you set the encryptedSharedPreferences to true, or didnt you use it at all?

[paulking86]

Instantiated with defaults!

final storage = new FlutterSecureStorage();

Will try with encrypted preferences on now :+1:

[paulking86]

Can confirm that I get the same behaviour when initialising like this:

final storage = new FlutterSecureStorage(aOptions: AndroidOptions(encryptedSharedPreferences: true));

This is when opening the app after upgrading from the version that uses 9.2.2 and no encrypted preferences.

As before, the app seems to be behave as expected in encrypted preferences mode with a fresh install!

I am going to turn encrypted prefs on in 9.2.2, and then see what happens when upgrading to version 10 with encrypted prefs on.

[juliansteenbakker]

Thanks for checking! I think we need a migration helper for this use case. I will let you know when i have some work done.

[paulking86]

No problem @juliansteenbakker - I can confirm that upgrading from 9.2.2 with encrypted prefs to 10 also using encrypted prefs appears to work as expected 🙌

[sed1ka]

Hi @juliansteenbakker thanks for your work!

When will version 10 be released? Suppose it can't be estimated. Can it be published in pre-release?

[Gonzalo-Bruna]

I wish we could have some news about this, I still can't fix the issue on many devices, and I might have to use another library for now. Any updates on the progress?