Migrate data after changing encryption AES-CBC → AES-GCM

oblador / react-native-keychain

:key: Keychain Access for React Native

MIT License

3.21k stars 519 forks source link

Migrate data after changing encryption AES-CBC → AES-GCM #687

Open Aure77 opened 1 week ago

Aure77 commented 1 week ago

Did you recommend something to migrate user data previously encrypted using AES-CBC in keychain/keystore (now deprecated and considered as a vulnerability by my security team) to AES-GCM ? That would be nice if this library explained how to manage the algorithm transition without data loss.

DorianMazur commented 6 days ago

Hey @Aure77 The storage type is only needed for setGenericPassword, while getGenericPassword uses the cipher that was originally used to store the credentials, ensuring backward compatibility. You can implement your own migration logic: use getGenericPassword and if the cipher storage is AES_CBC, resave it with AES_GCM_NO_AUTH.

Would you prefer having an automatic upgrade logic built into the library?