Wednesday, 22 September 2021

How to provide a way to use custom encryption in Android library?

I have a library that has default ways to encrypt stuff that it uses, which means user just need to provide a string as a key.

lib.encryption("key")
lib.doEncryptedStuff() // use default encryption

I want to allow users use custom encryption, including those that implement custom java crypto providers. My question is, what should be the correct way to ask user for such encryption methods? For now I came with idea to request two ciphers - one for encryption and one for decryption.

// create and init() ciphers here
lib.encryption(cipherEncrypt, cipherDecrypt)
lib.doEncryptedStuff() // use custom ciphers

But I'm unsure whether this is the correct way. Are Ciphers enough? Or should I provide interface for encryption for user to implement? I remember there being issues with reusing IV, which means cipher re-initialization?

Another issue that I'm facing is that it's really hard for me to generalize interface. Like AES with ECB will work with encrypt()/decrypt() methods, but with CBC it requires IV, which could also be stored inside encrypted data. What a mess.



from How to provide a way to use custom encryption in Android library?

No comments:

Post a Comment