I have been using Google Keyczar for encrypting data in my JAVA app. And I want to change the crypto solution to Google Tink.
But the problem is the already encrypted data by Keyczar. Can I decrypt them by Tink?
If yes, I want to change the crypto solution from Keyczar to Tink. If no, I have to think about another solution.
Thank you.
I did it.
Keyczar is using AES. So I use TinyAES.
Keyczar is also using HMAC. So I use HMAC of avr-crypto-lib.
Just one thing is I have to extract the key from Keyczar key.
Let's say I have some data that I obtained through a non-graphql endpoint for example from third party server (firebase).
How do I put the data into the local relay store?
Is there an easy way to add / edit / overwrite data to relay store directly without going through query or mutation?
A non public RelayStoreData field is accessible from the Relay.Store instance and it gives you direct access to the records contained in the store. I haven't done anything with this myself but you could try modifying the cache directly like this:
RelayStore._storeData._cachedStore._records[recordId][fieldName]=newValue
I would use relay without a server, defining your graphql schema locally and doing your API requests from your graphql schema the same way you would query a database in your schema.
https://github.com/relay-tools/relay-local-schema
I would like to store encrypted data in my db as well as its signature so that I could read it back at another time. How do I store the symmetric key used for encryption safely?
Store it on the file system and never version track it!
I think I found the answer to my question here: Where do you store your secret key in a Java Web Application?
Please let me know if there's a better way of doing things.
TLDR: Store it on the file system.
I have some code that I am using to encrypt and decrypt some strings in an ios application. The code involves the use of CCCrypt. Is there a reliable way to test the validity of a key used without actually storing the key anywhere? From my research it seems as though the only way to come close to telling if the key is valid is by using key lengths and key hashes. Can anyone guide me in the proper direction for this?
Getting to the answer requires a little bit of background about proper encryption. You may know this already, but most people do this wrong so I'm covering it. (If you're encrypting with a password and don't encode at least an HMAC, two salts, and an IV, you're doing it wrong.)
First, you must use an HMAC (see CCHmac()) any time you encrypt with an unauthenticated mode (such as AES-CBC). Otherwise attackers can modify your ciphertext in ways that cause it to decrypt into a different message. See modaes for an example of this attack. An HMAC is a cryptographically secure hash based on a key.
Second, if your are using password-based encryption, you must use a KDF to convert it into a key. The most common is PBKDF2. You cannot just copy password bytes into a key.
Assuming you're using a password this way, you generally generate two keys, one for encryption and one for HMAC.
OK, with those parts in place, you can verify that the password is correct because the HMAC will fail if it isn't. This is how RNCryptor does it.
There are two problems with this simple approach: you have to process the entire file before you can verify the password, and there is no way to detect file corruption vs bad password.
To fix these issues somewhat, you can add a small block of extra data that you HMAC separately. You then verify that small block rather than the whole file. This is basically how aescrypt does it. Specifically, they generate a "real" key for encrypting the entire file, and then encrypt that key with a PBKDF2-generated key and HMAC that separately. Some forms of corruption still look like bad passwords, but it's a little easier to tell them apart this way.
You can store a known value encrypted with the key in your database. validating if the key is correct is then straightforward: you encrypt the known string, and compare it to the encrypted output in the database. If you stick with a single block of data, then you don't have to worry about modes of operation and you can keep it simple.
It is also possible to store a hash of the key, but I would treat the key as a password, and take all the defensive measures you would take in storing a password in your database (e.g. use bcrypt, salt the hash, etc).
If you can't store these values, you can decrypt something where you don't know the actual contents, but perhaps know some properties of the message (e.g. ASCII text, has today's date somewhere in the string, etc) and test the decrypted message for those properties. Then if the decrypted block that doesn't have those properties (e.g. has bytes with MSB set, no instance of the date), you know the key is invalid. There is a possibility of a false positive in this case, but chances are very low.
Generally I agree with Peter Elliott. However, I have couple of additional comments:
a) If keys were randomly generated then storing hashes of the keys are safe
b) You can always attach to encrypted message (if you can control that) a hash of orginial message. In such case, you can decrypt message, get hash of decrypted message and compare it with the hash of original message. If they are eqaul then correct key was used for decryption.
I have an application that stores data locally on the iPhone.
I want to encrypt data so i am confused which method should i use.
I have used Core Data framework in application.
NSFileManager (NSFileProtectionKey), CoreData (NSFileProtectionKey), NSData (NSDataWritingOptions) are the options or is there some other method as well.
Please suggest me something
Thanks
Use the Keychain Service.
But you need to now that to encrypt the data you need a private key or a passphrase.
I would then say, encryption make only sense, when the user needs to authenticate when using your application. Then you could encrypt the data with the entered password.
Here you could AES256 encrypt data with the a PBKDF2 like function for generating a encryption key (thanks to Robert).
But providing a code sample would go to far. Read in yourself! :)
But also know: since iOS 4 the "disk" space is already encrypted with the Device PIN!