Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Fix][Android] Unsupported RSA key size for StrongBox #577

Merged
merged 1 commit into from
Feb 15, 2024
Merged

[Fix][Android] Unsupported RSA key size for StrongBox #577

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion android/src/main/java/com/oblador/keychain/cipherStorage/CipherStorageKeystoreRsaEcb.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ public class CipherStorageKeystoreRsaEcb extends CipherStorageBase {
public static final String TRANSFORMATION_RSA_ECB_PKCS1 =
ALGORITHM_RSA + "/" + BLOCK_MODE_ECB + "/" + PADDING_PKCS1;
/** Selected encryption key size. */
public static final int ENCRYPTION_KEY_SIZE = 3072;
public static final int ENCRYPTION_KEY_SIZE = 2048;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is indeed correct! I can confirm. What about the other scenarions with normal (non-strongbox) key generation? It will also change to 2048.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The strength of RSA encryption is based on the difficulty of factoring large numbers that are the product of two large prime numbers. A 2048-bit RSA key is believed to be secure against foreseeable cryptographic attacks, including brute force attacks, with the computational power available today and in the near future. The National Institute of Standards and Technology (NIST) and other cryptographic authorities have provided guidelines indicating that 2048-bit RSA keys are expected to be secure until at least 2030.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although StrongBox is a little slower and resource constrained (meaning that it supports fewer concurrent operations) compared to TEE, StrongBox provides better security guarantees against physical and side-channel attacks. If you want to prioritize higher security guarantees over app resource efficiency, we recommend using StrongBox on the devices where it is available. Wherever StrongBox isn't available, your app can always fall back to TEE to store key materials.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's go for 2048 key size and fix the strongbox issue

public static final int ENCRYPTION_KEY_SIZE_WHEN_TESTING = 512;

//endregion
Expand Down
Loading