API access tokens are the key to unlocking the power of various services for your mobile and web applications. But with this power comes the need for security to prevent unauthorized access to sensitive information.
In this article, we will dive into the technique of securing your app's data using Encrypted Shared Preferences of the Jetpack security library.
By the end of this article, you will have a solid understanding of how to safeguard your data in your Android applications and keep your user's data protected using encrypted shared preferences.
Encrypted SharedPreferences
Encrypted shared preference Wraps the SharedPreferences class and automatically encrypts keys and values using a two-scheme method: Keys are encrypted using a deterministic encryption algorithm such that the key can be encrypted and properly looked up. Values are encrypted using AES-256 GCM and are non-deterministic
Include the library in your project
To use the Security library, add the following dependencies, as appropriate, to your app module's build.gradle file:
dependencies {
implementation "androidx.security:security-crypto:1.0.0-alpha02"
}
Show me the code!
To demonstrate encrypted shared preferences, we'll create a helper class with two functions saveData and getData which as the name suggests, will be used to save and get data in a secure way.
Saving Data
private val masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC)
fun saveData(context: Context, key: String, data: String) {
val sharedPreferences = EncryptedSharedPreferences.create(
FILE_NAME,
masterKeyAlias,
context,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)
sharedPreferences.edit().putString(key, data).apply()
}
In the snippet above, We start by initializing the android Keystore class which gives us access to a master key alias we'll be using to initialize an instance of the EncryptedSharedPreferences object.
On initializing the EncryptedSharedPreferences, we can then save our data as we normally would using the sharedPreferences edit() and apply() method
Retrieving Data
fun getData(context: Context, key: String): String? {
val sharedPreferences = EncryptedSharedPreferences.create(
FILE_NAME,
masterKeyAlias,
context,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)
return sharedPreferences.getString(key, "")
}
Again, we initialize an instance of the EncryptedSharedPreferences object using the master key alias we created earlier and passing in the name of the key value we want to retrieve.
We can use the functions from our mainActivity.kt file or anywhere in our application like this:
And our complete sharedPreferencesHelper.kt file should look like this:
After running the code we should see:
The username is Astrocoder and the access token is MY_ACCESS_TOKEN printed in the logcat.
You can also check the emulator's data storage to see the encrypted My_file_name.xml file and its content, just like in the image below
Conclusion
The Jetpack team has made it really easy to securely store and retrieve sensitive data in our apps with EncryptedSharedPreferences; Here are some of the advantages of using it:
It uses Android keystore to automatically remove the pain of having to achieve the same thing using other methods of encryption
Every data we feed it is encrypted, including the key names used to access the shared preference values, as we can see in the image above, making it a lot harder for any attacker to know what data to attack
That's a wrap!!! feel free to reach out to me on any of my social media accounts should you have any questions.
You can find the complete code to this example on GitHub, here
Thank you for reading! Cheers!!!
