Titanium JIRA Archive
Appcelerator Modules (MOD)

[MOD-2591] Android: Add properties "hmacAlgorithm" and "hmacKdfIterations" to encrypted DB module

GitHub Issuen/a
TypeImprovement
PriorityHigh
StatusClosed
ResolutionFixed
Resolution Date2020-04-15T01:35:05.000+0000
Affected Version/sn/a
Fix Version/sn/a
ComponentsEncrypted SQLite DB
Labelsandroid, database, encrypted_database, encryption, hash, module, performance
ReporterJoshua Quick
AssigneeJoshua Quick
Created2020-04-04T03:39:21.000+0000
Updated2020-04-22T17:36:47.000+0000

Description

*Summary:* The "appcelerator.encrypteddatabase" module's default settings for its hashing algorithm has changed recently from SHA1 to SHA512, with KDF iterations from 64000 to 256000. While this has made it much more secure, it comes at the cost of performance. On Android, the defaults changed in module v3.0.3. On iOS, the defaults changed in module v2.0.6. We should add new properties that allowing app developers to control these settings. (ie: Sacrifice security for speed or sacrifice speed for security.) *Requirements:* Add the following constants to the module. These must be integer IDs. * HMAC_SHA1 * HMAC_SHA256 * HMAC_SHA512 Add the following properties to the module. * hmacAlgorithm - to be assigned one of the above constants. Defaults to HMAC_SHA512. * hmacKdfIterations - to be assigned an integer. Defaults to 256000. Min value is 4000. The above properties are "stateful" like the password property. Meaning that they affect the next time you call the open() method. When opening an existing database with different hmac settings above, then the module must auto-migrate it to use the module's current hmac settings. *Usage Test:*
var database = require("appcelerator.encrypteddatabase");
database.password = "password";

//database.hmacAlgorithm = database.HMAC_SHA1;
database.hmacAlgorithm = database.HMAC_SHA256;
//database.hmacAlgorithm = database.HMAC_SHA512;

database.hmacKdfIterations = 64000;
//database.hmacKdfIterations = 128000;
//database.hmacKdfIterations = 256000;

var openStartTime = new Date();
var dbConnection = database.open("test_encrypted.db");
Ti.API.info("@@@ DB open duration: " + (new Date() - openStartTime) + " ms");

dbConnection.execute("CREATE TABLE IF NOT EXISTS test(id integer PRIMARY KEY, name TEXT);");
dbConnection.execute("INSERT OR REPLACE INTO test(id, name) VALUES (?, ?)", 1, "Hello World");
dbConnection.close();

Attachments

FileDateSize
DatabaseEncryptMigrationTest.js2020-04-06T19:24:02.000+00002388
DatabaseEncryptMigrationTest.png2020-04-06T19:37:33.000+0000157626

Comments

  1. Joshua Quick 2020-04-04

    PR (android): https://github.com/appcelerator-modules/appcelerator.encrypteddatabase/pull/48
  2. Joshua Quick 2020-04-06

    The attached [^DatabaseEncryptMigrationTest.js] script can help test this change. !DatabaseEncryptMigrationTest.png|thumbnail!
  3. Lokesh Choudhary 2020-04-15

    PR Merged.
  4. Joshua Quick 2020-04-20

    Here is a back-port which will work with Titanium 7.0.0+. (Not built with gradle.) PR (android)(3_3_X): https://github.com/appcelerator-modules/appcelerator.encrypteddatabase/pull/50
  5. Joshua Quick 2020-04-21

    This updates the documented properties to the back-ported version. PR: https://github.com/appcelerator-modules/appcelerator.encrypteddatabase/pull/51
  6. Lokesh Choudhary 2020-04-22

    Verified the improvements in 4.1.0 & backported 3.3.0 module . Closing.

JSON Source