How to encrypt and decrypt file in Android?

by

Use a CipherOutputStream or CipherInputStream with a Cipher and your FileInputStream / FileOutputStream.

I would suggest something like Cipher.getInstance("AES/CBC/PKCS5Padding") for creating the Cipher class. CBC mode is secure and does not have the vulnerabilities of ECB mode for non-random plaintexts. It should be present in any generic cryptographic library, ensuring high compatibility.

Don’t forget to use a Initialization Vector (IV) generated by a secure random generator if you want to encrypt multiple files with the same key. You can prefix the plain IV at the start of the ciphertext. It is always exactly one block (16 bytes) in size.

If you want to use a password, please make sure you do use a good key derivation mechanism (look up password based encryption or password based key derivation). PBKDF2 is the most commonly used Password Based Key Derivation scheme and it is present in most Java runtimes, including Android. Note that SHA-1 is a bit outdated hash function, but it should be fine in PBKDF2, and does currently present the most compatible option.

Always specify the character encoding when encoding/decoding strings, or you’ll be in trouble when the platform encoding differs from the previous one. In other words, don’t use String.getBytes() but use String.getBytes(StandardCharsets.UTF_8).

To make it more secure, please add cryptographic integrity and authenticity by adding a secure checksum (MAC or HMAC) over the ciphertext and IV, preferably using a different key. Without an authentication tag the ciphertext may be changed in such a way that the change cannot be detected.

Be warned that CipherInputStream may not report BadPaddingException, this includes BadPaddingException generated for authenticated ciphers such as GCM. This would make the streams incompatible and insecure for these kind of authenticated ciphers.

More Related Contents:

  1. How to Secure Android Shared Preferences?
  2. How to avoid reverse engineering of an APK file
  3. How do I prevent Android taking a screenshot when my app goes to the background?
  4. How to prevent Screen Capture in Android
  5. Android database encryption
  6. How permission can be checked at runtime without throwing SecurityException?
  7. How to encrypt file from SD card using AES in Android?
  8. Method not found using DigestUtils in Android
  9. Android SharedPreference security
  10. Restrict API requests to only my own mobile app
  11. How to securely store credentials (password) in Android application?
  12. Encryption error on Android 4.2
  13. android: Determine security type of wifi networks in range (without connecting to them)
  14. How to securely store access token and secret in Android?
  15. Get all messages from Whatsapp
  16. Best way to secure Android app sensitive Data?
  17. Easy way to Encrypt/Decrypt string in Android
  18. sqlite encryption for android
  19. How to keep the OAuth consumer secret safe, and how to react when it’s compromised?
  20. Is google-services.json safe from hackers?
  21. How to secure my app against piracy
  22. How to enable AutoStart option for my App in Xiaomi phone Security App programmatically in android
  23. How to prevent NFC tag cloning?
  24. How to add Bouncy Castle algorithm to Android?
  25. Google Play security alert for insecure TrustManager
  26. Android KeyStoreException Unknown Error
  27. How to use an API from my mobile app without someone stealing the token
  28. How to manage installation from Unknown Sources in Android Oreo?
  29. Different resolution support android
  30. Android YouTube app Play Video Intent

Leave a Comment