feat: using encrypted shared preferences

[jimcase]

The key changes include enhanced handling of encrypted shared preferences and migration from older storage implementations.

Key Changes

1. Initialization Logic Enhancement:

   • Updated the initialization flow for better compatibility across Android versions.

2. Migration Support:

   • Implemented migration of existing data from non-encrypted preferences to encrypted shared preferences for Android M+ (API 23+).
   • Ensured backward compatibility for pre-M devices using legacy shared preferences.

3. Encryption and Decryption Updates:

   • For Android M+, switched to EncryptedSharedPreferences for modern and secure storage practices.

[axi92]

Thank you for your PR!
It's nice to see that others use this fork as well and want to contribute too =)

[axi92]

Thank you for resolving the things that I mentioned 👍
@0x7061 will probably have time to look into that in January.

[0x7061]

After code review we realized the used Jetpack security crypto library seems to be deprecated.
https://developer.android.com/privacy-and-security/cryptography#jetpack_security_crypto_library

Any idea if the used EncryptedSharedPreferences can be attained through a different library?

[jimcase]

@axi92 @0x7061 I've reviewed the official Android documentation, and it appears that EncryptedSharedPreferences is not listed as deprecated. This component remains a recommended solution for secure storage practices on Android M+ (API 23+) devices. Thus, we can continue to use EncryptedSharedPreferences for our encryption needs as it provides a robust and updated framework for handling secure preference storage across supported Android versions.

I upgraded the lib to use the latest version androidx.security:security-crypto:1.1.0-alpha06 - April 19, 2023

https://developer.android.com/jetpack/androidx/releases/security

[jimcase]

Hey @0x7061,

There unique deprecated method is EncryptedSharedPreferences.create. The docs suggest to the following:

* @deprecated Use {@link #create(Context, String, MasterKey,
* PrefKeyEncryptionScheme, PrefValueEncryptionScheme)} instead.

This means changing:

String masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC);
Log.d(LOG_TAG, "Master key alias obtained or created: " + masterKeyAlias);

preferences = EncryptedSharedPreferences.create(
    PREFERENCES_FILE,
    masterKeyAlias,
    context,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
);

To:

MasterKey masterKey = new MasterKey.Builder(context)
    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
    .build();
Log.d(LOG_TAG, "Master key alias obtained or created: ");

preferences = EncryptedSharedPreferences.create(
    context,
    PREFERENCES_FILE,
    masterKey,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
);
 

I updated the call to use the suggested EncryptedSharedPreferences.create and now i can remove the flag @SuppressWarnings("deprecation")