Simple API to perform AES encryption on Android. This is the Android counterpart to the AESCrypt library Ruby and Obj-C (with the same weak security defaults :( ) created by Gurpartap Singh. https://github.com/Gurpartap/aescrypt

Last update: Dec 18, 2022

Overview

AESCrypt-Android

Simple API to perform AES encryption on Android with no dependancies. This is the Android counterpart to the AESCrypt library Ruby and AESCrypt-ObjC created by Gurpartap Singh. It used the same weak :'( security defaults i.e Blank IV noted below.

For compatiblity with AESCrypt, AESCrypt-Android has the same defaults namely:

256-bit AES key
CBC mode
PKCS7Padding
Blank/Empty IV (default)*

*Using CBC with the default blank IV is vulnerable. This has been left in for compatibility with AESCrypt implementations. See Adv method for providing your own IV. If you don't need to be compatable with AESCrypt then look at java-aes-crypto it's API is just as simple and generates more secure keys.

Dependency

Download from Maven Central (.aar)

dependencies {
  compile 'com.scottyab:aescrypt:0.0.1'
}

Usage

Encrypt

String password = "password";
String message = "hello world";	
try {
    String encryptedMsg = AESCrypt.encrypt(password, message);
}catch (GeneralSecurityException e){
    //handle error
}

Decrypt

String password = "password";
String encryptedMsg = "2B22cS3UC5s35WBihLBo8w==";
try {
    String messageAfterDecrypt = AESCrypt.decrypt(password, encryptedMsg);
}catch (GeneralSecurityException e){
     //handle error - could be due to incorrect password or tampered encryptedMsg
}

Recommended Advanced usage

Please if you are going to use this library provide your own key, and use a different IV per message that you encrypt..

AESCrypt.encrypt(final SecretKeySpec key, final byte[] iv, final byte[] message)

AESCrypt.decrypt(final SecretKeySpec key, final byte[] iv, final byte[] decodedCipherText)

Note: for flexibility these 'adv' methods don't provide BASE64 encoding/decoding.

Debugging/Logging

To enable logging simple change switch on the logging flag as shown below.

AESCrypt.DEBUG_LOG_ENABLED = true;

Remember to disable in Live, recommend the below snippet if possible

if (BuildConfig.DEBUG) {
    AESCrypt.DEBUG_LOG_ENABLED = true;
}

To be honest it's a strech to call this a library given it's only a single util class, but I created as went through a ton of pain working out the conpatible settings for AESCrypt. I hope this will save some one time in the future.

Contributing

I welcome pull requests, issues and feedback.

Fork it
Create your feature branch (git checkout -b my-new-feature)
Commit your changes (git commit -am 'Added some feature')
Push to the branch (git push origin my-new-feature)
Create new Pull Request

Licence

Copyright (c) 2014 Scott Alexander-Bown

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Comments

How to use aes256 mode?

I use AESCrypt.encrypt("123456","123456") and I got "LK09ZUQfjEWnBhyah8VNXg==" but the result should be "U2FsdGVkX1/bIqQCoW3eTfBoynP0mswP1PE6HM97jTk=" . What's the problem?

opened by Ghostish 2
Use less Library Delete this Shit

After apk decompiler it clearly show all my string (jsoneditoronline.org) ex: this.encryptedMsg = AESCrypt.encrypt("url", "myurl");

Then why this useless library.. don't wast developer time .. just delete thus shit library

dont call this shit encrypt and decrypt

opened by Naguchennai 1
Python Counterpart

I have written the completely compatible python counterpart of AESCrypt (https://github.com/ninjatrench/PyAESCrypt)

Maybe it would be helpful for cross platform implementation and you can add it to readme file

Thanks

opened by ninjatrench 1
Crashing if invalid BASE64 String Given

java.lang.IllegalArgumentException: bad base-64

in this line :
byte[] decodedCipherText = Base64.decode(base64EncodedCipherText, Base64.NO_WRAP);

This occurs when base64EncodedCipherText is not a proper BASE64 value . Write something to check for a proper BASE64 and then pass it to the function.

opened by dynamitechetan 1
key derivation: use PBKDF2, not SHA-256

the long explanation is here: link to StackExchange

TL;DR SHA-256 was not meant as key derivation function and has some bad properties (e.g. it is too fast).

opened by japdlsd 1
Plain Text Error

Hello, Am using the library for a messaging app am working on. Before using the library messages are sent in plain text so after adding the library the decrypt message crashes the app for those old messages. Since the wrapped in the try catch block was expecting to catch the error for plain text. Need help please. :(

stack trace below

Fatal Exception: java.lang.IllegalArgumentException Fatal Exception: java.lang.IllegalArgumentException: bad base-64 at android.util.Base64.decode(Base64.java:161) at android.util.Base64.decode(Base64.java:136) at android.util.Base64.decode(Base64.java:118) at com.scottyab.aescrypt.AESCrypt.decrypt(AESCrypt.java:124)

opened by pixelbendr 1
unable to run wrong final block length

Please Help me to resolve this issue : {"Req Response":"unable to run wrong final block length","Response code":"003"}

opened by best2010 1
Wrote some classes for extra usability.

Hi, I have used your library a lot of times and really like it, so I thought I can somehow contribute to it and make it even easier to use and needing less code for the user. Please review my code and if you find it ok accept it, if not tell me so we can make it even better.

Thanks in advance

opened by drilonrecica 0
Wrote some classes for extra usability.

Hi, I have used your library a lot of times and really like it, so I thought I can somehow contribute to it and make it even easier to use and needing less code for the user. Please review my code and if you find it ok accept it, if not tell me so we can make it even better.

Thanks in advance

opened by drilonrecica 0
Not equal

http://blog.dealforest.net/2012/03/ios-android-per-aes-crypt-connection/

Base64.encodeToString(cipher.doFinal(stringTocrypt.getBytes()), Base64.DEFAULT); //correct

opened by flipnovidade 1
Java/Groovy Port

Hi, I have created a direct port of your Android File to suit Java/Grails enviornments. Works perfect with your Android Library. The Gist is at https://gist.github.com/vishnoor/a0e2922bda3af735a17e90ca03f7d446

Usage is same as your Android Usage. The only extra thing is to support 256 Bit AES, the Oracle 7 Unlimited JCE has to be installed http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html

Sincere Regards, Vishnoo

opened by vishnoor 3

Encryption result of AESCrypt-Android library differs from result in php?

According to the usage example, using password = password and message = hello world results in the encrypted message 2B22cS3UC5s35WBihLBo8w==

However in php using the same password and messagefollowing the snippet here results in the encrypted message lMwL6ztvVavgsTu7NJE/kw== which is different.

See complete php code snippet here

<!DOCTYPE html>
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>

<body>
 <!-- following this snippet<br>
      https://www.urbaninsight.com/2012/06/13/encrypt-and-decrypt-strings-php
 -->

 <?php
  $string = "hello world";
  $password = "password";
  $method = "aes-256-cbc";

  $encrypted = openssl_encrypt($string, $method, $password);
  echo "ENCRYPT:<br>$string<br>$password<br>$encrypted<br><br>";

  $decrypted = openssl_decrypt($encrypted, $method, $password);
  echo "DECRYPT:<br>$encrypted<br>$password<br>$decrypted";
 ?>

 <!-- result: lMwL6ztvVavgsTu7NJE/kw==
  -->

 </body>
</html>

Is the AESCrypt-Android library not compatible with php or is there something, I'm overseeing currently? Thank you in advance! Taifun

opened by puravidaapps 0

Encryption result is different on Android and IOS

Hello,

I am using this library in my android project and its counter part https://github.com/Gurpartap/aescrypt in ios project. I am encrypting same text with same encryption key, but it is giving me different results on ios and android.

I am using this key : 25c35734b1ef623ca2a7f730cf2fea8b790739ba

String to encrypt is : Password

Encrypted String IOS : W3LyAxKq2+QdDBfKUGVgTg== Encrypted String Android : zdgSimKva1jblici7F8DGw==

opened by CDNRahulSonpaliya 3
IV must be 16 bytes long

Hello,

Im getting (IV must be 16bytes long) when using the advance mode.

My encryptedText = "HE9257Ykdrnb7zZTbNYLcLNzsg24t2aEftUZ7Tr0BU0=" My IV = "618wNQX6K3k2343c" //My IV is 16byte long

I base 64 decode both using Base64.decode(encryptedText, Base64.NO_WRAP) and Base64.decode(IV, Base64.NO_WRAP) then pass in (SecretKeySpec, byte[] IV, byte[] encryptedText ) as parameter for advance mode, but gave me an error (IV must be 16 bytes long).

opened by nicchong 0

Owner

Scott Alexander-Bown

Android Developer (remote), author, speaker, father and scruffy looking nerf herder. Love coffee, Belgian beer and running. Founder @swmobilegroup

GitHub

Find Security Bugs is the SpotBugs plugin for security audits of Java web applications

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

2k Jan 6, 2023

AndroidHybridCrypto is simple customizable Android implementation of hybrid cryptography (AES+RSA+Hash) recommended by OWASP.

AndroidHybridCrypto HybridCrypto is simple customizable Android implementation of hybrid cryptography (AES+RSA+Hash) recommended by OWASP. Usage Step

2 Sep 6, 2022

The Spigot plugin counterpart of the overly complex SSN.gg authentication system

Atreus The Spigot plugin counterpart of the overly complex SSN.gg authentication system. Building Make sure you have both Maven and JDK installed (ver

3 Dec 16, 2022

MiHawk 🦅👁️ is simple and secure 🔒 Android Library to store and retrieve pair of key-value data with encryption , internally it use jetpack DataStore Preferences 💽 to store data.

MiHawk MiHawk ?? ??️ is simple and secure ?? Android Library to store and retrieve pair of key-value data with encryption , internally it use jetpack

5 Sep 3, 2022

A simple text encryption/decryption password based GUI+CLI tool

ZeText: Zero disk exposition texts This is a simple text encryption/decryption password based GUI+CLI tool, allowing to enter, edit and decrypt files

0 Dec 21, 2021

Secure your REST APIs with Spring Security, Resource and Authorization Server from zero to JWT

Secure REST APIs with Spring ./mvnw RTFM YouTube: Spring Security Patterns YouTube: Spring Security 5.5 From Taxi to Takeoff Official Apache Maven doc

1 Dec 5, 2021

A collection of android security related resources

android-security-awesome A collection of android security related resources. Tools Academic/Research/Publications/Books Exploits/Vulnerabilities/Bugs

6.6k Jan 5, 2023

Native Device security checks, Rooted/Jailbroken, Not real device, Developer mode is on, On external drive.

palestine_trusted_device Native Device security checks, Rooted/Jailbroken, Not real device, Developer mode is on, On external drive. Part of Palestine

3 Apr 19, 2022

Tiny app to enforce security policies of your device

Sentry Enforce security policies. Tiny app to enforce security policies of your device. It can: limit the maximum number of failed password attempts d

43 Dec 24, 2022

Mobile Security Framework (MobSF)

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

13.2k Jan 4, 2023

Java bytecode obfuscator created by x4e.

Binscure Java bytecode obfuscator created by x4e. Usage First, create a config file, (example config here). When you have a config file, run binscure

35 Nov 22, 2022

Contrast Scan GitHub action

Use Contrast Scan to analyze your code This github action will enable you to use Contrast Scan to detect vulnerabilities in your code. This action can

17 Nov 9, 2022

A tool translate a apk file to stantard android project include so hook api and il2cpp c++ scaffolding when apk is a unity il2cpp game. Write code on a apk file elegantly.

FakerAndroid (FakerAndroid.jar or FakerAndroid-AS) A tool translate a apk file to stantard android project include so hook api and il2cpp c++ scaffold

231 Dec 29, 2022