2

Basically, I want to encrypt some strings in my app, strings like access tokens or passwords. I planned on using AES, and mainly saw a good library at https://github.com/tozny/java-aes-crypto. Note that this is used only for protection of sensitive data while the app's purpose is other. As I said, simply add a bit of extra security to saved tokens if a root-ed user gains access to the database which stores these values.

However, after reading a bit about cryptography it seems that there are some US Export laws to consider for apps published on Google Play and available to other countries outside US.

Does using AES library in the link above fall under the requirements of US Export laws or because it uses the integrated android libraries and not uses own cryptography library is fine? Or maybe using xor would be better?

Thank you.

1

Does using AES library in the link above fall under the requirements of US Export laws or because it uses the integrated android libraries and not uses own cryptography library is fine?

If it doesn't have a cryptography engine inside it, you're fine. Even if you wanted to include a cryptography engine, the requirements for exporting cryptography from the U.S. are not difficult to meet at all.

As I said, simply add a bit of extra security to saved tokens if a root-ed user gains access to the database which stores these values.

But how do you select the encryption key? If it's hardcoded into your program then that doesn't really add any security.

  • Thank you very much for your answer. Since I am not a native English speaker I did not understood the terms too well. So basically you are saying that if my app uses the Android OS integrated cryptography engine and not a 3rd party one, then it's fine to use it? This may sound right, as looking at informit.com/articles/article.aspx?p=2268753&seqNum=3 the NOTE section does say something about using strong encryption and not the android default one. – Alin Mar 17 '17 at 20:30
  • It seems that Apple does not think so, even for HTTPS... iphonedevsdk.com/forum/business-legal-app-store/… – Alin Mar 17 '17 at 20:42
  • Or maybe laws have changed: stackoverflow.com/a/39799636/379865 – Alin Mar 17 '17 at 20:48
  • 2
    @Alin: That's not Apple. That's a random blogger. And I dare say not completely well informed. There's nothing you have to do for an app using https. Or anything using what's built into iOS. – gnasher729 Sep 17 '17 at 12:42
  • what do you mean with cryptography engine? – Bionix1441 Sep 25 '18 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.