2

Basically, I want to encrypt some strings in my app, strings like access tokens or passwords. I planned on using AES, and mainly saw a good library at https://github.com/tozny/java-aes-crypto. Note that this is used only for protection of sensitive data while the app's purpose is other. As I said, simply add a bit of extra security to saved tokens if a root-ed user gains access to the database which stores these values.

However, after reading a bit about cryptography it seems that there are some US Export laws to consider for apps published on Google Play and available to other countries outside US.

Does using AES library in the link above fall under the requirements of US Export laws or because it uses the integrated android libraries and not uses own cryptography library is fine? Or maybe using xor would be better?

Thank you.

Improve this question

1 Answer 1

Reset to default
1

Does using AES library in the link above fall under the requirements of US Export laws or because it uses the integrated android libraries and not uses own cryptography library is fine?

If it doesn't have a cryptography engine inside it, you're fine. Even if you wanted to include a cryptography engine, the requirements for exporting cryptography from the U.S. are not difficult to meet at all.

As I said, simply add a bit of extra security to saved tokens if a root-ed user gains access to the database which stores these values.

But how do you select the encryption key? If it's hardcoded into your program then that doesn't really add any security.

Improve this answer
5
  • Thank you very much for your answer. Since I am not a native English speaker I did not understood the terms too well. So basically you are saying that if my app uses the Android OS integrated cryptography engine and not a 3rd party one, then it's fine to use it? This may sound right, as looking at informit.com/articles/article.aspx?p=2268753&seqNum=3 the NOTE section does say something about using strong encryption and not the android default one.
    – Alin
    Commented Mar 17, 2017 at 20:30
  • It seems that Apple does not think so, even for HTTPS... iphonedevsdk.com/forum/business-legal-app-store/…
    – Alin
    Commented Mar 17, 2017 at 20:42
  • Or maybe laws have changed: stackoverflow.com/a/39799636/379865
    – Alin
    Commented Mar 17, 2017 at 20:48
  • 2
    @Alin: That's not Apple. That's a random blogger. And I dare say not completely well informed. There's nothing you have to do for an app using https. Or anything using what's built into iOS.
    – gnasher729
    Commented Sep 17, 2017 at 12:42
  • what do you mean with cryptography engine?
    – Bionix1441
    Commented Sep 25, 2018 at 19:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .