Good morning all, just to start the discussion about the APIs and
encrypted storage I wrote this gist. Probably after some revisions I
hope to make it a specification.

Regarding the available scenarios, feel free to add or change the priority.


Gist: https://gist.github.com/abstractj/f1229ae075f8e6688c75

# AeroGear Crypto API

**Note**: This document is a working progress

# Authors

- Bruno Oliveira
- *put your pretty name here*

## Goals

- User friendly interface for non crypto experts
- Advanced developers can make use of the pure crypto provider
implementation.

## Supported Algorithms

- https://issues.jboss.org/browse/AGSEC-114


## Scenarios

**Note**: For all scenarios the authentication process was intentionally
ignored.

- A logged in user wants to store sensitive data on mobile


- The mobile device goes offline but the sensitive data must be safe

[Under development]

- Device was stolen and data must be destroyed

[Under development]

- The data must be backed up on the server, but passwords can't be exposed

[Under development]

- The application was installed into another device and the keys must be
revoked on the server

[Under development]

- User wants to configure for how long the keys will be considered valid


## JavaScript

### Dependencies

- [sjcl](http://crypto.stanford.edu/sjcl/) with wrappers for basic
functionalities like: encrypt, decrypt, password salting and key pair
generation.


### Implementation details

- The size of sjcl library is still a concern (28K)

- Crypto bits were built in a separate module so it may be
included/excluded in a custom build.

- The project will be developed under AeroGear.js repository
(https://github.com/aerogear/aerogear-js/pull/57)

### API (draft 0)

- Password based key derivation support (PBKDF2)

        myEncryptedPassword = AeroGear.password("strong");

- Symmetric encryption support (GCM)

    - Encryption:

            var options = {
                IV: superRandomInitializationVector,
                AAD: "whateverAuthenticatedData",
                key: generatedKey,
                data: "My bonnie lies over the ocean"
            };

            var cipherText = AeroGear.encrypt( options );

    - Decryption:

            var options = {
                IV: superRandomInitializationVector,
                AAD: "whateverAuthenticatedData",
                key: generatedKey,
                data: cipherText
            };
            AeroGear.decrypt( options );


- Message authentication support (GMAC, HMAC)

[Under development]


**Note**: The implementations below are currently under discussion at
https://github.com/aerogear/aerogear-js/pull/62

- Hashing support (SHA-256, SHA-512)

        digest = AeroGear.crypto.hash("some message");

- Asymmetric encryption support (ECC)

        var hex = sjcl.codec.hex,
            keyPair = new AeroGear.crypto.KeyPair(),
            cipherText, plainText,
            options = {
                IV: superRandomInitializationVector,
                AAD: "whateverAuthenticatedData",
                key: keyPair.publicKey,
                data: ""My bonnie lies over the ocean"
            };
        cipherText = AeroGear.crypto.encrypt( options );
        options.key = keyPair.privateKey;
        options.data = cipherText;
        plainText = AeroGear.crypto.decrypt( options );

- Digital signatures support (ECDSA)

        var validation,
            options = {
                keys: sjcl.ecc.ecdsa.generateKeys(192),
                message: "My bonnie lies over the ocean"
            };
        options.signature = AeroGear.crypto.sign( options );
        validation = AeroGear.crypto.verify( options );

## Android

### Dependencies

- [Spongy Castle](http://rtyley.github.io/spongycastle/) with wrappers
for basic functionalities like: encrypt, decrypt, password salting and
key pair generation.


### Implementation details

- The bouncycastle "provided" in Android doesn't have ECDH that's the
reason why Spongy Castle was chosen.

- aerogear-crypto-java will be the main repository to provide a crypto
API for Android and the Java server.


### API (draft 0)

**Note**: The implementations below are currently under discussion at
https://github.com/aerogear/aerogear-crypto-java/tree/refactoring

- Password based key derivation support (PBKDF2)

        Pbkdf2 pbkdf2 = AeroGearCrypto.pbkdf2();
        byte[] rawPassword = pbkdf2.encrypt(PASSWORD);

- Symmetric encryption support (GCM)

    - Encryption:

            CryptoBox cryptoBox = new CryptoBox(new
PrivateKey(SOME_SECRET_KEY));
            final byte[] IV = new Random().randomBytes();
            final byte[] message = "My bonnie lies over the
ocean".getBytes();
            final byte[] ciphertext = cryptoBox.encrypt(IV, message);

    - Decryption:

            CryptoBox pandora = new CryptoBox(new
PrivateKey(SOME_SECRET_KEY));
            final byte[] message = pandora.decrypt(IV, ciphertext);


- Message authentication support (GMAC, HMAC)

[Under development]

- Hashing support (SHA-256, SHA-512)

[Under development]

- Asymmetric encryption support (ECC)

        KeyPair keyPair = new KeyPair();
        KeyPair keyPairPandora = new KeyPair();

        CryptoBox cryptoBox = new CryptoBox(keyPair.getPrivateKey(),
keyPairPandora.getPublicKey());
        final byte[] IV = new Random().randomBytes();
        final byte[] message = "My bonnie lies over the ocean".getBytes();
        final byte[] ciphertext = cryptoBox.encrypt(IV, message);

        CryptoBox pandora = new
CryptoBox(keyPairPandora.getPrivateKey(), keyPair.getPublicKey());
        final byte[] message = pandora.decrypt(IV, ciphertext);

- Digital signatures support (ECDSA)

[Under development]


## iOS

### Dependencies

[TBD] - http://oksoclap.com/p/iOS_Meeting_(Security)

- [Common
Crypto](https://developer.apple.com/library/mac/documentation/security/conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html)


### Implementation details

[TBD]


### API (draft 0)

- Password based key derivation support (PBKDF2)

[Under development]

- Symmetric encryption support (GCM)

[Under development]

- Message authentication support (GMAC, HMAC)

[Under development]

- Hashing support (SHA-256, SHA-512)

[Under development]

- Asymmetric encryption support (ECC)

[Under development]

- Digital signatures support (ECDSA)

[Under development]


--
abstractj



_______________________________________________
aerogear-dev mailing list
aerogear-dev@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev