isar / isar/hive

encryption - where is the best place to store encryption keys?

Open
#1,070 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
Dart
Stars
4.4k
Forks
449
PR merge metrics
No merged PRs in 30d

Description

I used hive in my flutter app. I store very important data in the local database(hive). I used encryptedBox for my data, but I want to securely protect my data. so I have a few questions:
1. I am concerned that it is relatively easy to access the box file. how reliable is the encryption method(AES-256)?

2.if the encryption is reliable(and I read that yes), then it is important to store the key securely.
where is the best place to store keys? I have two options:
2.1 secureStorage(like as example).

const secureStorage = FlutterSecureStorage();

final encryptionKey = await secureStorage.read(key: 'key');

if (encryptionKey == null) {

final key = Hive.generateSecureKey();

await secureStorage.write( key: 'key', value: base64UrlEncode(key),);

}

final key = await secureStorage.read(key: 'key');

final encryptionKey = base64Url.decode(key!);

final encryptedBox= await Hive.openBox('vaultBox', encryptionCipher: HiveAesCipher(encryptionKey));`

also in the documentation it says:

`Only values are encrypted while keys are stored in plaintext.`

I think it is not very reliable - to store the key in the program code.

2.2 store them(value and key) on the server - receive them when starting the application.

your opinion? I will be grateful for any advice.

Contributor guide

No contributing guide indexed for this repository

Research direction

Review the encryptedBox/HiveAesCipher example and the documentation statement that only values are encrypted while keys are stored in plaintext. The issue does not identify a file, test, or concrete documentation change; a useful outcome would first define the supported key-storage guidance for FlutterSecureStorage versus server storage.

Written by the indexing model from the issue text.

Assessment

Tech stack
dart, flutter
Domain
database, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.