encryption - where is the best place to store encryption keys?
- Dominant language
- Dart
- Stars
- 4.4k
- Forks
- 449
- PR merge metrics
- No merged PRs in 30d
Description
I used hive in my flutter app. I store very important data in the local database(hive). I used encryptedBox for my data, but I want to securely protect my data. so I have a few questions:
1. I am concerned that it is relatively easy to access the box file. how reliable is the encryption method(AES-256)?
2.if the encryption is reliable(and I read that yes), then it is important to store the key securely.
where is the best place to store keys? I have two options:
2.1 secureStorage(like as example).
const secureStorage = FlutterSecureStorage();
final encryptionKey = await secureStorage.read(key: 'key');
if (encryptionKey == null) {
final key = Hive.generateSecureKey();
await secureStorage.write( key: 'key', value: base64UrlEncode(key),);
}
final key = await secureStorage.read(key: 'key');
final encryptionKey = base64Url.decode(key!);
final encryptedBox= await Hive.openBox('vaultBox', encryptionCipher: HiveAesCipher(encryptionKey));`
also in the documentation it says:
`Only values are encrypted while keys are stored in plaintext.`
I think it is not very reliable - to store the key in the program code.
2.2 store them(value and key) on the server - receive them when starting the application.
your opinion? I will be grateful for any advice.
Contributor guide
No contributing guide indexed for this repository
Research direction
Review the encryptedBox/HiveAesCipher example and the documentation statement that only values are encrypted while keys are stored in plaintext. The issue does not identify a file, test, or concrete documentation change; a useful outcome would first define the supported key-storage guidance for FlutterSecureStorage versus server storage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- dart, flutter
- Domain
- database, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100