Skip to content

Commit 1644984

Browse files
westracerwestracer
committed
Remove onlyAllowStrongBox
1 parent f1c78d7 commit 1644984

File tree

6 files changed

+6
-30
lines changed

6 files changed

+6
-30
lines changed

‎flutter_secure_storage/CHANGELOG.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
## Fork
22

33
* Enabled StrongBox by default, use fallback if it's not available.
4-
* [Android] Allow to force StrongBox with a flag (onlyAllowStrongBox)
54
* [Android] Method to check if an Android device supports Strongbox
65

76
## 10.0.0

‎flutter_secure_storage/android/src/main/java/com/it_nomads/fluttersecurestorage/FlutterSecureStorage.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1145,7 +1145,8 @@ private SharedPreferences initializeEncryptedSharedPreferencesManager(Context co
11451145
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
11461146
.setBlockModes(KeyProperties.BLOCK_MODE_GCM)
11471147
.setKeySize(256).build())
1148-
.build(config.getOnlyAllowStrongBox());
1148+
.setRequestStrongBoxBacked(true)
1149+
.build();
11491150
return EncryptedSharedPreferences.create(
11501151
context,
11511152
config.getSharedPreferencesName(),

‎flutter_secure_storage/android/src/main/java/com/it_nomads/fluttersecurestorage/FlutterSecureStorageConfig.java‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ public class FlutterSecureStorageConfig {
1212
private static final Boolean DEFAULT_MIGRATE_ON_ALGORITHM_CHANGE = true;
1313
private static final Boolean DEFAULT_ENCRYPTED_SHARED_PREFERENCES = false;
1414
private static final Boolean DEFAULT_ENFORCE_BIOMETRICS = false;
15-
private static final Boolean DEFAULT_ONLY_ALLOW_STRONGBOX = false;
1615
private static final String DEFAULT_BIOMETRIC_PROMPT_TITLE = "Authenticate to access";
1716
private static final String DEFAULT_BIOMETRIC_PROMPT_SUBTITLE = "Use biometrics or device credentials";
1817
private static final String DEFAULT_STORAGE_CIPHER_ALGORITHM = "AES_GCM_NoPadding";
@@ -24,7 +23,6 @@ public class FlutterSecureStorageConfig {
2423
public static final String PREF_OPTION_MIGRATE_ON_ALGORITHM_CHANGE = "migrateOnAlgorithmChange";
2524
public static final String PREF_OPTION_ENCRYPTED_SHARED_PREFERENCES = "encryptedSharedPreferences";
2625
public static final String PREF_OPTION_ENFORCE_BIOMETRICS = "enforceBiometrics";
27-
public static final String PREF_OPTION_ONLY_ALLOW_STRONGBOX = "onlyAllowStrongBox";
2826
public static final String PREF_OPTION_BIOMETRIC_PROMPT_TITLE = "prefOptionBiometricPromptTitle";
2927
public static final String PREF_OPTION_BIOMETRIC_PROMPT_SUBTITLE = "prefOptionBiometricPromptSubtitle";
3028
public static final String PREF_OPTION_STORAGE_CIPHER_ALGORITHM = "storageCipherAlgorithm";
@@ -36,7 +34,6 @@ public class FlutterSecureStorageConfig {
3634
private final boolean migrateOnAlgorithmChange;
3735
private final boolean useEncryptedSharedPreferences;
3836
private final boolean enforceBiometrics;
39-
private final boolean onlyAllowStrongBox;
4037
private final String biometricPromptTitle;
4138
private final String biometricPromptSubtitle;
4239
private final String keyCipherAlgorithm;
@@ -49,7 +46,6 @@ public FlutterSecureStorageConfig(Map<String, Object> options) {
4946
this.migrateOnAlgorithmChange = getBooleanOption(options, PREF_OPTION_MIGRATE_ON_ALGORITHM_CHANGE, DEFAULT_MIGRATE_ON_ALGORITHM_CHANGE);
5047
this.useEncryptedSharedPreferences = getBooleanOption(options, PREF_OPTION_ENCRYPTED_SHARED_PREFERENCES, DEFAULT_ENCRYPTED_SHARED_PREFERENCES);
5148
this.enforceBiometrics = getBooleanOption(options, PREF_OPTION_ENFORCE_BIOMETRICS, DEFAULT_ENFORCE_BIOMETRICS);
52-
this.onlyAllowStrongBox = getBooleanOption(options, PREF_OPTION_ONLY_ALLOW_STRONGBOX, DEFAULT_ONLY_ALLOW_STRONGBOX);
5349
this.biometricPromptTitle = getStringOption(options, PREF_OPTION_BIOMETRIC_PROMPT_TITLE, DEFAULT_BIOMETRIC_PROMPT_TITLE);
5450
this.biometricPromptSubtitle = getStringOption(options, PREF_OPTION_BIOMETRIC_PROMPT_SUBTITLE, DEFAULT_BIOMETRIC_PROMPT_SUBTITLE);
5551
this.storageCipherAlgorithm = getStringOption(options, PREF_OPTION_STORAGE_CIPHER_ALGORITHM, DEFAULT_STORAGE_CIPHER_ALGORITHM);
@@ -84,7 +80,6 @@ private boolean getBooleanOption(Map<String, Object> options, String key, boolea
8480

8581
public boolean isUseEncryptedSharedPreferences() { return useEncryptedSharedPreferences; }
8682
public boolean getEnforceBiometrics() { return enforceBiometrics; }
87-
public boolean getOnlyAllowStrongBox() { return onlyAllowStrongBox; }
8883

8984
public String getBiometricPromptTitle() { return biometricPromptTitle; }
9085
public String getPrefOptionBiometricPromptSubtitle() { return biometricPromptSubtitle; }
@@ -100,7 +95,6 @@ public String toString() {
10095
", deleteOnFailure=" + deleteOnFailure +
10196
", migrateOnAlgorithmChange=" + migrateOnAlgorithmChange +
10297
", enforceBiometrics=" + enforceBiometrics +
103-
", onlyAllowStrongBox=" + onlyAllowStrongBox +
10498
'}';
10599
}
106100
}

‎flutter_secure_storage/android/src/main/java/com/it_nomads/fluttersecurestorage/ciphers/KeyCipherImplementationAES23.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,6 @@ public void generateSymmetricKey() throws Exception {
138138
// Check if device has security (PIN/biometric) configured
139139
boolean deviceHasSecurity = isDeviceSecure();
140140
boolean enforceBiometrics = config.getEnforceBiometrics();
141-
boolean isStrongBoxBacked = config.getOnlyAllowStrongBox();
142141

143142
// ENFORCEMENT MODE: Fail if enforcement enabled but no device security
144143
if (enforceBiometrics && !deviceHasSecurity) {
@@ -178,7 +177,7 @@ public void generateSymmetricKey() throws Exception {
178177
builder.setUnlockedDeviceRequired(true);
179178

180179
// Only enable StrongBox if it's available
181-
if (isStrongBoxBacked && isStrongBoxAvailable()) {
180+
if (isStrongBoxAvailable()) {
182181
builder.setIsStrongBoxBacked(true);
183182
Log.d(TAG, "StrongBox is available and enabled for biometric key");
184183
} else {

‎flutter_secure_storage/android/src/main/java/com/it_nomads/fluttersecurestorage/crypto/MasterKey.java‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -264,8 +264,8 @@ public Builder setKeyGenParameterSpec(@NonNull KeyGenParameterSpec keyGenParamet
264264
* @return The master key.
265265
*/
266266
@NonNull
267-
public MasterKey build(boolean isStrongBoxBacked) throws GeneralSecurityException, IOException {
268-
return Api23Impl.build(this, isStrongBoxBacked);
267+
public MasterKey build() throws GeneralSecurityException, IOException {
268+
return Api23Impl.build(this);
269269
}
270270

271271
static class Api23Impl {
@@ -277,7 +277,7 @@ static String getKeystoreAlias(KeyGenParameterSpec keyGenParameterSpec) {
277277
return keyGenParameterSpec.getKeystoreAlias();
278278
}
279279
@SuppressWarnings("deprecation")
280-
static MasterKey build(Builder builder, boolean isStrongBoxBacked) throws GeneralSecurityException, IOException {
280+
static MasterKey build(Builder builder) throws GeneralSecurityException, IOException {
281281
if (builder.mKeyScheme == null && builder.mKeyGenParameterSpec == null) {
282282
throw new IllegalArgumentException("build() called before "
283283
+ "setKeyGenParameterSpec or setKeyScheme.");
@@ -289,9 +289,6 @@ static MasterKey build(Builder builder, boolean isStrongBoxBacked) throws Genera
289289
.setBlockModes(KeyProperties.BLOCK_MODE_GCM)
290290
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
291291
.setKeySize(DEFAULT_AES_GCM_MASTER_KEY_SIZE);
292-
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P && isStrongBoxBacked) {
293-
keyGenBuilder.setIsStrongBoxBacked(true);
294-
}
295292
if (builder.mAuthenticationRequired) {
296293
keyGenBuilder.setUserAuthenticationRequired(true);
297294
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {

‎flutter_secure_storage/lib/options/android_options.dart‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ class AndroidOptions extends Options {
5151
bool resetOnError = true,
5252
bool migrateOnAlgorithmChange = true,
5353
bool enforceBiometrics = false,
54-
bool onlyAllowStrongBox = false,
5554
KeyCipherAlgorithm keyCipherAlgorithm =
5655
KeyCipherAlgorithm.RSA_ECB_OAEPwithSHA_256andMGF1Padding,
5756
StorageCipherAlgorithm storageCipherAlgorithm =
@@ -64,7 +63,6 @@ class AndroidOptions extends Options {
6463
_resetOnError = resetOnError,
6564
_migrateOnAlgorithmChange = migrateOnAlgorithmChange,
6665
_enforceBiometrics = enforceBiometrics,
67-
_onlyAllowStrongBox = onlyAllowStrongBox,
6866
_keyCipherAlgorithm = keyCipherAlgorithm,
6967
_storageCipherAlgorithm = storageCipherAlgorithm;
7068

@@ -85,7 +83,6 @@ class AndroidOptions extends Options {
8583
bool resetOnError = true,
8684
bool migrateOnAlgorithmChange = true,
8785
bool enforceBiometrics = false,
88-
bool onlyAllowStrongBox = false,
8986
this.sharedPreferencesName,
9087
this.preferencesKeyPrefix,
9188
this.biometricPromptTitle,
@@ -94,7 +91,6 @@ class AndroidOptions extends Options {
9491
_resetOnError = resetOnError,
9592
_migrateOnAlgorithmChange = migrateOnAlgorithmChange,
9693
_enforceBiometrics = enforceBiometrics,
97-
_onlyAllowStrongBox = onlyAllowStrongBox,
9894
_keyCipherAlgorithm = KeyCipherAlgorithm.AES_GCM_NoPadding,
9995
_storageCipherAlgorithm = StorageCipherAlgorithm.AES_GCM_NoPadding;
10096

@@ -132,13 +128,6 @@ class AndroidOptions extends Options {
132128
/// Defaults to false.
133129
final bool _enforceBiometrics;
134130

135-
/// If true, only allow keys to be stored in StrongBox backed keymaster.
136-
/// This option is only available on API 28 and greater.
137-
/// If set to true some phones might not work.
138-
/// Defaults to false.
139-
/// https://developer.android.com/training/articles/keystore#HardwareSecurityModule
140-
final bool _onlyAllowStrongBox;
141-
142131
/// Algorithm used to encrypt the secret key.
143132
/// By default RSA/ECB/OAEPWithSHA-256AndMGF1Padding is used (API 23+).
144133
/// Legacy RSA/ECB/PKCS1Padding is available for backwards compatibility.
@@ -182,7 +171,6 @@ class AndroidOptions extends Options {
182171
'resetOnError': '$_resetOnError',
183172
'migrateOnAlgorithmChange': '$_migrateOnAlgorithmChange',
184173
'enforceBiometrics': '$_enforceBiometrics',
185-
'onlyAllowStrongBox': '$_onlyAllowStrongBox',
186174
'keyCipherAlgorithm': _keyCipherAlgorithm.name,
187175
'storageCipherAlgorithm': _storageCipherAlgorithm.name,
188176
'sharedPreferencesName': sharedPreferencesName ?? '',
@@ -199,7 +187,6 @@ class AndroidOptions extends Options {
199187
bool? resetOnError,
200188
bool? migrateOnAlgorithmChange,
201189
bool? enforceBiometrics,
202-
bool? onlyAllowStrongBox,
203190
KeyCipherAlgorithm? keyCipherAlgorithm,
204191
StorageCipherAlgorithm? storageCipherAlgorithm,
205192
String? preferencesKeyPrefix,
@@ -216,7 +203,6 @@ class AndroidOptions extends Options {
216203
migrateOnAlgorithmChange:
217204
migrateOnAlgorithmChange ?? _migrateOnAlgorithmChange,
218205
enforceBiometrics: enforceBiometrics ?? _enforceBiometrics,
219-
onlyAllowStrongBox: onlyAllowStrongBox ?? _onlyAllowStrongBox,
220206
keyCipherAlgorithm: keyCipherAlgorithm ?? _keyCipherAlgorithm,
221207
storageCipherAlgorithm:
222208
storageCipherAlgorithm ?? _storageCipherAlgorithm,

0 commit comments

Comments
 (0)