Local storage protection in phonegap application

user_1579614 0
Viewed 3862

I should develop an phonegap application. I need to encrypt my requests to the server side and then decrypt. HTTPS is not a solution, because I need to sign requests to be sure that the data is not fake. I can use any async cryptography (the app will generate private/public keys and will send public key to the server). But this way I need to keep my private key on the device.

The question is: how I can keep private key on the device securely?

I can use sqlclipher (to encrypt my local SQLite DB) and integrate it into my phonegap app. Great, but here I have to keep secret key for database :)

var db = window.sqlitePlugin.openDatabase({name: "DB", key: "secret1"});

Any one who have access to the phone can get this secret key. So here I have the same issue:)

Please, give me any suggestions.

Thanks!

p.s. app for iOS and Android

cordova encryption android ios
2 Answers

By default, PhoneGap does not provide the feature of encryption on its own. Devices based on iOs and Android(above Gingerbread version) support full-disk encryption. But this is not available to PhoneGap/Cordova developers.

From the wiki:

PhoneGap is generally limited to the security features of the platform on which it is running.

Refer to https://github.com/phonegap/phonegap/wiki/Platform-Security

For some JS based solution, give a try at http://code.google.com/p/crypto-js/

user_20758390
Related