EncryptedLocalStore in android

Question

Hello everyone,
I recently installed Flash Builder 4 Burrito, in order to develop a mobile application in AIR, but I'm getting trouble in encrypting an sqlite database using this open source library: https://github.com/mikechambers/as3corelib, the EncryptionKeyGenerator object to be more precise.
The code I'm using is this:
import flash.utils.ByteArray;
import com.adobe.air.crypto.EncryptionKeyGenerator;
protected var password:String = "MyStrongPassword";
protected var passwordInBytes:ByteArray = new ByteArray();
protected var keyGenerator:EncryptionKeyGenerator = new EncryptionKeyGenerator();
protected var connection:SQLConnection = new SQLConnection();
protected function init(event:Event):void {               
     if (connection.connected == false) {
          var file:File = File.applicationStorageDirectory.resolvePath("myDB.db");
          connection.addEventListener(SQLEvent.OPEN, onOpen);
          connection.addEventListener(SQLErrorEvent.ERROR, onError);
          passwordInBytes = keyGenerator.getEncryptionKey(password);
          connection.openAsync(file, "create", null, false, 1024, passwordInBytes);
protected function onOpen(event:Event):void {
     trace("Opened successfully");
protected function onError(event:Event):void {
     trace("Couldn't open");
The trouble here is that I'm getting an error stating "EncryptedLocalStore is not supported on the current platform", pointing to the line that says " passwordInBytes = keyGenerator.getEncryptionKey(password);". Does android doesn't really support EncryptedLocalStore (I'm not even using it)? Or is it another error? How would anyone develop apps for android without being able to store encrypted data?

Answer 1

"AIR profile support: This feature is supported on all desktop operating systems, but is not supported on mobile devices or AIR for TV devices. You can test for support at run time using the EncryptedLocalStore.isSupported property. See AIR Profile Support for more information regarding API support across multiple profiles." Livedocs.
I debugged into the source of library you mentioned.
It does something like
var salt:ByteArray = EncryptedLocalStore.getItem(saltKey);
if (salt == null)
     salt = makeSalt();
     EncryptedLocalStore.setItem(saltKey, salt);
So, salt is how you key is made more secure. Your given key is appended with salt (Another string) and then Bitwise Opeartions are done on combined key.
The library stores this key in ELS with the key "com.adobe.air.crypto::EncryptedDBSalt$$$" by default.
Following is the function that is used to generate salt.
private function makeSalt():ByteArray
     var result:ByteArray = new ByteArray;
     for (var i:uint = 0; i < 8; i++)
          result.writeUnsignedInt(Math.round(Math.random() * uint.MAX_VALUE));
     return result;
So now you know what this Library does. (keyGenerator.getEncryptionKey(password);)
1. Optionally validate for strongness.
2. repeate the password to make the lenghth 32 "saumitrabhave" will become "saumitrabhavesaumitrabhavesaumit"(commentedpwd)
3. Generate salt and store it in ELS.
4. XOR commentedpwd and salt
5 etc
6. etc
So you might want to remove ELS.getItem and ELS.setItem calls before you can use this library.
Or
Not to use library at all develop a secure way of yours based on the steps decribed.
So, You can encrypt sqlDB, But you can't use ELS.