如何在 flutter 中存储密钥对？

Question

I am working on a Flutter messaging application with Firebase as database. In order to encrypt messages sent between 2 users, I have used rsa-encrypt package to generate Public and Private Keypairs at the start of the application.

Code used to generated Keypairs using EncryptionData class:

    import 'package:rsa_encrypt/rsa_encrypt.dart';
    import 'package:pointycastle/api.dart' as crypto;

    Future<crypto.AsymmetricKeyPair> futureKeyPair;
    crypto.AsymmetricKeyPair keyPair;

    class EncryptFunctions{

    Future<crypto.AsymmetricKeyPair<crypto.PublicKey,crypto.PrivateKey>> getKeyPair(){
      var helper = RsaKeyHelper();
      return helper.computeRSAKeyPair(helper.getSecureRandom());
      }
     }

Main.dart is something like this:

    void main(){
    EncryptFunctions encryptFunctions = new EncryptFunctions();
    futureKeyPair = encryptFunctions.getKeyPair();
    runApp(MyApp());
    }

In order to encrypt or decrypt strings, we use encrypt() and decrypt() methods from the same package. The futureKeyPair contains both Public and Private keys which can be accessed by using

    keyPair = await futureKeyPair();

How do I store the private key securely on the device in order to accomplish End To End Encryption. This is my first question here on Stackoverflow. Sorry for any formatting mistakes.

Answer 1

I am working on a Flutter messaging application with Firebase as database. In order to encrypt messages sent between 2 users, I have used rsa-encrypt package to generate Public and Private Keypairs at the start of the application.

Code used to generated Keypairs using EncryptionData class:

    import 'package:rsa_encrypt/rsa_encrypt.dart';
    import 'package:pointycastle/api.dart' as crypto;

    Future<crypto.AsymmetricKeyPair> futureKeyPair;
    crypto.AsymmetricKeyPair keyPair;

    class EncryptFunctions{

    Future<crypto.AsymmetricKeyPair<crypto.PublicKey,crypto.PrivateKey>> getKeyPair(){
      var helper = RsaKeyHelper();
      return helper.computeRSAKeyPair(helper.getSecureRandom());
      }
     }

Main.dart is something like this:

    void main(){
    EncryptFunctions encryptFunctions = new EncryptFunctions();
    futureKeyPair = encryptFunctions.getKeyPair();
    runApp(MyApp());
    }

In order to encrypt or decrypt strings, we use encrypt() and decrypt() methods from the same package. The futureKeyPair contains both Public and Private keys which can be accessed by using

    keyPair = await futureKeyPair();

How do I store the private key securely on the device in order to accomplish End To End Encryption. This is my first question here on Stackoverflow. Sorry for any formatting mistakes.

Answer 2

Android has KeyChain and KeyStore api:

https://developer.android.com/reference/android/security/KeyChain

https://developer.android.com/training/articles/keystore.html

iOS has Keychain:

https://developer.apple.com/documentation/security/keychain_services

I don't know any flutter package that abstracts these APIs, as of December 2020.

Unless you want to write your own package, the closest thing you might want to use could be flutter_secure_storage package which stores the key pair in Keystore for android and in Keychain for iOS, then encrypt the data using the key before storing in SharedPreference (on Android). Just check out the code for details.