Cross platform 256bit AES encryption / decryption

Recently I was writing an app for iOS and Android. Both the apps connect to webservices written in C#. One of the challenges that I faced was to securely encrypt and decrypt the sensitive data.

The encryption which I chose was – AES 256. However getting the cross platform encryption / decryption to work was a big challenge. Those of you who have worked on cross platform encryption / decryption must already be knowing about this. I also searched on internet but couldn’t find example of secure implementation of cross platform 256bit AES encryption / decryption. So I ended up writing my own library which I would like to share in this post.

Now what makes an implementation of AES 256 secure ? There are important things to consider here. First, the key used for encryption should be hashed. Some of the code snippets which I have seen on internet use plain text as key, which is a security flaw. Second, the initialization vector or IV should always be random. This is very important. Most of the implementations which I have seen on internet either do not use an IV or use hardcoded IV. To generate Random IV you’ll need a truly random number and getting a truly random number on mobile device (using sensor data) is an interesting and  separate topic of discussion in itself ! 

What happens if you don’t use random IV ? Read here and here.

Source code for the project is available here – https://github.com/Pakhee/Cross-platform-AES-encryption

This project contains the implementation of 256 bit AES encryption which works on all the platforms (C#, iOS, Android). One of the key objective is to make AES work on all the platforms with simple implementation.

Platforms Supported:

1. iOS

2. Android

3. Windows (C#).

Features:

1. Cross platform support. Encryption-Decryption works across C#, iOS and Android.

2. Support for Random IV (initialization vector) for encryption and decryption. Randomization is crucial for encryption schemes to achieve semantic security, a property whereby repeated usage of the scheme under the same key does not allow an attacker to infer relationships between segments of the encrypted message.

3. Support for SHA-256 for hashing the key. Never use plain text as encryption key. Always hash the plain text key and then use for encryption. AES permits the use of 256-bit keys. Breaking a symmetric 256-bit key by brute force requires 2^128 times more computational power than a 128-bit key. A device that could check a billion billion (10^18) AES keys per second would in theory require about 3×10^51 years to exhaust the 256-bit key space.

How to encrypt a string:

See code samples for more details. You’ll have to perform following steps:

1. Generate Ramdom IV using the provided randomIV generator function.
2. Select a secret key and hash it using the provided SHA-256 hash function.
3. Encrypt your string using the hashed key and random IV.

How to decrypt a string:

See code samples for more details. You’ll have to perform following steps:

1. Get the encrypted text and the randomIV used for encryption
2. Decrypt the strying using the provided decrypt function !

Hope you’ll find this useful !