Crypto: add a small cryptography library module with CipherFactory

libraries/cryptography/api/build.gradle.kts

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2023 New Vector Ltd
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+plugins {
+    id("io.element.android-library")
+}
+
+android {
+    namespace = "io.element.android.libraries.cryptography.api"
+}

libraries/cryptography/api/src/main/kotlin/io/element/android/libraries/cryptography/api/CipherFactory.kt

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2023 New Vector Ltd
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.element.android.libraries.cryptography.api
+
+import javax.crypto.Cipher
+
+/**
+ * Factory to create [Cipher] instances for encryption and decryption.
+ * The implementation should use a secure way to store the keys.
+ */
+interface CipherFactory {
+    /**
+     * Create a [Cipher] instance for encryption.
+     * @param alias the alias of the key used for encryption.
+     * @return the [Cipher] instance.
+     */
+    fun createEncryptionCipher(alias: String): Cipher
+
+    /**
+     * Create a [Cipher] instance for decryption.
+     * @param alias the alias of the key used for encryption.
+     * @param initializationVector the initialization vector used for encryption.
+     * @return the [Cipher] instance.
+     */
+    fun createDecryptionCipher(alias: String, initializationVector: ByteArray): Cipher
+}

libraries/cryptography/impl/build.gradle.kts

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2023 New Vector Ltd
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+plugins {
+    id("io.element.android-library")
+    alias(libs.plugins.anvil)
+}
+
+android {
+    namespace = "io.element.android.libraries.cryptography.impl"
+}
+
+anvil {
+    generateDaggerFactories.set(true)
+}
+
+dependencies {
+    anvil(projects.anvilcodegen)
+    implementation(projects.anvilannotations)
+    implementation(projects.libraries.di)
+    implementation(projects.libraries.cryptography.api)
+}

libraries/cryptography/impl/src/main/kotlin/io/element/android/libraries/cryptography/impl/KeyStoreCipherFactory.kt

@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2023 New Vector Ltd
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.element.android.libraries.cryptography.impl
+
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import com.squareup.anvil.annotations.ContributesBinding
+import io.element.android.libraries.cryptography.api.CipherFactory
+import io.element.android.libraries.di.AppScope
+import java.security.KeyStore
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+import javax.inject.Inject
+
+private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+private const val ENCRYPTION_BLOCK_MODE = KeyProperties.BLOCK_MODE_GCM
+private const val ENCRYPTION_PADDING = KeyProperties.ENCRYPTION_PADDING_NONE
+private const val ENCRYPTION_ALGORITHM = KeyProperties.KEY_ALGORITHM_AES
+private const val ENCRYPTION_AES_TRANSFORMATION = "$ENCRYPTION_ALGORITHM/$ENCRYPTION_BLOCK_MODE/$ENCRYPTION_PADDING"
+
+/**
+ * Implementation of [CipherFactory] that uses the Android Keystore to store the keys.
+ */
+@ContributesBinding(AppScope::class)
+class KeyStoreCipherFactory @Inject constructor() : CipherFactory {
+
+    override fun createEncryptionCipher(alias: String): Cipher {
+        val cipher = Cipher.getInstance(ENCRYPTION_AES_TRANSFORMATION)
+        val secretKey = getOrGenerateKeyForAlias(alias)
+        cipher.init(Cipher.ENCRYPT_MODE, secretKey)
+        return cipher
+    }
+
+    override fun createDecryptionCipher(alias: String, initializationVector: ByteArray): Cipher {
+        val cipher = Cipher.getInstance(ENCRYPTION_AES_TRANSFORMATION)
+        val secretKey = getOrGenerateKeyForAlias(alias)
+        val spec = GCMParameterSpec(128, initializationVector)
+        cipher.init(Cipher.DECRYPT_MODE, secretKey, spec)
+        return cipher
+    }
+
+    private fun getOrGenerateKeyForAlias(alias: String): SecretKey {
+        val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE)
+        val secretKeyEntry = (keyStore.getEntry(alias, null) as? KeyStore.SecretKeyEntry)
+            ?.secretKey
+        return if (secretKeyEntry == null) {
+            val generator = KeyGenerator.getInstance(ENCRYPTION_ALGORITHM, ANDROID_KEYSTORE)
+            val keyGenSpec = KeyGenParameterSpec.Builder(
+                alias,
+                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
+            )
+                .setBlockModes(ENCRYPTION_BLOCK_MODE)
+                .setEncryptionPaddings(ENCRYPTION_PADDING)
+                .setKeySize(128)
+                .build()
+            generator.init(keyGenSpec)
+            generator.generateKey()
+        } else secretKeyEntry
+    }
+}