(Android™) Generate Encryption Key

Discusses symmetric encryption key generation techniques for block encryption algorithms such as AES, Blowfish, and Twofish, or for other algorithms such as ChaCha20.

Chilkat Android™ Downloads Android™ Java Libraries Android C/C++ Libraries

// Important: Don't forget to include the call to System.loadLibrary
// as shown at the bottom of this code sample.
package com.test;

import android.app.Activity;
import com.chilkatsoft.*;

import android.widget.TextView;
import android.os.Bundle;

public class SimpleActivity extends Activity {

  private static final String TAG = "Chilkat";

  // Called when the activity is first created.
  @Override
  public void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);

    // Symmetric encryption algorithms are such that the encryptor and decryptor
    // share a pre-known secret key.  This could be a "single-use" key that is 
    // derived from a secure key exchange algorithm using RSA, ECC, or Diffie-Hellman,
    // or it could be a password known to both sides, or
    // it could simply be the binary bytes of the secret key known in advance on both
    // sides.

    // A secret key has no structure.  It's nothing more than N bytes of data.
    // It should typically be random data, or bytes that resemble random data such
    // as the hash of a password.

    // The number of bytes in the secret key defines the bit-strength of an encryption
    // algorithm.  For example, AES with a 32-byte key is 256-bit AES.  Most algorithms
    // define restrictions on key sizes.  For example, AES has 3 choices: 128-bit, 192-bit,
    // or 256-bit.  In the ChaCha20 algorithm, the key size must always be 256-bits (32-bytes).

    // Both sides (encryptor and decryptor) must be in possession of the same secret key
    // in order to communicate.   Whichever side generates the key, it must somehow
    // deliver the key to the other side beforehand.  Key exchange algorithms, such as RSA, ECC,
    // and Diffie-Hellman define secure ways of exchanging symmetric encryption keys.
    // They do so using asymmetric encryption algorithms (public/private keys).  It is not
    // required to use a key exchange algorithm to achieve the goal of having both sides
    // in possession of the same secret key.  A long-living secret key could be exchanged
    // via any secure out-of-band means.  For example, exchanging the information over a secure
    // TLS (HTTPS) or SSH connection...

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    boolean success;

    CkCrypt2 crypt = new CkCrypt2();
    crypt.put_CryptAlgorithm("aes");
    crypt.put_KeyLength(256);

    // Generate a 32-byte random secret key,
    // and use it in the crypt object.
    CkPrng prng = new CkPrng();
    String secretKeyHex = prng.genRandom(32,"hex");
    // It is important that the number of bytes in the secret key
    // matches the value specified in the KeyLength property (above).
    crypt.SetEncodedKey(secretKeyHex,"hex");
    Log.i(TAG, "randomly generated key: " + secretKeyHex);

    // Alternatively, a password could be hashed using a hash algorithm
    // the results in the desired key length.  Our desired key length
    // in this case is 32 bytes, so we wouldn't want MD5 (16 bytes),
    // nor would we want to use SHA-1 (20 bytes).  SHA256 would be the
    // hash of choice because it results in 32-bytes of random-looking
    // key material.
    crypt.put_HashAlgorithm("SHA256");
    crypt.put_EncodingMode("hex");
    secretKeyHex = crypt.hashStringENC("mypassword");
    crypt.SetEncodedKey(secretKeyHex,"hex");
    Log.i(TAG, "password-based key: " + secretKeyHex);

  }

  static {
      System.loadLibrary("chilkat");

      // Note: If the incorrect library name is passed to System.loadLibrary,
      // then you will see the following error message at application startup:
      //"The application <your-application-name> has stopped unexpectedly. Please try again."
  }
}