expo-secure-store 12.6.0 → 12.8.0

package/CHANGELOG.md

@@ -10,6 +10,24 @@
 
 ### 💡 Others
 
+## 12.8.0 — 2023-12-12
+
+### 🎉 New features
+
+- [iOS] Added possibility to store values that require authentication and ones that don't under the same `keychainService`. ([#23841](https://github.com/expo/expo/pull/23841) by [@behenate](https://github.com/behenate))
+- [iOS] Added synchronous functions for storing and retrieving values from the store. ([#23841](https://github.com/expo/expo/pull/23841) by [@behenate](https://github.com/behenate))
+
+## 12.7.0 — 2023-11-14
+
+### 🛠 Breaking changes
+
+- Bumped iOS deployment target to 13.4. ([#25063](https://github.com/expo/expo/pull/25063) by [@gabrieldonadel](https://github.com/gabrieldonadel))
+- On `Android` bump `compileSdkVersion` and `targetSdkVersion` to `34`. ([#24708](https://github.com/expo/expo/pull/24708) by [@alanjhughes](https://github.com/alanjhughes))
+
+### 💡 Others
+
+- [Android] Enforce minimum authentication tag length for the `AESEncryptor` for improved security. ([#25294](https://github.com/expo/expo/pull/25294) by [@behenate](https://github.com/behenate))
+
 ## 12.6.0 — 2023-10-17
 
 ### 🛠 Breaking changes

package/android/build.gradle

@@ -3,7 +3,7 @@ apply plugin: 'kotlin-android'
 apply plugin: 'maven-publish'
 
 group = 'host.exp.exponent'
-version = '12.6.0'
+version = '12.8.0'
 
 def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
 if (expoModulesCorePlugin.exists()) {
@@ -61,11 +61,11 @@ if (!safeExtGet("expoProvidesDefaultConfig", false)) {
 android {
   // Remove this if and it's contents, when support for SDK49 is dropped
   if (!safeExtGet("expoProvidesDefaultConfig", false)) {
-    compileSdkVersion safeExtGet("compileSdkVersion", 33)
+    compileSdkVersion safeExtGet("compileSdkVersion", 34)
 
     defaultConfig {
       minSdkVersion safeExtGet("minSdkVersion", 23)
-      targetSdkVersion safeExtGet("targetSdkVersion", 33)
+      targetSdkVersion safeExtGet("targetSdkVersion", 34)
     }
 
     publishing {
@@ -94,7 +94,7 @@ android {
   namespace "expo.modules.securestore"
   defaultConfig {
     versionCode 17
-    versionName '12.6.0'
+    versionName '12.8.0'
   }
 }
 

package/android/src/main/java/expo/modules/securestore/SecureStoreModule.kt

@@ -126,12 +126,12 @@ open class SecureStoreModule : Module() {
         AESEncryptor.NAME -> {
           val secretKeyEntry = getPreferredKeyEntry(SecretKeyEntry::class.java, mAESEncryptor, options, requireAuthentication, usesKeystoreSuffix)
             ?: throw DecryptException("Could not find a keychain for key $key$legacyReadFailedWarning", key, options.keychainService)
-          return mAESEncryptor.decryptItem(encryptedItem, secretKeyEntry, options, authenticationHelper)
+          return mAESEncryptor.decryptItem(key, encryptedItem, secretKeyEntry, options, authenticationHelper)
         }
         HybridAESEncryptor.NAME -> {
           val privateKeyEntry = getPreferredKeyEntry(PrivateKeyEntry::class.java, hybridAESEncryptor, options, requireAuthentication, usesKeystoreSuffix)
             ?: throw DecryptException("Could not find a keychain for key $key$legacyReadFailedWarning", key, options.keychainService)
-          return hybridAESEncryptor.decryptItem(encryptedItem, privateKeyEntry, options, authenticationHelper)
+          return hybridAESEncryptor.decryptItem(key, encryptedItem, privateKeyEntry, options, authenticationHelper)
         }
         else -> {
           throw DecryptException("The item for key $key in SecureStore has an unknown encoding scheme $scheme)", key, options.keychainService)

package/android/src/main/java/expo/modules/securestore/encryptors/AESEncryptor.kt

@@ -5,6 +5,7 @@ import android.security.keystore.KeyGenParameterSpec
 import android.security.keystore.KeyProperties
 import android.util.Base64
 import expo.modules.securestore.AuthenticationHelper
+import expo.modules.securestore.DecryptException
 import expo.modules.securestore.SecureStoreModule
 import expo.modules.securestore.SecureStoreOptions
 import org.json.JSONException
@@ -108,6 +109,7 @@ class AESEncryptor : KeyBasedEncryptor<KeyStore.SecretKeyEntry> {
 
   @Throws(GeneralSecurityException::class, JSONException::class)
   override suspend fun decryptItem(
+    key: String,
     encryptedItem: JSONObject,
     keyStoreEntry: KeyStore.SecretKeyEntry,
     options: SecureStoreOptions,
@@ -122,6 +124,9 @@ class AESEncryptor : KeyBasedEncryptor<KeyStore.SecretKeyEntry> {
     val cipher = Cipher.getInstance(AES_CIPHER)
     val requiresAuthentication = encryptedItem.optBoolean(AuthenticationHelper.REQUIRE_AUTHENTICATION_PROPERTY)
 
+    if (authenticationTagLength < MIN_GCM_AUTHENTICATION_TAG_LENGTH) {
+      throw DecryptException("Authentication tag length must be at least $MIN_GCM_AUTHENTICATION_TAG_LENGTH bits long", key, options.keychainService)
+    }
     cipher.init(Cipher.DECRYPT_MODE, keyStoreEntry.secretKey, gcmSpec)
     val unlockedCipher = authenticationHelper.authenticateCipher(cipher, requiresAuthentication, options.authenticationPrompt)
     return String(unlockedCipher.doFinal(ciphertextBytes), StandardCharsets.UTF_8)
@@ -134,5 +139,6 @@ class AESEncryptor : KeyBasedEncryptor<KeyStore.SecretKeyEntry> {
     private const val CIPHERTEXT_PROPERTY = "ct"
     const val IV_PROPERTY = "iv"
     private const val GCM_AUTHENTICATION_TAG_LENGTH_PROPERTY = "tlen"
+    private const val MIN_GCM_AUTHENTICATION_TAG_LENGTH = 96
   }
 }

package/android/src/main/java/expo/modules/securestore/encryptors/HybridAESEncryptor.kt

@@ -80,7 +80,13 @@ class HybridAESEncryptor(private var mContext: Context, private val mAESEncrypto
   }
 
   @Throws(GeneralSecurityException::class, JSONException::class)
-  override suspend fun decryptItem(encryptedItem: JSONObject, keyStoreEntry: KeyStore.PrivateKeyEntry, options: SecureStoreOptions, authenticationHelper: AuthenticationHelper): String {
+  override suspend fun decryptItem(
+    key: String,
+    encryptedItem: JSONObject,
+    keyStoreEntry: KeyStore.PrivateKeyEntry,
+    options: SecureStoreOptions,
+    authenticationHelper: AuthenticationHelper
+  ): String {
     // Decrypt the encrypted symmetric key
     val encryptedSecretKeyString = encryptedItem.getString(ENCRYPTED_SECRET_KEY_PROPERTY)
     val encryptedSecretKeyBytes = Base64.decode(encryptedSecretKeyString, Base64.DEFAULT)
@@ -92,7 +98,7 @@ class HybridAESEncryptor(private var mContext: Context, private val mAESEncrypto
 
     // Decrypt the value with the symmetric key
     val secretKeyEntry = KeyStore.SecretKeyEntry(secretKey)
-    return mAESEncryptor.decryptItem(encryptedItem, secretKeyEntry, options, authenticationHelper)
+    return mAESEncryptor.decryptItem(key, encryptedItem, secretKeyEntry, options, authenticationHelper)
   }
 
   @get:Throws(NoSuchAlgorithmException::class, NoSuchProviderException::class, NoSuchPaddingException::class)

package/android/src/main/java/expo/modules/securestore/encryptors/KeyBasedEncryptor.kt

@@ -30,6 +30,7 @@ interface KeyBasedEncryptor<E : KeyStore.Entry> {
 
   @Throws(GeneralSecurityException::class, JSONException::class)
   suspend fun decryptItem(
+    key: String,
     encryptedItem: JSONObject,
     keyStoreEntry: E,
     options: SecureStoreOptions,

package/ios/ExpoSecureStore.podspec

@@ -10,7 +10,7 @@ Pod::Spec.new do |s|
   s.license        = package['license']
   s.author         = package['author']
   s.homepage       = package['homepage']
-  s.platform       = :ios, '13.0'
+  s.platform       = :ios, '13.4'
   s.swift_version  = '5.4'
   s.source         = { git: 'https://github.com/expo/expo.git' }
   s.static_framework = true
@@ -22,7 +22,7 @@ Pod::Spec.new do |s|
     'DEFINES_MODULE' => 'YES',
     'SWIFT_COMPILATION_MODE' => 'wholemodule'
   }
-  
+
   if !$ExpoUseSources&.include?(package['name']) && ENV['EXPO_USE_SOURCE'].to_i == 0 && File.exist?("#{s.name}.xcframework") && Gem::Version.new(Pod::VERSION) >= Gem::Version.new('1.10.0')
     s.source_files = "**/*.h"
     s.vendored_frameworks = "#{s.name}.xcframework"

package/ios/SecureStoreModule.swift

@@ -17,20 +17,22 @@ public final class SecureStoreModule: Module {
     ])
 
     AsyncFunction("getValueWithKeyAsync") { (key: String, options: SecureStoreOptions) -> String? in
-      guard let key = validate(for: key) else {
-        throw InvalidKeyException()
-      }
+      return try get(with: key, options: options)
+    }
 
-      let data = try searchKeyChain(with: key, options: options)
+    Function("getValueWithKeySync") { (key: String, options: SecureStoreOptions) -> String? in
+      return try get(with: key, options: options)
+    }
 
-      guard let data = data else {
-        return nil
+    AsyncFunction("setValueWithKeyAsync") { (value: String, key: String, options: SecureStoreOptions) -> Bool in
+      guard let key = validate(for: key) else {
+        throw InvalidKeyException()
       }
 
-      return String(data: data, encoding: .utf8)
+      return try set(value: value, with: key, options: options)
     }
 
-    AsyncFunction("setValueWithKeyAsync") { (value: String, key: String, options: SecureStoreOptions) -> Bool in
+    Function("setValueWithKeySync") {(value: String, key: String, options: SecureStoreOptions) -> Bool in
       guard let key = validate(for: key) else {
         throw InvalidKeyException()
       }
@@ -39,33 +41,61 @@ public final class SecureStoreModule: Module {
     }
 
     AsyncFunction("deleteValueWithKeyAsync") { (key: String, options: SecureStoreOptions) in
-      let searchDictionary = query(with: key, options: options)
-      SecItemDelete(searchDictionary as CFDictionary)
+      let noAuthSearchDictionary = query(with: key, options: options, requireAuthentication: false)
+      let authSearchDictionary = query(with: key, options: options, requireAuthentication: true)
+      let legacySearchDictionary = query(with: key, options: options)
+
+      SecItemDelete(legacySearchDictionary as CFDictionary)
+      SecItemDelete(authSearchDictionary as CFDictionary)
+      SecItemDelete(noAuthSearchDictionary as CFDictionary)
     }
   }
 
+  private func get(with key: String, options: SecureStoreOptions) throws -> String? {
+    guard let key = validate(for: key) else {
+      throw InvalidKeyException()
+    }
+
+    if let unauthenticatedItem = try searchKeyChain(with: key, options: options, requireAuthentication: false) {
+      return String(data: unauthenticatedItem, encoding: .utf8)
+    }
+
+    if let authenticatedItem = try searchKeyChain(with: key, options: options, requireAuthentication: true) {
+      return String(data: authenticatedItem, encoding: .utf8)
+    }
+
+    if let legacyItem = try searchKeyChain(with: key, options: options) {
+      return String(data: legacyItem, encoding: .utf8)
+    }
+
+    return nil
+  }
+
   private func set(value: String, with key: String, options: SecureStoreOptions) throws -> Bool {
-    var query = query(with: key, options: options)
+    var setItemQuery = query(with: key, options: options, requireAuthentication: options.requireAuthentication)
 
     let valueData = value.data(using: .utf8)
-    query[kSecValueData as String] = valueData
+    setItemQuery[kSecValueData as String] = valueData
 
     let accessibility = attributeWith(options: options)
 
     if !options.requireAuthentication {
-      query[kSecAttrAccessible as String] = accessibility
+      setItemQuery[kSecAttrAccessible as String] = accessibility
     } else {
       guard let _ = Bundle.main.infoDictionary?["NSFaceIDUsageDescription"] as? String else {
         throw MissingPlistKeyException()
       }
       let accessOptions = SecAccessControlCreateWithFlags(kCFAllocatorDefault, accessibility, SecAccessControlCreateFlags.biometryCurrentSet, nil)
-      query[kSecAttrAccessControl as String] = accessOptions
+      setItemQuery[kSecAttrAccessControl as String] = accessOptions
     }
 
-    let status = SecItemAdd(query as CFDictionary, nil)
+    let status = SecItemAdd(setItemQuery as CFDictionary, nil)
 
     switch status {
     case errSecSuccess:
+      // On success we want to remove the other key alias and legacy key (if they exist) to avoid conflicts during reads
+      SecItemDelete(query(with: key, options: options) as CFDictionary)
+      SecItemDelete(query(with: key, options: options, requireAuthentication: !options.requireAuthentication) as CFDictionary)
       return true
     case errSecDuplicateItem:
       return try update(value: value, with: key, options: options)
@@ -75,7 +105,7 @@ public final class SecureStoreModule: Module {
   }
 
   private func update(value: String, with key: String, options: SecureStoreOptions) throws -> Bool {
-    var query = query(with: key, options: options)
+    var query = query(with: key, options: options, requireAuthentication: options.requireAuthentication)
 
     let valueData = value.data(using: .utf8)
     let updateDictionary = [kSecValueData as String: valueData]
@@ -93,8 +123,8 @@ public final class SecureStoreModule: Module {
     }
   }
 
-  private func searchKeyChain(with key: String, options: SecureStoreOptions) throws -> Data? {
-    var query = query(with: key, options: options)
+  private func searchKeyChain(with key: String, options: SecureStoreOptions, requireAuthentication: Bool? = nil) throws -> Data? {
+    var query = query(with: key, options: options, requireAuthentication: requireAuthentication)
 
     query[kSecMatchLimit as String] = kSecMatchLimitOne
     query[kSecReturnData as String] = kCFBooleanTrue
@@ -119,8 +149,12 @@ public final class SecureStoreModule: Module {
     }
   }
 
-  private func query(with key: String, options: SecureStoreOptions) -> [String: Any] {
-    let service = options.keychainService ?? "app"
+  private func query(with key: String, options: SecureStoreOptions, requireAuthentication: Bool? = nil) -> [String: Any] {
+    var service = options.keychainService ?? "app"
+    if let requireAuthentication {
+      service.append(":\(requireAuthentication ? "auth" : "no-auth")")
+    }
+
     let encodedKey = Data(key.utf8)
 
     return [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-secure-store",
-  "version": "12.6.0",
+  "version": "12.8.0",
   "description": "Provides a way to encrypt and securely store key–value pairs locally on the device.",
   "main": "build/SecureStore.js",
   "types": "build/SecureStore.d.ts",
@@ -42,5 +42,5 @@
   "peerDependencies": {
     "expo": "*"
   },
-  "gitHead": "da25937e2a99661cbe5eb60ca1d8d6245fc96a50"
+  "gitHead": "6aca7ce098ddc667776a3d7cf612adbb985e264a"
 }