Encrypt String (RSA x509) Android, iOS

[VRonin]

Since you are probably shipping OpenSSL with your code anyway (or at least I hope you are using SSL to connect over the network) you can use that to do the encryption, see http://hayageek.com/rsa-encryption-decryption-openssl-c/ for an example.

P.S.
Password encryption is a VERY BAD idea! Passwords should be stored as salted hashes (SHA3-512 is an option)

[raven-worx]

@ekkescorner
RSA encryption is not supported directly by Qt. You need to use OpenSSL for this.

This can be a very cumbersome task to compile OpenSSL for Android and iOS yourself.
For Android see this, for iOS this.

Use OpenSSL v1.0x (not v1.1.x)

[ekkescorner]

@VRonin customer doesn't use SSL because all is running with AndroidForWorks on BlackBerry Infrastructure where all is encrypted

customer doesn't store the passwords encrypted - only uses this encryption as an extra step to verify app access

[raven-worx]

@ekkescorner
this isn't a matter of SSL. OpenSSL is a cryptographic library you need to use to encrypt your data.

To add up to @VRonin: for SHA hashes Qt has support via QCryptographicHash class.

[ekkescorner]

@raven-worx thx. had the fear I have to add OpenSSL ;-)
it's already on my todo list because I'll need this for Android 7 for customers using SSL

So I'll try to add OpenSSL - thx for the links

[raven-worx]

@ekkescorner said in Encrypt String (RSA x509) Android, iOS:

@raven-worx thx. had the fear I have to add OpenSSL ;-)

So I'll try to add OpenSSL - thx for the links

ó.Ò

[VRonin]

@ekkescorner said in Encrypt String (RSA x509) Android, iOS:

customer doesn't use SSL

I'm curious now... you encrypt locally, send over unsecure network and decrypt locally on the other side? If so how can you prevent men-in-the-middle?

[ekkescorner]

@VRonin the network is secure. it's AndroidForWork on BlackBerry Enterprise Server. you could think that it's something like a VPN.

most of my mobile business apps are running on BlackBerry Server and 90% of the customers only use http because all is encxrypted: devices and traffic

in this case where very sensible data can be accessed it's only an extra verification step.

[VRonin]

@ekkescorner I only now read your username. Sorry for treating you as "not an expert" in network and/or password encryption.

I think you still have 2 options apart from OpenSSL:

• Use Android's built in encryption with QAndroidJniObject: https://www.example-code.com/android/rsa_encryptstrings.asp
• use CryptoC++ https://www.cryptopp.com/wiki/RSA_Cryptography

[ekkescorner]

@VRonin said in Encrypt String (RSA x509) Android, iOS:

@ekkescorner I only now read your username. Sorry for treating you as "not an expert" in network and/or password encryption.

I think you still have 2 options apart from OpenSSL:

• Use Android's built in encryption with QAndroidJniObject: https://www.example-code.com/android/rsa_encryptstrings.asp
• use CryptoC++ https://www.cryptopp.com/wiki/RSA_Cryptography

thx for this worthful info - will try CryptoC++ - need solution for Android and iOS