Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Since Android allows for Java and Native implementation of Cryptography, I would like to know how to provide a particular implementation of cryptographic algorithms (say just RSA for example). What would be the best (in terms of ease of development, ease of integration, ease of use) way to provide it?

Is it as a java crypto provider(JCE) bundle? Or is it as an OpenSSL engine?

Native code has the advantage of being faster. What speaks for JCE?

Thanks.

share|improve this question

1 Answer 1

Generally you would not want to add your own cryptographic implementation of any secure protocols or algorithms. There are a few reasons for this:

  1. It is unlikely that you will code a correct implementation on the first go.
  2. Your code has not be scrutinized for years like many open source cryptography libraries.
  3. Your code will most likely be slower regardless of which JCE or OpenSSL engine because other libraries have already been optimized for speed.

Android provides an API for interacting with the OpenSSL library that is already present. This is called Spongy Castle, which is a modified version of Bouncy Castle. The algorithms it supports should already meet your needs. Here is some example code using the API.

That being said, and I encourage you not to use your own implementation, there are two routes you can go.

Custom JCE
This is probably more up your alley and what you want to do. Here is a link to How to Implement a Provider. Here you provide classes for each cryptographic service you want to implement. You will most likely need to sign your provider, and provide your application with the public key to verify it.

Adding a Shared Library
A more fun way (in my opinion anyway) is to create your own crypto-implementation by adding a shared crypto-library to Android, and provide a JNI for your application to use it. The main library would be written in C, and cross-compiled for ARM using Android's NDK. You'll then need to write a Java Provider (JNI) that can be registered with Dalvik in order for your application to run it. Here is an example of installing a different crypto library to your phone.

This has the disadvantage of needing to rebuilt Android and flashing your device. Not ideal for an application installing from Google Play.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.