Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices.

So for this what can I do? I think about storing encrypted videos to sd-card. Can you suggest which encryption/decryption is better or any other method which I can use for my problem.

share|improve this question
2  
This might resolve to a simple "What products provide encryption for my SD card in case my phone gets stolen?" question, but that's a reasonable question, especially given recent increases in police aggressiveness toward confiscating cameras. – gowenfawr Aug 11 '11 at 15:52

1 Answer

up vote 1 down vote accepted

You have the right instincts. Everything on the SD card is readable by every application, so the best solution is to encrypt the file before storing it on the SD card.

I am assuming you are asking from the perspective of an application developer, and you want to know how to implement this protection in your app. If so, one simple approach is to encrypt using AES-CBC mode (with a random IV), and then take the resulting ciphertext and append to it a message authentication code using AES-CMAC. You will need two separate (and cryptographically random) AES keys. You can generate the keys with java.util.SecureRandom. You could then store the keys in app-private storage (not on the SD card). Hopefully this should be pretty straightforward to code up.

If you are asking from the perspective of a user, then you'll need to provide more information about what you are trying to achieve. If you just want to store the video on your cellphone, but not view it on your cellphone, then one possibility is to encrypt it using GPG (or PGP) on your desktop, then download the encrypted file onto your cellphone; when you later want to access it, copy it off your cellphone and decrypt with GPG (or PGP). On the other hand, if you want to be able to view it on your cellphone, you'll probably need to explain what you mean by "no other application or user can use it, outside the application or on any other devices" (e.g., what application?).

share|improve this answer
" You could then store the keys in app-private storage" - but this is just as safe as putting it on the sdcard if the device is rooted. The key needs to be stored in some obfuscated way at least. – Mathias Lin Oct 28 '11 at 7:30
@Mathias, that's a different threat model. The threat model I suspect Mohit cares most about is the risk of a malicious application. Today, on Android, a malicious application can read everything on the SD card, but cannot read data store in other apps' private storage. In contrast, you're talking about the risk if the phone is lost or stolen and then analyzed by someone else with physical access to the phone, which is a bit different (though that threat model is covered by my last paragraph). If I've misunderstood Mohit's goal, I hope he'll clarify. – D.W. Oct 29 '11 at 6:58
Yes, you're right. I read it more from a developer's perspective, who wants to protect his app's content, but I see, he just meant his own personal device. – Mathias Lin Oct 31 '11 at 1:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.