0

I'm not sure if I have my terminology right here or that my question is accurate, I will expound here:

Homomorphic encryption seems to be impractical but from my limited knowledge looks like the only area that fully secures all data.

The concept of homomorphic encryption is to carry out calculations on encrypted data, so it seems. This leads me to understand that a whole program could be run with entirely encrypted data at the code level. And only when fed to the user on screen or printed to paper would data really be deciphered. This gets into state management of course. You really have no choice but to have deciphered data at some point in a programs execution.

So, my question is this: is this really necessary, is there a risk for example, in deciphering a piece of a database to work with the data, holding that data in memory until app or webpage is killed? The data after all is indeed a part of the state of app webpage etc. Would this present security risks if this was not designed for? Can deciphered data be accessed by a malicious person in memory while a program is running?

To narrow my question and give context, I am writing with Flutter and Dart. I will be designing for apps as well as web. I am using a Hive encrypted database, to crunch some numbers I must decipher and load to standard memory. Example:

// Initialize our list of persons
  List<Person> _persons = [];

  /// Get Person
  /// Gets all person objects from the hive box and loads them into our state List
  void getAllPersons() async {

    final FlutterSecureStorage secureStorage = const FlutterSecureStorage();
  var containsEncryptionKey = await secureStorage.containsKey(key: 'key');
  if (!containsEncryptionKey) {
    var key = Hive.generateSecureKey();
    await secureStorage.write(key: 'key', value: base64UrlEncode(key));
  }
  
  var encryptionKey = base64Url.decode(await secureStorage.read(key: 'key'));
  print('Encryption key: $encryptionKey');

  var box = await Hive.openBox<Person>('_hiveBox', encryptionCipher: HiveAesCipher(encryptionKey));

    // Update our provider state data with a hive read, and refresh the ui
    _persons = box.values.toList();
    notifyListeners();
  }

_persons.reduce... /// Do something with deciphered data

When this load to list happens, what are the security risks?

While I am trying to narrow my question as much as possible to get it answered as recommended from another post, I am indeed also more broadly interested in knowing if this applies to other languages and to all platforms i.e. software, web, hardware & app.

Thanks for any input!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.