ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Working with local SQL databases in AIR
Understanding the EncryptionKeyGenerator class
Adobe AIR 1.5 and later
It isn’t necessary to understand the inner workings of the EncryptionKeyGenerator class to use it to create a secure
encryption key for your application database. The process for using the class is explained in “Using the
EncryptionKeyGenerator class to obtain a secure encryption key” on page 762. However, you might find it valuable to
understand the techniques that the class uses. For example, you might want to adapt the class or incorporate some of
its techniques for situations where a different level of data privacy is desired.
The EncryptionKeyGenerator class is included in the open-source ActionScript 3.0 core library (as3corelib) project.
You can download the as3corelib package including source code and documentation.You can also view the source
code on the project site or download it to follow along with the explanations.
When code creates an EncryptionKeyGenerator instance and calls its getEncryptionKey() method, several steps are
taken to ensure that only the rightful user can access the data. The process is the same to generate an encryption key
from a user-entered password before the database is created as well as to re-create the encryption key to open the
database.
Obtain and validate a strong password
Adobe AIR 1.5 and later
When code calls the getEncryptionKey() method, it passes in a password as a parameter. The password is used as
the basis for the encryption key. By using a piece of information that only the user knows, this design ensures that only
the user who knows the password can access the data in the database. Even if an attacker accesses the user’s account
on the computer, the attacker can’t get into the database without knowing the password. For maximum security, the
application never stores the password.
An application’s code creates an EncryptionKeyGenerator instance and calls its getEncryptionKey() method,
passing a user-entered password as an argument (the variable password in this example):
var keyGenerator:EncryptionKeyGenerator = new EncryptionKeyGenerator();
var encryptionKey:ByteArray = keyGenerator.getEncryptionKey(password);
The first step the EncryptionKeyGenerator class takes when the getEncryptionKey() method is called is to check the
user-entered password to ensure that it meets the password strength requirements. The EncryptionKeyGenerator class
requires a password to be 8 - 32 characters long. The password must contain a mix of uppercase and lowercase letters
and at least one number or symbol character.
The regular expression that checks this pattern is defined as a constant named STRONG_PASSWORD_PATTERN:
private static const STRONG_PASSWORD_PATTERN:RegExp =
/(?=^.{8,32}$)((?=.*\d)|(?=.*\W+))(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$/;
The code that checks the password is in the EncryptionKeyGenerator class’s validateStrongPassword() method.
The code is as follows:
public function vaidateStrongPassword(password:String):Boolean
{
if (password == null || password.length