ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Working with local SQL databases in AIR
Internally the getEncryptionKey() method calls the EncryptionKeyGenerator class’s validateStrongPassword()
method and, if the password isn’t valid, throws an exception. The validateStrongPassword() method is a public
method so that application code can check a password without calling the getEncryptionKey() method to avoid
causing an error.
Expand the password to 256 bits
Adobe AIR 1.5 and later
Later in the process, the password is required to be 256 bits long. Rather than require each user to enter a password
that’s exactly 256 bits (32 characters) long, the code creates a longer password by repeating the password characters.
The getEncryptionKey() method calls the concatenatePassword() method to perform the task of creating the
long password.
var concatenatedPassword:String = concatenatePassword(password);
The following is the code for the concatenatePassword() method:
private function concatenatePassword(pwd:String):String
{
var len:int = pwd.length;
var targetLength:int = 32;
}
if (len == targetLength)
{
return pwd;
}
var repetitions:int = Math.floor(targetLength / len);
var excess:int = targetLength % len;
var result:String = "";
for (var i:uint = 0; i < repetitions; i++)
{
result += pwd;
}
result += pwd.substr(0, excess);
return result;
If the password is less than 256 bits, the code concatenates the password with itself to make it 256 bits. If the length
doesn’t work out exactly, the last repetition is shortened to get exactly 256 bits.
Generate or retrieve a 256-bit salt value
Adobe AIR 1.5 and later
The next step is to get a 256-bit salt value that in a later step is combined with the password. A salt is a random value
that is added to or combined with a user-entered value to form a password. Using a salt with a password ensures that
even if a user chooses a real word or common term as a password, the password-plus-salt combination that the system
uses is a random value. This randomness helps guard against a dictionary attack, where an attacker uses a list of words
to attempt to guess a password. In addition, by generating the salt value and storing it in the encrypted local store, it is
tied to the user’s account on the machine on which the database file is located.
Last updated 6/6/2012
770