Hi,
I have the following problem problem with uploading APKs to the android developer console.
"Security alert
Your app is using a version of OpenSSL containing a security vulnerability."
I have tried building with the most recent daily build (2016.2984) and the most recent release build (2016.2949) with no luck.
I have managed to build and publish versions of this app with the same code for encryption before but as of tuesday, any updates have been rejected with the above reason.
the suggestion from google’s support is “**Please migrate your app(s) to OpenSSL 1.02f/1.01r or higher” **but i do not know how to do this in corona
in my build.settings I have this
settings = { plugins = { ["plugin.openssl"] = { publisherId = "com.coronalabs", }, } }
The encryption is only used as an obfuscation method so that users who may wish to tamper with the app settings stored on the phone cannot.
this is the code that i use in the lua files to encrypt/decrypt the data.
local json = require( "json" ) local openssl = require( "plugin.openssl" ) encKey = "RANDOMKEY" cipher = openssl.get\_cipher ( "aes-256-cbc" ) local filePath = system.pathForFile( "somefile.json", system.DocumentsDirectory ) local goldTable = {} local file = io.open( filePath, "w" ) if file then file:write( cipher:encrypt( json.encode( goldTable ), encKey) ) io.close( file ) end local file = io.open( filePath, "r" ) if file then local contents = file:read( "\*a" ) io.close( file ) goldTable = json.decode( cipher:decrypt(contents, encKey) ) print(contents) end
Can anyone give some pointers as to why this is insecure or is there a better way of doing this?
Thanks!