Encryption?

[shamilovtim]

Hello! Thank you for this awesome work. Just wondering what the status of encryption is in this library? Is it already part of it or on the roadmap?

[mrousavy]

Hi! Yes, I've thought about adding support for Encryption, but I'd have change the API for that since we need custom instances.

So I've imagined it like this:

const storage = new MMKV({
  // ...
  encryptionKey: 'my-encryption-key'
})

storage.set('password', '12345') // <-- gets encrypted
const password = storage.get('password') // <-- gets decrypted

Then we need support for multiple MMKV instances as well, since the default one can't be encrypted. And if we already have multiple instances, we also need to be able to configure it's process-mode.

const storage = new MMKV({
  name: 'secret-storage', // any name/id for the instance
  encryptionKey: 'my-encryption-key', // (optional) key used for encrypting/decrypting
  processMode: 'single-process', // (optional) 'single-process' or 'multi-process'
})

And to access the API as it is now:

const storage = MMKV.default
storage.set('username', 'Marc')

So all of that requires a lot of work, since it has to be natively implemented using TurboModules. That's the main blocker here, so I'll have to wait until TurboModules are released.

[gabimoncha]

@shamilovtim Would this library help? https://github.com/ammarahm-ed/react-native-mmkv-storage
@mrousavy @ammarahm-ed I'm not sure if the two are related or if you can merge them into one for less react native js fatigue and more community open source :)

[heroic]

@mrousavy do we really need to change the API?

We could always have something like

MMKV.createInstance() that accepts props for a new instance. The instance can have .set and .get

MMKV.set() could internally map to MMKV.default instance, so no breaking change either for anyone.

[domwebb]

I would suggest that you don't want to add this into MMKV itself.

Iv used redux-persist extensively the last 4/5 years and have had to encrypt in most cases. If you encrypt at the JS level then something like CryptoJS gives what's need to encrypt. The downside to this is that you have overhead encrypting and decrypting.

Taking a larger redux store (for example) and encrypting it and saving (via redux-persist or otherwise) is going to cause the app to appear laggy to the user as the overhead of the decryption/encryption is not tiny.

My suggestion (tho obvs each app is different) would be you either encrypt certain values and not everything. If you need to encrypt everything then CryptoJS as a wrapper around .set and .get gives you encryption. Where you store encryptions keys etc libs like https://github.com/pradeep1991singh/react-native-secure-key-store give you a drop in solution.

[mrousavy]

Hey! I will implement this in #127 🚀