How to Implement Data Encryption for Sensitive Information in FlutterFlow

1// encryption_service.dart — AES-256-GCM field-level encryption
2// Manages key generation, storage, and encrypt/decrypt operations
3// Initialize once in main() before runApp()
4
5import 'dart:math';
6import 'dart:convert';
7import 'dart:typed_data';
8import 'package:encrypt/encrypt.dart' as enc;
9import 'package:flutter_secure_storage/flutter_secure_storage.dart';
10import 'package:crypto/crypto.dart';
11
12class EncryptedField {
13  final String ciphertext;
14  final String iv;
15  const EncryptedField({required this.ciphertext, required this.iv});
16  Map<String, String> toMap() => {'ciphertext': ciphertext, 'iv': iv};
17}
18
19class EncryptionService {
20  static final EncryptionService _instance = EncryptionService._internal();
21  factory EncryptionService() => _instance;
22  EncryptionService._internal();
23
24  static const _keyStorageKey = 'aes_256_gcm_key_v1';
25  static const _appSalt = 'REPLACE_WITH_YOUR_APP_SALT';
26  static const _storage = FlutterSecureStorage(
27    aOptions: AndroidOptions(encryptedSharedPreferences: true),
28    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
29  );
30
31  enc.Key? _key;
32  bool get isInitialized => _key != null;
33
34  Future<void> initialize() async {
35    String? storedKey = await _storage.read(key: _keyStorageKey);
36    if (storedKey == null) {
37      final random = Random.secure();
38      final keyBytes =
39          Uint8List.fromList(List.generate(32, (_) => random.nextInt(256)));
40      storedKey = base64Url.encode(keyBytes);
41      await _storage.write(key: _keyStorageKey, value: storedKey);
42    }
43    _key = enc.Key(base64Url.decode(storedKey));
44  }
45
46  /// Encrypt a plaintext string. Returns ciphertext + IV pair.
47  /// Always generates a fresh random IV — never reuse IVs.
48  EncryptedField encrypt(String plaintext) {
49    _assertInitialized();
50    final iv = enc.IV.fromSecureRandom(16);
51    final encrypter = enc.Encrypter(enc.AES(_key!, mode: enc.AESMode.gcm));
52    final encrypted = encrypter.encrypt(plaintext, iv: iv);
53    return EncryptedField(
54      ciphertext: encrypted.base64,
55      iv: base64.encode(iv.bytes),
56    );
57  }
58
59  /// Decrypt a ciphertext using the stored AES key and provided IV.
60  String decrypt(String ciphertext, String ivBase64) {
61    _assertInitialized();
62    final iv = enc.IV(base64.decode(ivBase64));
63    final encrypter = enc.Encrypter(enc.AES(_key!, mode: enc.AESMode.gcm));
64    return encrypter.decrypt64(ciphertext, iv: iv);
65  }
66
67  /// Hash a value for searchable indexing.
68  /// Uses SHA-256 with app salt and optional field-level salt.
69  /// Normalize input before hashing (lowercase, trim).
70  String hashForSearch(String value, {String fieldSalt = ''}) {
71    final normalized = value.toLowerCase().trim();
72    final input = '$_appSalt:$fieldSalt:$normalized';
73    return sha256.convert(utf8.encode(input)).toString();
74  }
75
76  /// Encrypt a field and compute its search hash in one call.
77  Map<String, String> encryptWithHash(String plaintext,
78      {String fieldSalt = ''}) {
79    final encrypted = encrypt(plaintext);
80    final hash = hashForSearch(plaintext, fieldSalt: fieldSalt);
81    return {
82      'ciphertext': encrypted.ciphertext,
83      'iv': encrypted.iv,
84      'search_hash': hash,
85    };
86  }
87
88  void _assertInitialized() {
89    if (_key == null) {
90      throw StateError(
91          'EncryptionService not initialized. Call initialize() in main().');
92    }
93  }
94}