Flutter - client side encryption of user data

Question

Are there any packages, frameworks, or services to do client-side encryption of user data in Flutter, using firebase as a server?

I hope to build an app that handles some of a user's personal financial information and so I want no one else, including me, to be able to access it. Firebase allows a Dev to see the unencrypted database so I need to do the encryption on the client-side.

I think this will probably have to involve a client-side symmetric key used for encrypting and decrypting the user data.

My worry is how to store this key.

(1) Randomly generated key stored locally - doesn't allow the user to switch between devices and is lost if the device is lost (2) Store it in a Google Drive - requires the user to have a Google account. (Advocated by this article from HackerMoon (3) Generate it deterministically from a salted hash of the user's password (stored locally) - lost if the user forgets or changes their password. (4) Allow the user to choose between a subset of the above

My question is similar to this one How to encrypt user data in Firebase but it covers situations were data is transferred between users and hence uses public key cryptography.

Questions: What is the best way to encrypt user-data for a firebase db?

And if it is to use a symmetric key, what is the best way to generate and store this key so the user doesn't risk losing access to their data?

Solution

This one appeared to be the best solution for my case: flutter_secure_storage. It stores the data in an app specific container within the official key stores of iOS and Android

Comments

[Yadu]

pub.dev/packages/crypt, ask for a encryption password, so the data is never lost