SecureSettingsFactory
Platform-specific factory that creates an encrypted Settings instance.
Returns the standard multiplatform-settings Settings interface — zero API change for consumers.
Android: EncryptedSharedPreferences (MasterKey AES256_GCM) -> SharedPreferencesSettings
iOS: KeychainSettings (service = "com.siddharth.kmp.secure")
JVM: AES-256-GCM-encrypted PropertiesSettings (key file beside the store, 0600)
Construction is per-platform (the Android actual needs a Context, the JVM actual takes an optional store File) — that is the whole point of the expect/actual factory.
Platform-specific factory that creates an encrypted Settings instance.
Returns the standard multiplatform-settings Settings interface — zero API change for consumers.
Android: EncryptedSharedPreferences (MasterKey AES256_GCM) -> SharedPreferencesSettings
iOS: KeychainSettings (service = "com.siddharth.kmp.secure")
JVM: AES-256-GCM-encrypted PropertiesSettings (key file beside the store, 0600)
Construction is per-platform (the Android actual needs a Context, the JVM actual takes an optional store File) — that is the whole point of the expect/actual factory.
Platform-specific factory that creates an encrypted Settings instance.
Returns the standard multiplatform-settings Settings interface — zero API change for consumers.
Android: EncryptedSharedPreferences (MasterKey AES256_GCM) -> SharedPreferencesSettings
iOS: KeychainSettings (service = "com.siddharth.kmp.secure")
JVM: AES-256-GCM-encrypted PropertiesSettings (key file beside the store, 0600)
Construction is per-platform (the Android actual needs a Context, the JVM actual takes an optional store File) — that is the whole point of the expect/actual factory.
Desktop/JVM secure settings: the whole properties store is AES-256-GCM encrypted at rest.
The key is generated once and persisted base64 in a sibling <store>.key file (0600 where the FS supports POSIX perms). ponytail: the key sits next to the ciphertext — a determined local attacker with FS access can read both. Upgrade path when that threat matters: move the key to the OS credential store (macOS Keychain / Windows DPAPI / Linux libsecret), same as the reference template's deferred "Phase 4".