CryptoEngine

Client mobile crypto layer

Cryptography is a Super Admin policy. SHA-256 / SHA-3 and AES-256-GCM are the modern baseline. SHA-1 is never used for a new security-sensitive operation.

Policy diagram

APPDEFENDER.DEV SUPER ADMIN
              │
   Client Security Policy
              │
     ┌────────┴────────┐
     │                 │
ANDROID SDK         iOS SDK
     │                 │
Native Bridge       Native Bridge
     │                 │
SHA-256 / AES-256-GCM
     │                 │
React Native     Client App

Recommended algorithm policy

Function	Recommended	Legacy
Password / data hashing	SHA-256 / SHA-3	SHA-1 — not for new work
Integrity digest	SHA-256	SHA-1 — marked legacy only
Encryption	AES-256-GCM	AES-CBC — not for new policy
Key derivation	HKDF-SHA-256 / PBKDF2-SHA-256	Custom — rejected
Android key storage	Android Keystore	Plain storage — rejected
iOS key storage	Keychain / Secure Enclave	Plain storage — rejected
Transport	TLS 1.2+ / TLS 1.3	SSL / old TLS — rejected

Anti-downgrade

Super Admin can publish a signed policy. The native SDK validates it before apply. A remote update cannot drop production from AES-256-GCM to AES-128 or SHA-1 unless Super Admin sets an explicit legacy migration. An unsafe package is rejected and the secure default stays in force.

Remote Policy
     │
     ▼
Policy Validation
     ├── Valid → Apply
     └── Unsafe → Reject / keep SHA-256 + AES-256-GCM

React Native

The crypto engine is not implemented in JavaScript. The RN adapter receives a decision and key availability. AES key material never crosses the bridge.

await AppDefender.initialize({ appId: "CLIENT_001", environment: "production" });

const result = await AppDefender.launchSecurityCheck();
if (result.decision === "BLOCK") {
  // Do not expose protected application functionality
}

const key = await AppDefender.getKey("MOENGAGE_APP_KEY");
// { released, keyName, reason } — never the AES key or Client secret

KeysDefender