Geek Answers Handbook

Android Keystore, safe key value

I learn using the safe / enhanced Keystore introduced in Android 4.3.

I would like to keep the encryption key inside this keystore, this key is used to encrypt sqlite db and the values ​​contained in my general settings.

When I look at the KeyStore sample in the SDK, I see the following:

public static final String ALIAS = "my_key"

If someone can decompile my code, they can see the alias cleartext (= key to retrieve the encryption key from the keystore), and therefore they can get a link to my encryption key. How can I safely manage my ALIAS? or am i missing an item here?

+6
source share
2 answers

An alias is not confidential. Each keystore is associated with a password, and each key has its own (optional) password. These are values ​​that must be preserved.

Without password (s), an attacker cannot read your key material, despite knowing the alias.

+1
source

Below is the answer for 4.3+. This release introduced major changes to the KeyStore and KeyChain classes. See here for more information.

Keystore access is limited by UID - your application is allocated a UID during installation.

This is what prevents other applications / processes from gaining access to your key pair / private key . The keystore keeper will provide this.

This may require the device PIN for additional encryption. See http://developer.android.com/reference/android/security/KeyPairGeneratorSpec.Builder.html#setEncryptionRequired ()

The whole point of using software / hardware key storage is to get around the situation that you are describing - any hard-coded data in your application can be read during decompilation so that it is not safe.

@Duncans replies that it seems that you need to maintain a password. I would advise you to create a key pair using the keystore, and then use it to encrypt the AES key, which you can use to encrypt everything you want (much faster than using the RSA key).

You can use the secret key supported by the hardware / sorting repository like keyStore.getEntry(alias, null); and do not pass any password.

See SecretKeyWrapper.java for a good example.

+7
source

More articles:


All Articles