Android : 如果不是硬编码的加密密钥，加密密钥保存在哪里

Question

My android application has account, passwd and other important information needs to store in its database. So concern about security, i am now studying encrypt these data to save in the database and decrypt it again when needed.

Using salt and iteration can make the encrypt data more strong. This part i understand how to do it. But my concern here comes that there is a lot discussion that not suggest to hard-coded AES key or PBE key. But without the key, i can't decrypt the data again (I do need to decrypt it again).

Is there any good suggestion for android application to save the key?

Thanks a lot.

Answer 1

It is suggested that the encryption key should be managed using Android Keystore, it is the safest option available at the device end to manage the encryption key. Android Keystore went through lots of changes from the day it was available for the user applications and that is why I have categorised the recommended approach based on the API level:

• API Level < 18: Android does not support Keystore for API level 17 and below. For API level 17 and below, it is recommended that the application use PBKDF2 (Password-Based Key Derivation Functions) securely such that the application should generate the encryption key on runtime while login(using user's password). The encryption key should not be stored in the device and should be dynamically generated whenever required using the user's password since there is no secure place in the device to manage the key.

  API Level >=18 <23 : Android supports Keystore for API level 18 and above. However, for API level 22 and below the support for AES encryption is not available. It is recommended that the application generates a random AES key using the default cryptographic provider and encrypt the AES key using RSA public key, generated using Android Keystore through keyPairGenerator. Once the encryption key is encrypted, the same can be stored in the private data storage of the application (For ex: SharedPreferences). When the application starts, the AES key can be decrypted using the RSA private key.

  API Level >=23: Android supports Keystore with AES support for API level 23 and above. We can directly generate the random AES key using generateKey API and the same is managed automatically by Android Keystore.

Answer 2

Save your data in .so file. you need to implement ndk integration in your project. It will make it much more difficult to hack. and you can get your value back from c++ file. Also check for package name in c++ to make sure your so file is not used in any other application.