在Android应用程序中隐藏加密密钥

Question

I want to hide some data that is entered by user in user's phone encrypted. As far as I know I can encrypt/decrypt data using a key/seed value, but if I hide the key value in code, I know it can be found somehow (eg decompiling the Java code).

Do you have any suggestions to make the process harder?

Answer 1

It is impossible to hide the key in the app such that a resourceful hacker won't be able to pull it out. You can try to obfuscate the key and make it difficult to find but it will always be do able.

See this: https://www.excelsior-usa.com/articles/java-obfuscators.html#examples

The best option would be to require your users to specify a PIN or password and to use that as the encryption key. That way if the device is lost or stolen the key is still safe and it also prevents someone from decompiling your app and getting the encryption key for all instances of your application.

Answer 2

One of the new features in Ice Cream Sandwich (Android 4.0) is the keychain API . From the Platform Highlights page (emphasis mine):

Android 4.0 makes it easier for applications to manage authentication and secure sessions. A new keychain API and underlying encrypted storage let applications store and retrieve private keys and their corresponding certificate chains. Any application can use the keychain API to install and store user certificates and CAs securely .

Answer 3

如果您正在为用户名/密码数据执行此操作，则应该签出实施身份验证器 。

Answer 4

Since android does not have any secure storage on it ( at least as of 2.2), you would have to write your own.

The only way to do this really securely is to encrypt with a key derived from a user supplied password (PBKDF2/ RFc2898 being the way to that). Crypto is only as secure as your key and if you store that on the phone in anyway, then someone can find it and use it. This allows you to have the user store the key without actually remembering a large AES key.

There may be libraries that do this for android. I wrote one for windows phone that can be found here if you want some basis for how to do it.

Answer 5

If encryption/decryption all happens on the handset, a determined hacker will be able to crack it. You can make life harder by using obfustication, or (if appropriate for your application), adding user input into the encrypt/decrypt code.

If your application requires network connectivity, it might be worth off-loading some of the code to a server running elsewhere, so that encrypted data lives on the device, but keys are downloaded at run-time. Still not hack-proof, but it reduces risks to confidential data on a stolen device.