如何通过使用AES算法在android中存储用于加密文件的密钥

Question

im try develop a encryption app for android by using AES algorithm ,where should i store the key. the idea is that the user provides a password and a key is generated.how can i do this process safer.thanks in advance

Answer 1

im try develop a encryption app for android by using AES algorithm ,where should i store the key. the idea is that the user provides a password and a key is generated

Then you do not store the key. When the user supplies the password -- either for the initial encryption or for later decryption -- you generate the key from the password.

Answer 2

As @CommonWare indicates, you should generate a key from the password. The correct way to do this is using the PBKDF2 algorithm together with a salt (*). There are other good algorithms such as bcrypt and scrypt, but PBKDF2 is the most established standard. For Android implementations, see PBKDF2 function in Android .

(*) The salt is a random number that is required as part of the PBKDF2 algorithm. This salt is not a secret; you can store it any way you like. But you need to keep track of it for later decryption. Typically you prepend the salt, along with the random IV used by CBC, to the ciphertext when you store it.