Android Encryption/Decryption

Question

There are many encryption algorithms and most of them require IV and KEY and Plaintext .

In Android, we have to add 3 of them to our code. On the other side, Android is open source and everyone can extract APK files and access the IV and the KEY , this doesn't make it secure.

Which algorithms are better and unbreakble that can be applied in Java and PHP. I'm working on a Project similar to Instagram/Facebook/Twitter, Security is the first problem for such applications.

Answer 1

Let's start with basic stuff:

• never store an IV/KEY in the source code or unencrypted within the app filesystem
• your might want to look into the Android KeyStore and it's supported operations
• you might need to depend upon the existence of a hardware keystore (so that users cannot modify locally stored keys)

For more information I would recommend to look into the OWASP MSTG -- Android Data Store and Android Cryptographic APIs might be interesting to you