Storing RSA Private Key Android

android encryption storage private-key
user32981 picture user32981 · Nov 20, 2013 · Viewed 26.9k times · Source

During the creation of simple messaging android application that is to encrypt/decrypt messages and send them through internet, I decided to use RSA public/private key encryption. Question is how to store private key, so that even if phone is maliciously rooted, the key would stay safe? As far as I understood, KeyStore is used for certificates, and cannot be used for this? Should I encrypt private key as text file with AES? I have very little experience with security, so please feel free to correct my ideas, and give your opinion!

Kind Regards.

Answer

gabrielwong picture gabrielwong · Nov 20, 2013

I think KeyStore could be suitable for your use. It is able to store RSA keys and encrypts them using AES so even with root access, they cannot be extracted without the password or bruteforcing.

There's a good post here about using KeyStore: http://nelenkov.blogspot.fr/2012/05/storing-application-secrets-in-androids.html

Related questions

Android encryption / decryption using AES

Is there a good example of how to encrypt and decrypt image and other files with AES on Android?

Read More
What is the most appropriate way to store user settings in Android application

I am creating an application which connects to the server using username/password and I would like to enable the option "Save password" so the user wouldn't have to type the password each time the application starts. I was trying …

Read More
Get all messages from Whatsapp

I'm trying to implement an app that will show in a textview all the messages received from Whatsapp. Is there any way to do it? Is it possible to extract all the messages from Whatsapp?

Read More