How to securely encrypt data on Android device using AndroidKeyStore

Data encryption is important in every Android application. You need to know a few ways to secure your data, secure your Android files, secure shared preferences data, the keys used in your application. The fact is, even after applying some coding techniques, your data may be retrieved by some experts, but your goal is how to make it harder for them to retrieve the data by Provide some additional layers of security inside your application. In this blog, we will learn how to encrypt data securely on devices and use AndroidKeyStore to store keys in Android. Let's get started

Jetpack Security Library

At Google I / O 19, the Jetpack Security library was introduced to allow us to easily encrypt data, files and shared preferences. It provides strong security, a great balance between encryption and good performance. In addition, for applications that require hardware-enabled Keystore, it provides maximum security. So all we need to do is use this library without thinking about the work it does in the backend.

But Android OS is very secure and we have a separate file-based encryption system, so why use Android's Jetpack Security Library? There are many different reasons, some of which are:

• If you are working on a rooted device, the file system will be unlocked and some attackers can easily access the data even though you have encrypted the entire memory.
• Another reason might be to secure the keys or tokens in your application because you don't want your users to use them.

Therefore, this Jetpack Security Library is used to encrypt on phone memory and is provided for Android version 6.0 and above. All you need to do is add this library to your build.gradle file.

Key management

The keys we use in Android apps must be secure because if we don't secure our Android keys it can be used against us in some way. So to protect our keys from being used by others, we have something called the Android Keystore System in Android. It protects your key material from unauthorized use. Therefore, to use it, you must be authorized. It has hardware support which means it runs on a separate memory space on the device. So even though your application has access to the key, your application doesn't know what the key material is and in this way, your key material is secure. For API 28 and above, you can use the StrongBox Keymaster located in the hardware security module and it is an implementation of the Keymaster HAL. The module has its own CPU and safe storage. So it will provide an extra layer of encryption for your keys.

In Jetpack Security we have a class called MasterKeys allows us to create private keys (by default, the ASE256 encryption standard is used).

Here, we're using dungblock mode GCM_SPEC no padding. If you want to encrypt a small data the size of the key, then you do not need any buffer or blocking. But when the encrypted data is longer than the key size, we use buffering and blocking.

It is not always necessary to use 256-bit keys or use GCM without buffers. You have other options like setBlockModes() , setEncryptPaddings , setKeySize() , setUserAuthenticationRequired() , setUnlockedDeviceRequired() , and more.

You can also generate new EC key pairs using the KeyPairGenerator API.

Now we have a key, and we can use it for many purposes, such as encrypting files. Let's see how we do it

File Encryption

With the help of the Jetpack Security library, you can encrypt files included in your application. It uses Streaming AES to process files of all sizes. All you need to do is create a file and then make this file encrypted. After receiving the encrypted file, if you want to write some data to the encrypted file, you can use the openFileOutput() and if you want to read data from your encrypted file, you have You can use the openFileInput() . Here is the implementation code:

Everything is encrypted and decoded right where you call the data, you don't need to worry about how it works.

SharedPreferences Encryption

We store data in SharedPreferences because it's easy to use. But besides that, it was too easy to attack and get key-values ​​from SharedPreferences. So we need to encrypt the SharedPreferences data and this is completely easy when using EncryptedSharedPreferences. It works with Android 6.0 and higher.

To use EncryptedSharedPreferences, simply create or receive a Master Key from AndroidKeyStore:

After receiving the Master Key, now initialize an instance of EncryptedSharedPreferences:

And then, you can save the data and read it from EncryptedSharedPreferences as always

In this blog, we have learned how to secure our keys with the help of AndroidKeyStore and with the help of these keys, we can secure our files and SharedPreferences. If you want some advanced encryption, you can use Tink, which is Google's open source library also used by Jetpack Security Library. It has cross-platform security that provides security for different Android versions and for different mobile devices. You can learn more about Tink from here .

Hope you learned something new today.

Source: How to encrypt data safely on the device and use the AndroidKeyStore?