Mobile Security: Keystore, Cryptography & Biometrics

Software-based encryption keys stored in RAM or app files are vulnerable to memory dump attacks on rooted devices. To provide military-grade security, Android introduces the Android Keystore System, backed by dedicated hardware isolation:

• Trusted Execution Environment (TEE): A secure, isolated subsystem running alongside the main application processor (ARM TrustZone) with its own dedicated secure operating system.
• StrongBox Keymaster (Android 9+ / API 28): A physically isolated hardware security module (HSM) with dedicated CPU, true random number generator (TRNG), tamper-resistant packaging, and secure storage (e.g. Google Titan M2 chip on Pixel devices).

The Non-Exportability Guarantee: Cryptographic keys generated inside the Android Keystore can never be extracted from the secure hardware. When an app performs encryption or decryption, the plaintext is passed into the TEE/StrongBox, the hardware chip executes the AES-256-GCM cipher internally, and only the ciphertext or plaintext result is returned to user space. Even if an attacker gains full Linux root access to the device kernel, the private keys remain unextractable!

Standard SharedPreferences write keys and values as unencrypted cleartext XML files at /data/data/<package>/shared_prefs/. Anyone with a rooted device or ADB backup can read stored passwords and authentication tokens directly.

EncryptedSharedPreferences (part of Jetpack Security, powered by Google's audited cryptographic library Tink) wraps standard SharedPreferences with automatic hardware encryption:

• Keys: Deterministically encrypted using AES-256-SIV (Synthetic Initialization Vector), meaning keys cannot be read, but lookups remain O(1) fast.
• Values: Authenticated and encrypted using AES-256-GCM (Galois/Counter Mode), preventing both eavesdropping and unauthorized tampering.

object SecureStorageManager {
    private const val PREFS_FILE = "devascent_secure_prefs"

    fun getEncryptedPrefs(context: Context): SharedPreferences {
        // 1. Generate or retrieve hardware-backed MasterKey in Android Keystore
        val masterKey = MasterKey.Builder(context)
            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
            .build()

        // 2. Instantiate EncryptedSharedPreferences
        return EncryptedSharedPreferences.create(
            context,
            PREFS_FILE,
            masterKey,
            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
        )
    }

    fun saveAuthToken(context: Context, token: String) {
        getEncryptedPrefs(context).edit()
            .putString("auth_jwt_token", token)
            .apply()
    }
}

Introduced in Android 7.0 (API 24), the Network Security Config file lets apps customize network security declarations without modifying Kotlin networking code:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Prohibit cleartext HTTP across the entire application -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <!-- Trust ONLY official system CAs; ignore user-installed proxy certs -->
            <certificates src="system" />
        </trust-anchors>
    </base-config>
</network-security-config>

Many applications simply ask the biometric scanner for a boolean: "Did the user authenticate? Yes/No". On a rooted device, an attacker using instrumentation frameworks like Frida can hook the callback function and force-return true to bypass authentication entirely!

The Secure Solution: BiometricPrompt.CryptoObject:
Instead of relying on a naive boolean check, the Android Keystore key is configured to require user authentication (setUserAuthenticationRequired(true)). The app instantiates an uninitialized Cipher and wraps it inside a BiometricPrompt.CryptoObject. The Android hardware chip will physically refuse to unlock the cryptographic key until the fingerprint or face authentication succeeds in the TEE:

fun authenticateWithBiometrics(
    activity: FragmentActivity,
    cryptoObject: BiometricPrompt.CryptoObject,
    onSuccess: (Cipher) -> Unit
) {
    val executor = ContextCompat.getMainExecutor(activity)

    val prompt = BiometricPrompt(activity, executor, object : BiometricPrompt.AuthenticationCallback() {
        override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
            // Cipher is now physically unlocked by the TEE hardware
            result.cryptoObject?.cipher?.let(onSuccess)
        }
    })

    val promptInfo = BiometricPrompt.PromptInfo.Builder()
        .setTitle("Biometric Security Verification")
        .setSubtitle("Confirm your identity to decrypt sensitive credentials.")
        .setAllowedAuthenticators(BiometricManager.Authenticators.BIOMETRIC_STRONG)
        .setNegativeButtonText("Cancel")
        .build()

    prompt.authenticate(promptInfo, cryptoObject)
}

Standard Room database SQLite files reside as unencrypted binary records at /data/data/<package>/databases/app.db. SQLCipher is an extension providing transparent, 256-bit AES full-database file encryption:

val passphrase = SecureStorageManager.getDatabasePassphrase()
val factory = SupportFactory(passphrase) // SQLCipher OpenHelperFactory

val encryptedDb = Room.databaseBuilder(
    context,
    DevAscentDatabase::class.java,
    "secure_devascent.db"
)
    .openHelperFactory(factory) // Injects SQLCipher transparent 256-bit AES encryption
    .build()