Securing App Secrets: Hardware-Backed Cryptography and the Android Keystore

Your app may encrypt sensitive user data, but if the decryption keys are not securely stored, attackers can extract them directly from memory. While Android has offered secure, hardware-backed Keystore cryptography since API 24, software-based encryption remains the default, meaning developers may adopt it without further consideration. In this session, we will demonstrate how attackers use tools like Frida to extract keys from memory, and how the Android Keystore prevents it.You will learn about the performance overhead of Keystore operations and practical techniques to mitigate it. We will also share insights from real-world devices showing that Keystore operations are prone to unexpected failures, emphasizing the need to handle exceptions gracefully and designing recovery mechanisms to ensure app stability. Finally, we cover additional ways to secure your keys, such as requiring biometric authentication, and verifying hardware backing via key attestation.