mobile-crypto-patterns

Mobile Crypto Patterns

Secure cryptographic implementation patterns for Android and iOS, covering key storage, data-at-rest encryption, transport security, and common mobile crypto pitfalls.

Knowledge Base

Platform Crypto Primitives

Mobile platforms provide hardware-backed cryptographic capabilities that should always be preferred over software-only implementations.

Android Keystore System:

• Hardware-backed key storage (TEE or StrongBox on supported devices)
• Keys never leave the secure hardware in plaintext
• Supports key use restrictions (user authentication required, time-based validity)
• Supports AES, RSA, EC, HMAC operations
• Key attestation for verifying hardware backing

iOS Secure Enclave:

• Hardware-backed key storage in dedicated security coprocessor
• Supports P-256 elliptic curve operations natively
• Keys bound to device, cannot be exported
• Biometric-gated key access through LocalAuthentication + Keychain
• CryptoKit provides modern Swift API for crypto operations

Symmetric Encryption

Recommended: AES-256-GCM (authenticated encryption, provides confidentiality + integrity)

Android implementation:

// Generate key in Keystore
val keyGenerator = KeyGenerator.getInstance(
    KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore"
)
keyGenerator.init(KeyGenParameterSpec.Builder("encryption_key",
    KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
    .setKeySize(256)
    .build())
val secretKey = keyGenerator.generateKey()

// Encrypt
val cipher = Cipher.getInstance("AES/GCM/NoPadding")
cipher.init(Cipher.ENCRYPT_MODE, secretKey)
val iv = cipher.iv // Save this with the ciphertext
val ciphertext = cipher.doFinal(plaintext)

// Decrypt
cipher.init(Cipher.DECRYPT_MODE, secretKey, GCMParameterSpec(128, iv))
val decrypted = cipher.doFinal(ciphertext)

iOS implementation:

import CryptoKit

// Generate key (for Keychain storage, wrap in SecKey)
let key = SymmetricKey(size: .bits256)

// Encrypt with AES-GCM
let sealedBox = try AES.GCM.seal(plaintext, using: key)
let combined = sealedBox.combined! // nonce + ciphertext + tag

// Decrypt
let sealedBox = try AES.GCM.SealedBox(combined: combined)
let decrypted = try AES.GCM.open(sealedBox, using: key)