mobile-security

Mobile Security Patterns

Security best practices for Android.

Secure Storage

EncryptedSharedPreferences is dead — use Keystore directly

⚠️ Deprecated. Jetpack Security Crypto (androidx.security:security-crypto) — EncryptedSharedPreferences, EncryptedFile, MasterKey — was deprecated in 1.1.0-alpha07 (April 2025) "in favour of existing platform APIs and direct use of Android Keystore"; 1.1.0 stable (July 30, 2025) ships with the deprecation in place and no successor artifact is planned. Do not build new secure storage on it. Current approach: encrypt with an Android Keystore key and persist only IV || ciphertext in plain DataStore/SharedPreferences. Google's Tink is the maintained library if you need envelope encryption, key rotation, or deterministic AEAD.

Exclude the ciphertext store from backup/transfer as well — a Keystore key never leaves the device, so a restored blob is undecryptable garbage, and a restored plaintext pref is a leak:

<!-- targetSdk 31+ uses dataExtractionRules; allowBackup still governs pre-31 cloud backup.
     Note: on some OEMs allowBackup="false" does not disable device-to-device transfer,
     so also add explicit <exclude> rules in the rules file. -->
<application
    android:allowBackup="false"
    android:dataExtractionRules="@xml/data_extraction_rules">

Android Keystore

// Generate key in Keystore
fun generateSecretKey(alias: String) {
    val keyGenerator = KeyGenerator.getInstance(
        KeyProperties.KEY_ALGORITHM_AES,
        "AndroidKeyStore"
    )
    
    keyGenerator.init(
        KeyGenParameterSpec.Builder(alias,
            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
            .setKeySize(256)  // AndroidKeyStore's AES default is 128 - always state 256
            .setUserAuthenticationRequired(true)
            // API 30+. timeout = 0 -> auth-per-use: the key unlocks only through a
            // BiometricPrompt CryptoObject (see Biometric section below).
            // timeout > 0 -> key usable for N seconds after any auth; no CryptoObject needed.
            .setUserAuthenticationParameters(0, KeyProperties.AUTH_BIOMETRIC_STRONG)
            .setUnlockedDeviceRequired(true)  // API 28+: unusable while the screen is locked
            // New biometric enrollments invalidate the key by default
            // (setInvalidatedByBiometricEnrollment(true)) - catch KeyPermanentlyInvalidatedException
            // on Cipher.init, delete the alias, and force a full re-login.
            .build()
    )
    
    keyGenerator.generateKey()
}