'Secure private key in AOSP
I'm working on custom AOSP build for specific hardware. One of my applications needs to access 3rd-party private key securely.
I considered following:
- to put it in source code -> bad, can be reversed
- to put it as a file with APK -> bad, someone can get hardware and, say, root it and get the key
- to keep it remotely and acquire it on first application start-up using some unique id -> complicated, needs remote storage available, secure communication, application logic needs to have additional code to do this etc.
Is there some other software or hardware way to do this? Hardware baking (theoretically, read about TEE but no idea if it is accessible for regular apps)?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|