79254755

Date: 2024-12-05 12:55:33
Score: 0.5
Natty:
Report link

I know this is an old question, but there is a popular "work around" how you can overcome the limitations of Android keystore.

If you need to generate and store any key (e.g. Ed25519, secp256k1), which is not supported by keystore, the usual strategy is to make use of a symmetric wrapper key.

Example: Ed25519 key

  1. Generate Ed25519 key pair with BouncyCastle
  2. Generate master AES key using Keystore
  3. Encrypt Ed25519 private key with master AES key
  4. Save encrypted Ed25519 private key in local storage (ideally should be encrypted too) or encrypted file

Now, whenever you need to access Ed25519 private key, you need to unwrap it first using AES master key, which is held in keystore.

This is the best you can do right now, alternative would be to use 3rd party key management services (AWS KMS, Hashicorp Vault, Azure Key Vault).

Reasons:
  • Long answer (-0.5):
  • No code block (0.5):
  • Low reputation (0.5):
Posted by: Jokubas Trinkunas