Return to Answer

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and data processing for cryptographic blobs. In Qualcomm Snapdragon and Samsung Exynos SoCs, TEE is based on ARM Trustzone. Some devices like in Pixel and iPhone have their own discrete TEE (Google's Titan M and Apple's T2 chip) which is called strongbox. Discrete TEEs are more isolated than ARM Trustzone and independent of the SoC used.

You can use android keystore provider APIs to

• generate private keys

• generate secret keys

• sign and verify data

• import encrypted keys

• authenticate user for key use

• Verify hardware-backed key pairs with Key Attestation

Every key stored within the keystore can have the following parameters set:

• alias - used to identify the key.
• key size (API 23).
• purpose – encrypt/decrypt (API 23).
• encryption mode, algorithm and padding (API 23).
• should the key be authenticated with the keystore before usage? (API 23).
• the time duration for which the key can be used after a successful authentication (API 23).
• should a key be invalidated on new fingerprint enrolment? (API 24)
• should a keystore require the screen to be unlocked before performing cryptographic operations? (API 28)
• should a key be protected by a StrongBox hardware security module? (API 28)

You can also use it to encrypt authentication tokens for login, store passwords and encrypt the key which encrypts your app's large sensitive data.

Android keystore system

How Secure is your Android Keystore Authentication? (Outdated, published before android 10 release)

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and data processing for cryptographic blobs. In Qualcomm Snapdragon and Samsung Exynos SoCs, TEE is based on ARM Trustzone. Some devices like in Pixel and iPhone have their own discrete TEE (Google's Titan M and Apple's T2 chip) which is called strongbox. Discrete TEEs are more isolated than ARM Trustzone and independent of the SoC used.

You can use android keystore provider APIs to

• generate private keys

• generate secret keys

• sign and verify data

• import encrypted keys

• authenticate user for key use

• Verify hardware-backed key pairs with Key Attestation

Every key stored within the keystore can have the following parameters set:

• alias - used to identify the key.
• key size (API 23).
• purpose – encrypt/decrypt (API 23).
• encryption mode, algorithm and padding (API 23).
• should the key be authenticated with the keystore before usage? (API 23).
• the time duration for which the key can be used after a successful authentication (API 23).
• should a key be invalidated on new fingerprint enrolment? (API 24)
• should a keystore require the screen to be unlocked before performing cryptographic operations? (API 28)
• should a key be protected by a StrongBox hardware security module? (API 28)

You can also use it to encrypt authentication tokens for login, store passwords and encrypt the key which encrypts your app's large sensitive data.

"should a key be protected by a StrongBox hardware security module? (API 28)" seem to be very important in terms of overal security level.

For android 9+, apps can set preference to store keys in strongbox by calling setIsStrongBoxBacked(true). If it throws StrongBoxUnavailableException then apps should fallback to hardware backed keystore. Strongbox is immune from critical side channel vulnerabilities in SoC's CPU which may affect hardware backed keystore. The security of hardware backed keystore falls on the chipmaker of SoC: Gaping 'hole' in Qualcomm’s Secure World mobile vault leaked sensitive data.

Hardware Security Best Practices recommend StrongBox Keymaster. The module contains the following:

• Its own CPU
• Secure storage
• A true random-number generator.
• Additional mechanisms to resist package tampering and unauthorized sideloading of apps.

Android keystore system

How Secure is your Android Keystore Authentication? (Outdated, published before android 10 release)

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and data processing for cryptographic blobs. In Qualcomm Snapdragon and Samsung Exynos SoCs, TEE is based on ARM Trustzone. Some devices like in Pixel and iPhone have their own discrete TEE (Google's Titan M and Apple's T2 chip) which is called strongbox just like iPhone's T2 chip). Discrete TEEs are more isolated than ARM Trustzone and independent of the SoC used.

You can use android keystore provider APIs to

• generate private keys

• generate secret keys

• sign and verify data

• import encrypted keys

• authenticate user for key use

• Verify hardware-backed key pairs with Key Attestation

Every key stored within the keystore can have the following parameters set:

• alias - used to identify the key.
• key size (API 23).
• purpose – encrypt/decrypt (API 23).
• encryption mode, algorithm and padding (API 23).
• should the key be authenticated with the keystore before usage? (API 23).
• the time duration for which the key can be used after a successful authentication (API 23).
• should a key be invalidated on new fingerprint enrolment? (API 24)
• should a keystore require the screen to be unlocked before performing cryptographic operations? (API 28)
• should a key be protected by a StrongBox hardware security module? (API 28)

You can also use it to encrypt authentication tokens for login, store passwords and encrypt the key which encrypts your app's large sensitive data.

Android keystore system

How Secure is your Android Keystore Authentication? (Outdated, published before android 10 release)

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and data processing for cryptographic blobs. In Qualcomm Snapdragon and Samsung Exynos SoCs, TEE is based on ARM Trustzone. Some devices like in Pixel and iPhone have their own discrete TEE (Google's Titan M and Apple's T2 chip) which is called strongbox. Discrete TEEs are more isolated than ARM Trustzone and independent of the SoC used.

You can use android keystore provider APIs to

• generate private keys

• generate secret keys

• sign and verify data

• import encrypted keys

• authenticate user for key use

• Verify hardware-backed key pairs with Key Attestation

Every key stored within the keystore can have the following parameters set:

• alias - used to identify the key.
• key size (API 23).
• purpose – encrypt/decrypt (API 23).
• encryption mode, algorithm and padding (API 23).
• should the key be authenticated with the keystore before usage? (API 23).
• the time duration for which the key can be used after a successful authentication (API 23).
• should a key be invalidated on new fingerprint enrolment? (API 24)
• should a keystore require the screen to be unlocked before performing cryptographic operations? (API 28)
• should a key be protected by a StrongBox hardware security module? (API 28)

You can also use it to encrypt authentication tokens for login, store passwords and encrypt the key which encrypts your app's large sensitive data.

Android keystore system

How Secure is your Android Keystore Authentication? (Outdated, published before android 10 release)

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and data processing for cryptographic blobs. In Qualcomm Snapdragon and Samsung Exynos SoCs, TEE is based on ARM Trustzone. Some devices like in Pixel and iPhone have their own discrete TEE (Google's Titan M and Apple's T2 chip) which is called strongbox just like iPhone's T2 chip). Discrete TEEs are more isolated than ARM Trustzone and independent of the SoC used.

You can use android keystore provider APIs to

• generate private keys

• generate secret keys

• sign and verify data

• import encrypted keys

• authenticate user for key use

• Verify hardware-backed key pairs with Key Attestation

Every key stored within the keystore can have the following parameters set:

alias - used to identify the key.
key size (API 23).
purpose – encrypt/decrypt (API 23).
encryption mode, algorithm and padding (API 23).
should the key be authenticated with the keystore before usage? (API 23).
the time duration for which the key can be used after a successful authentication (API 23).
should a key be invalidated on new fingerprint enrolment? (API 24)
should a keystore require the screen to be unlocked before performing cryptographic operations? (API 28)
should a key be protected by a StrongBox hardware security module? (API 28)

You can also use it to encrypt authentication tokens for login, store passwords and encrypt the key which encrypts your app's large sensitive data.

Android keystore system

How Secure is your Android Keystore Authentication? (Outdated, published before android 10 release)

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and data processing for cryptographic blobs. In Qualcomm Snapdragon and Samsung Exynos SoCs, TEE is based on ARM Trustzone. Some devices like in Pixel and iPhone have their own discrete TEE (Google's Titan M and Apple's T2 chip) which is called strongbox just like iPhone's T2 chip). Discrete TEEs are more isolated than ARM Trustzone and independent of the SoC used.

You can use android keystore provider APIs to

• generate private keys

• generate secret keys

• sign and verify data

• import encrypted keys

• authenticate user for key use

• Verify hardware-backed key pairs with Key Attestation

Every key stored within the keystore can have the following parameters set:

• alias - used to identify the key.
• key size (API 23).
• purpose – encrypt/decrypt (API 23).
• encryption mode, algorithm and padding (API 23).
• should the key be authenticated with the keystore before usage? (API 23).
• the time duration for which the key can be used after a successful authentication (API 23).
• should a key be invalidated on new fingerprint enrolment? (API 24)
• should a keystore require the screen to be unlocked before performing cryptographic operations? (API 28)
• should a key be protected by a StrongBox hardware security module? (API 28)

You can also use it to encrypt authentication tokens for login, store passwords and encrypt the key which encrypts your app's large sensitive data.

Android keystore system

How Secure is your Android Keystore Authentication? (Outdated, published before android 10 release)