First of all, I don't have a strong background in information security and just need some basic guidelines for my question. Posted the same question on cryptography stackexchange, but this seems to be much more appropriate place.
So there are an Android application and a remote HTTP(S) server. To access the server's functionality the application needs to receive a token (generated for each individual device based on device id), and to do this app has to provide a valid API key.
We assume the communication with the server is secure and the main danger for an attack is to reverse-engineer the application. There is no 100% defense against reverse-engineering, but app's dex executable (virtual machine bytecode) is obfuscated using specialized tools.
So the question is what the best way to store the API key?
Currently I'm considering two options:
- API key is stored inside native code portion of the application, not in plain text, but encrypted with an algorithm that is very complex and thus harder to reverse engineer than VM bytecode. So I need a method to eliminate replay attack, where an attacker can just call a specific native function and get the key. We assume that all native code is black box to an attacker.
- Do not use a fixed API key at all, but use some kind of dynamic API key to authenticate on the server to receive a token. Plus implement all security-related stuff in native code.