I work for a place that offers an encryption suite for Android apps in the form of a .so C library to be integrated in Android apps.

The issue is that there is only two exported functions in the .so library: an encrypt function and a decrypt function. From what I know, one can simply call those two exported functions from ANY environment, not just our apps.

The idea here is to protect the encryption/decryption mechanism. Assuming that static analysis won't be possible (just humor me please :) ): Is there a way to make sure the .so library can ONLY run from our apps?

  • 3
    In cryptography, you protect the keys, not the algorithm or the implementation. So store the keys in a keystore and don't worry about who gets access to the .so. – Neil Smithline Apr 11 '18 at 14:13
  • For our implementation, we have have the key "somewhere" in the code base before pushing it to the keystore. Also, there's the process of getting the key out to use it. If there's a way to mash the keys directly to the keystore from a .so library, that would be ideal! – Solidak Apr 11 '18 at 14:18
  • 1
    I'm not confused. What does you're encryption suite do? Why do you use a static key instead of generating one securely on first use and storing it in the keystore? And do you use the same key in every .so that you ship? – Neil Smithline Apr 11 '18 at 14:25
  • Not the same key in every .so. Each app's .so has a baked in secret. We can't generate one since it is communicated with backend. That doesn't answer the question: is there a way to protect a .so library from being executed anywhere apart from the android app? – Solidak Apr 11 '18 at 14:33
  • 1
    @Solidak So every user that installs the app gets the same key? What's the point of encrypting then? – AndrolGenhald Apr 11 '18 at 14:46

If you ignore reverse engineering threat (you shouldn't), you can hide the encrypt/decrypt functions of your SO, and only let them be used from a trusted environment (see JNI_OnLoad()). E.g. you can check the package name of the application that loads your library. But just the same, you can run same checks in your encrypt() and decrypt().

Another trick is not to use the normal packaging process for the library, but unpack it manually from your APK to some location that can only be accessed from your application. This protection will not help on rooted devices.

  • Alex, the shared lib is not written to be used by TEE. Advice to check who is using the lib seems useful. – VovCA Apr 13 '18 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.