1

I have a secret file which I cannot encrypt (because I am using it in a third party library) in an Android app which I want to protect from reverse engineering. The app will go public on Google Play store. The app can authenticate a user and later download this secret file. But as this file cannot be encrypted, is there a way where I can protect from reverse engineering?

I thought to download an encrypted version of the file and decrypt it in JNI layer to a new file and later use the new file in 3rd party library but the risk is any legit user can root the phone and gain access to the decrypted file.

Improve this question

1 Answer 1

Reset to default
4

You are out of luck here. If you want the file to be used on users phones, you will have to live with the fact that the file can be stolen. Encryption doesn't really help here, since you need to store the key somewhere on the phone. A sneaky user can just steal the key and decrypt the file themself.

You can make it more or less complicated to gain access to the file by obfuscating in various ways, but in the end you are playing a loosing game here. If the contents of the file must not be stolen, you need to rethink your architecture. Whatever is done with the file has to happend on the server side instead of on the client, so that the client no longer needs the file.

Improve this answer
2
  • Thanks for your insights. Its actually a tensorflow neural network graph which I want to use for onDevice computing.
    – HimalayanCoder
    Sep 20, 2018 at 9:08
  • @HimalayanCoder Cool! I'd say you have to choose between risking someone gets their hand on the graph, or bearing the burden of doing the calculations on your servers.
    – Anders
    Sep 20, 2018 at 10:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .