Securing a file from getting stolen in an Android application?

Question

I have a secret file which I cannot encrypt (because I am using it in a third party library) in an Android app which I want to protect from reverse engineering. The app will go public on Google Play store. The app can authenticate a user and later download this secret file. But as this file cannot be encrypted, is there a way where I can protect from reverse engineering?

I thought to download an encrypted version of the file and decrypt it in JNI layer to a new file and later use the new file in 3rd party library but the risk is any legit user can root the phone and gain access to the decrypted file.

Answer 1

You are out of luck here. If you want the file to be used on users phones, you will have to live with the fact that the file can be stolen. Encryption doesn't really help here, since you need to store the key somewhere on the phone. A sneaky user can just steal the key and decrypt the file themself.

You can make it more or less complicated to gain access to the file by obfuscating in various ways, but in the end you are playing a loosing game here. If the contents of the file must not be stolen, you need to rethink your architecture. Whatever is done with the file has to happend on the server side instead of on the client, so that the client no longer needs the file.