1

I have a secret file which I cannot encrypt (because I am using it in a third party library) in an Android app which I want to protect from reverse engineering. The app will go public on Google Play store. The app can authenticate a user and later download this secret file. But as this file cannot be encrypted, is there a way where I can protect from reverse engineering?

I thought to download an encrypted version of the file and decrypt it in JNI layer to a new file and later use the new file in 3rd party library but the risk is any legit user can root the phone and gain access to the decrypted file.

4

You are out of luck here. If you want the file to be used on users phones, you will have to live with the fact that the file can be stolen. Encryption doesn't really help here, since you need to store the key somewhere on the phone. A sneaky user can just steal the key and decrypt the file themself.

You can make it more or less complicated to gain access to the file by obfuscating in various ways, but in the end you are playing a loosing game here. If the contents of the file must not be stolen, you need to rethink your architecture. Whatever is done with the file has to happend on the server side instead of on the client, so that the client no longer needs the file.

  • Thanks for your insights. Its actually a tensorflow neural network graph which I want to use for onDevice computing. – HimalayanCoder Sep 20 '18 at 9:08
  • @HimalayanCoder Cool! I'd say you have to choose between risking someone gets their hand on the graph, or bearing the burden of doing the calculations on your servers. – Anders Sep 20 '18 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.