Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request.

Does Android Keystore offer anyway for the receiver of the request to verify that a specific key came from Android Keystore with a specific hardware/device ID rather than a keypair generated from OpenSSL, for example.


It doubtful that your signing protocol can convey that metadata. As far as is documented, the public key of a keypair generated in the Android keystore contains no telltale patterns that would identify it as such, nor would such a feature necessarily be desirable from a security standpoint. Finally, such metadata would itself need to authenticated to be relied upon, which creates a very complicated trust structure that would be hard to maintain. – James K Polk Nov 5 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.