Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request.
Does Android Keystore offer anyway for the receiver of the request to verify that a specific key came from Android Keystore with a specific hardware/device ID rather than a keypair generated from OpenSSL, for example.
It doubtful that your signing protocol can convey that metadata. As far as is documented, the public key of a keypair generated in the Android keystore contains no telltale patterns that would identify it as such, nor would such a feature necessarily be desirable from a security standpoint. Finally, such metadata would itself need to authenticated to be relied upon, which creates a very complicated trust structure that would be hard to maintain. – James K Polk Nov 5 at 20:09
