I am writing an Android application that needs to verify that a request is sent from a trusted party (me).
This is my current solution:
- Generate ECDSA public key / private key from a server.
- Store private key in server. Store public key in Android app, hard-coding it as a
static final String.
- Deploy Android application.
Request some action from server to Android app:
- Server requests a challenge message to the Android app.
- Android app creates a random String and sends it to server.
- Server signs random String with private key and sends it to Android app.
- Android app verifies signature from server, if signature is verified, perform some action.
From what I understand, it is easy to reveal the server's public key by decompiling the APK. Then it seems pretty easy for the attacker to recompile the APK with the attacker's own public key, rather than the server's key.
If my understanding is correct, how can I securely store the server's public key so that an attacker cannot modify it?