0

If we have data stored in encrypted format by the android app (encryption key in keystore), is it possible for the app to be the only entity capable of decrypting it to do some calculations? I am talking even the app's own user can't access the decrypted data, not even when not using the app UI to access the app like hackers do.?

Exemple : server is sending encrypted data regarding a QR code for a book. The app should decryot the QR and check if it is stored inside its local data and send a response back to the server. I don't want the QR code to be humanly accessed by the app's user through the app or any other tool even though their app can.?

Improve this question
4
  • 3
    No, this is known as the DRM problem.
    – user1937198
    Apr 19, 2020 at 13:09
  • @user1937198 I am not sure I understand. I checkd some DRM related articles and i understand it is implemented to protect intelllectual property. How is the exemple I gave affected since the user does not have access to the protected content? Also do you mean DRM exists on android by default?
    – Asma Hakim
    Apr 19, 2020 at 13:20
  • 3
    DRM covers any technique to restrict what a user can do with data on there systems. Commonly used to protect IP rights, the fundermental problems cover any form of restriction.
    – user1937198
    Apr 19, 2020 at 13:23
  • @user1937198 how would DRM affect the scenario I posted above? Does it make the QR code readable by the user even if the app tries to keep it off the UI? The encryption uses RSA for exemple. The UI of the app does not show the decrypted data but a tech_savy user can using other tools?
    – Asma Hakim
    Apr 19, 2020 at 13:27

1 Answer 1

Reset to default
2

Whenever you write software that runs on hardware you do not control (e.g. an app installed on a user's phone), you can assume that everything related to the app could be visible to the user, if the user is knowledgeable. This includes code/functionality, which can typically be decompiled, or any data received/transmitted/processed by the app, which could be dumped from memory or captured over the network.

You can certainly make it more challenging by using obfuscation, anti-RE/anti-debugging techniques, and plenty of crypto. This may be enough to foil a casual user with some basic skills, but a determined adversary will eventually bypass these measures.

Improve this answer
2
  • I see that, the data expires in 14 days or so so there is a time constraint for a hacker. Also, iPhones for exemple are known to be hard to crack. Is it due to cryptography alone?
    – Asma Hakim
    Apr 20, 2020 at 15:37
  • @AsmaHakim well, iOS is much more of a closed system compared to Android. There's just a higher barrier for entry for someone to start debugging an iPhone vs an Android phone.
    – multithr3at3d
    Apr 21, 2020 at 0:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .