0

I did a lot of research on how to securely create, use and backup android signing keys (when using Google Play Signing is not an option). The best option seams to be a Yubikey or a Nitrokey HSM 2 and use their pkcs11 capability [0]. Backing up those keys without trusting the computer seams kind of impossible (the keys will always be for a short time as a file on the computer).

For example if you use a Ledger device to store cryptocurrencies, you can backup your seed over the display and you do not need to trust the computer. (The same goes for recovery).

Are there any solutions, where I can create and backup a key without trusting the computer?

[0] https://geoffreymetais.github.io/code/key-signing/

Improve this question

1 Answer 1

Reset to default
1

No, and frankly the question is nonsense in my opinion.

If you don't trust the computer, you can't trust what you sign. You could be signing malware.

Set up a computer you trust. You will need it anyway to build and sign the application.

Improve this answer
2
  • Thank you, I think you have a point there, but doesn't this mean, that all those security-hardware-devices are nonsense? Just always trust your device? I think, it is also about reducing risk. If I sign something on a malicious computer, that attacker can sign one file, but if he steals the key, he can sign any number of files.
    – Alai
    Jan 15 at 17:02
  • No. Limiting exposure is a good idea. But it's possible to come to a point where the return is exceedingly small. Perform the backup using a live system without writing the key to disk if that's a worry.
    – vidarlo
    Jan 15 at 17:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .