I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone.

Let's say that this data will be kept on the phone, which is offline most of the time, and has a very small and not so frequent time-window to send the data to a remote server.

I want to secure (encrypt?) this data so that in a situation where the phone is stolen, someone with tech knowledge cannot root the phone, access the app storage and access the information.

The data doesn't need to be decrypted on the phone, so it can be sent encrypted to the server, but the server needs to be able to decrypt it there.

What are the options here? Are certificates or public/private keys suitable for this, or they are too faulty?

What are the advantages and disadvantages of each solution?

  • Please share with us findings from your own research. – Deer Hunter Apr 11 '14 at 14:46
  • Well, from a high level perspective, and as an outsider of specific security concerns, using a public key to encrypt data on the phone, and the private key kept on the server to decrypt it, seemed a good idea... But then wasn't whatsapp thinking some similar that didn't end up very well? – catteneo Apr 11 '14 at 15:01
  • That's why I need people with more experience in this matters to enlighten me ;) – catteneo Apr 11 '14 at 15:02
  • Anyone willing to contribute to the discussion? – catteneo Apr 14 '14 at 9:13

Public / private keys seems the logical way to do, but you may not want to code from scratch.

Look at how TextSecure does it: https://github.com/WhisperSystems/TextSecure/

It does all the things that your app would (encrypt data / send to web service).

You should probably use the encryption libraries / code directly from their codebase although the license (GPLv3) may be restrictive depending on your use case.

  • Thanks for the tip. I'll check TextSecure, but yeah GPLv3 might be a problem. – catteneo Apr 21 '14 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.