3

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone.

Let's say that this data will be kept on the phone, which is offline most of the time, and has a very small and not so frequent time-window to send the data to a remote server.

I want to secure (encrypt?) this data so that in a situation where the phone is stolen, someone with tech knowledge cannot root the phone, access the app storage and access the information.

The data doesn't need to be decrypted on the phone, so it can be sent encrypted to the server, but the server needs to be able to decrypt it there.

What are the options here? Are certificates or public/private keys suitable for this, or they are too faulty?

What are the advantages and disadvantages of each solution?

Improve this question
4
  • Please share with us findings from your own research.
    – Deer Hunter
    Apr 11, 2014 at 14:46
  • Well, from a high level perspective, and as an outsider of specific security concerns, using a public key to encrypt data on the phone, and the private key kept on the server to decrypt it, seemed a good idea... But then wasn't whatsapp thinking some similar that didn't end up very well?
    – catteneo
    Apr 11, 2014 at 15:01
  • That's why I need people with more experience in this matters to enlighten me ;)
    – catteneo
    Apr 11, 2014 at 15:02
  • Anyone willing to contribute to the discussion?
    – catteneo
    Apr 14, 2014 at 9:13

1 Answer 1

Reset to default
1

Public / private keys seems the logical way to do, but you may not want to code from scratch.

Look at how TextSecure does it: https://github.com/WhisperSystems/TextSecure/

It does all the things that your app would (encrypt data / send to web service).

You should probably use the encryption libraries / code directly from their codebase although the license (GPLv3) may be restrictive depending on your use case.

Improve this answer
1
  • Thanks for the tip. I'll check TextSecure, but yeah GPLv3 might be a problem.
    – catteneo
    Apr 21, 2014 at 11:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .