AndroidKeystore on 4.1 API

Question

I am using AndroidKeystore as the provider in my current project to store private keys securely. Now I want to make my app available for older Android releases down to 4.1 (API version 16). Therefore I need to find an alternative for the AndroidKeystore but can hardly find any usable solution. Is there any recommendation how to implement/emulate/replace the AndroidKeystore functionality on these older versions?

Additionally the KeyPairGeneratorSpec is available since v18. What would be the correct replacement on older versions?

Magnusson

can you use BouncyCastle keystore instead ? – Robot

The AndroidKeystore is a provider for (preferrable) hardware security devices. The question is what to use instead. A plain KeyStore would be one solution. – Magnusson

I'm also incredibly flabbergasted that the support library doesn't provide backwards compatibility to Android 4.1. Seriously! I am at a loss for words. Maybe in a couple of years I'll get over it... – Bargello

Answer 1

I finally found a working solution. For Android 4.x there is the Credential Storage service which can hold various secrets. The best description I found so far is here

http://nelenkov.blogspot.de/2012/05/storing-application-secrets-in-androids.html

Magnusson

Did it worked with no issues? I read in this blog post that it is tested but not guaranteed to work. – Manly

I had no problems with it. Unfortunately there is no other "standard way" I found. So what can you do? Use and hope :-) – Magnusson