[Security Enhancement] Android: Enable StrongBox (Api 28 and Newer)

[brian-weasner]

Your Environment

• Plugin version: 4.1.3
• Platform: Android
• Device OS version: 9 (API level 28) and Newer

Context

Newer Android devices have secure chips (like Titan M on Google Pixel 3) that can and should be used for Secure storage of Keys. It looks like this plugin is not currently implementing StrongBox for KeyStorage, but probably should be.

When generating or importing keys using the KeyStore class, you indicate a preference for storing the key in the StrongBox Keymaster by passing true to the setIsStrongBoxBacked() method.

Resources

• Stackoverflow: How is the android keystore system secure
• Keystore Hardware Security
• Difference Between StrongBox and Hardware Backed Keys