这是在 apk 中包含一对密钥（公钥/私钥）的最安全方法
我正在开发一个 Android 应用程序，我必须通过一对私钥和公钥与服务器保持安全通信。在我的 apk 中存储私钥的最安全方法是什么？显然我会混淆代码，但我想要更多的安全性。我想到了以下选项：
如果我使用签署交易信息的方法创建一个本机共享库，那么该apk只需包含.so文件，并且该文件是机器代码，因此反编译可能会很困难，不是吗？是吗？
有什么想法吗？ 谢谢
I'm developing an application for android and I have to maintain a secure communication with a server through a pair of private and public key. Which is the safest way to storage the private key in my apk? Obviously I'm going to obfuscate the code but I want more security. I have thought the following option:
If I create a native share library with the methods for sign the transaction information, The apk only have to contain the .so file and this file is in machine code, so the decompilation could be difficult, isn't it?
any ideas?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
将密钥对存储在密钥库中，并将密钥库作为资源包含在您的 APK 中。 Android 倾向于使用 BouncyCastle Key Store (BKS) 格式。密钥库是专门为此目的而设计的。
请注意，您应该使用密码保护密钥库，并且您的应用程序需要知道该密码才能访问密钥库。因此，您需要向用户询问密码才能访问密钥库或将密码包含在代码中（对其进行混淆以使攻击者更难进行逆向工程）。如果有人不厌其烦地对您的应用程序进行逆向工程以恢复加密的密钥库和访问它所需的密码，那么将该密码包含在已编译的本机库中不会带来太多额外的障碍。
但是，无论如何您可能都不需要这样做。如果您的目标是保护/加密与服务器之间传输的数据，请使用 SSL/TLS。如果您不进行客户端身份验证，则您的服务器需要 SSL 证书，但您的客户端不需要；该协议负责以安全的方式为您生成加密密钥。如果您确实希望服务器对客户端进行身份验证（使您的服务器仅与您的客户端通信），您需要在您的应用程序中安装客户端 SSL 证书...这是您的私钥大概在想。
我还将向您介绍Android 平台的应用程序安全性。这本书（免责声明：我写了这本书）有一整章讨论如何设计安全的 Android 应用程序到服务器通信，并用代码示例来说明如何实现适当的保护。您可能想读一读。
Store the keypair in a keystore and include the keystore as a resource in your APK. Android tends to prefer the BouncyCastle Key Store (BKS) format. Keystores are specifically designed for this purpose.
Note that you should protect the keystore with a password and your application will need to know that password to access the keystore. So, you're left with needing to ask the user for a password to access the keystore or include the password in your code (obfuscate it to make it harder for an attacker to reverse engineer). If someone is going to the trouble of reverse engineering your application to recover your encrypted keystore and the password needed to access it, including that password in a compiled native library will not present much of an additional hurdle.
However, you may not need to do this anyway. If your goal is to protect/encrypt the data in transport to/from the server, use SSL/TLS. If you're not doing client-side authentication, your server needs an SSL certificate but your client does not; the protocol takes care of generating the encryption keys for you in a safe manner. If you do want the server to authenticate the client (make it so your server only talks to your clients), you'd need to install a client-side SSL certificate with your app ... this is the private key that you're probably thinking about.
I'll also point you to Application Security for the Android Platform. This book (disclaimer: I wrote the book) has an entire chapter talking about how to design secure Android app-to-server communications, with code examples to illustrate how to implement the appropriate protections. You may want to give it a read.
首先，为了实现客户端应用程序和服务器之间的安全通信，从概念上讲，您只需要服务器的公钥。这允许您与服务器建立单向信任关系并建立安全会话，在该会话中保证服务器的身份。
虽然上述方法当然不提供双向信任（客户端无法被服务器识别），但在大多数应用程序中建立通信通道时，实际上并不需要这种级别的信任。
如果您的要求是使用公钥/私钥向服务器提供客户端身份验证，那么事情会变得更加复杂，因为如果您将密钥放入 apk 中，无论您对其进行多少混淆（包括将其嵌入本机库中），它都只会减慢专门的恶意用户的速度。
客户端存储私钥的唯一方法是对其进行加密。但是，您也会遇到类似的问题，即在哪里存储解密密钥。最简单的解决方案是为客户端应用程序的用户生成公钥/私钥对，并要求用户提供对称加密/解密密钥（用户始终必须输入该密钥）以在每次使用时解密私钥。用户正在使用该应用程序。
另一种方法是使用某种类似于智能卡的专用加密硬件设备，它可以安全地存储私钥，但您仍然存在授权应用程序从设备读取密钥的问题（更不用说接口的复杂性了）与所述设备）。
现在，您必须问自己的问题是：“您试图阻止谁读取私钥？”（当然在回答了另一个问题之后：“您真的需要吗？客户端的公钥/私钥对”）。
First of all, in order to implement secure communication between your client application and a server, conceptually speaking, you need only the public key of the server. That allows you to establish a one-way trust relation ship with the server and to establish a secure session, in which the identity of the server is guaranteed.
While certainly the above method does not provide two-way trust (the client cannot be identified to the server), when establishing the communication channel in most applications, this level of trust is not really required.
If your requirements are to provide client authentication to the server using public/private keys then things get more complicated because if you put the key in the apk, no matter how much you obfuscate it (including embedding it in a native library) it will only slow down a dedicated nefarious user.
The only way to store the private key with the client is to encrypt it. But then you have a similar issue of where to store the decrypt key. The easiest solution is to generate a public/private key pair for the user of the client application and ask the user to provide a symmetric encryption/decryption key (which the user will always have to type in) to decrypt the private key each time the user is using the application.
The alternative would be to use some kind of dedicated cryptographic hardware device similar to a smart card that would store the private key securely but you still have the problem of authorizing your application to read the key from the device (not to mention the complication of interfacing with said device).
Now, the question you have to ask yourself is this: "Who are you trying to prevent from reading the private key?" (of course after answering the other question: "Do you really need a public/private key pair for the client").