I'm using SQLite database with SQLCipher and I'm trying to figure out proper way to use KeyStore for encrypting the database passphrase.
Some threads suggests that I'd have to generate random key, encrypt it with asymmetric public key and then store it to SharedPreferences. How ever, I think it's unnecessary and my own solution would be:
- Declare random hard coded string in code.
- at runtime, create asymmetric Secret to KeyStore
- Encrypt hard coded string with asymmetric Cipher using private key from the Secret
- Convert the result to base64 string
- Use the base64 string as passphrase for database
Then unlocking is simple, just fetch the Secret from Keystore and encrypt the hard coded string and you get the passphrase as result. Anyone could see the hard coded string from source codes but it's useless without private key. Also, by using asymmetric keys we maintain support for devices below API 23. Is there any reasons why it shouldn't be implemented this way?