Android Keystore System
The Android Keystore System stores cryptographic keys in hardware backed secure storage instead of app memory or disk. Apps can use the keys to sign or encrypt data, but the raw key material never leaves the secure environment, even on a rooted device.
Why it exists
Apps regularly need cryptographic keys, for signing tokens, encrypting local data, or authenticating to a server, but any key sitting in regular app memory or in SharedPreferences is one root exploit or memory dump away from being stolen. The Android Keystore System exists to remove the key material from the app's reach entirely, so even a fully compromised OS cannot extract it.
The mental model
Think of it like a bank vault with a slot for documents instead of a door. You cannot walk in and take the key out, but you can slide data through the slot to be signed or encrypted with a key that stays inside, and get the result back. The app holds a reference to a key, never the key itself.
How it works
An app generates a key using KeyGenParameterSpec, specifying purpose, sign, encrypt, or both, along with constraints like requiring user authentication or setting a validity period. That request goes through the standard KeyStore API with provider AndroidKeyStore, but instead of storing bytes on the filesystem, the system routes key generation into a Trusted Execution Environment, a CPU region isolated from the main OS, or into StrongBox, a separate secure element chip on devices that include one. All actual cryptographic operations, signing, encrypting, decrypting, execute inside that isolated hardware, and only the output crosses back into the app.
When it matters
It matters for anything security sensitive: storing an auth token encryption key, protecting biometric backed credentials, or signing requests to prove device identity. The footgun is assuming Keystore alone makes data safe: if a key is generated without setUserAuthenticationRequired, it is still hardware protected from extraction but usable by any code running as that app, so it defends against key theft, not against a malicious or compromised app using its own keys.
A concrete example
A banking app generates an AndroidKeyStore backed key pair the first time a user enables biometric login, marked to require a fingerprint for every use. On future logins, the app calls Signature.sign to sign a challenge from its server, the OS prompts for a fingerprint, and only after that succeeds does the secure hardware perform the signature, meaning the private key never exists anywhere the app process, or an attacker with root, could read it directly.
Interview question
A key is generated in the Android Keystore System without calling setUserAuthenticationRequired. What does that mean for the key's security?
- a.The key still cannot be extracted from the device, but any code running as that app can use it without a biometric or lock screen promptCorrect
- b.The key is stored as plain bytes in app memory instead of secure hardware, since authentication is what triggers hardware backing
- c.The key becomes readable by any app on the device, not just the one that created it
- d.Keystore silently falls back to software only encryption whenever authentication is not required
Why? this is the answer
Hardware backed protection against key extraction and a user authentication gate are separate settings, so skipping setUserAuthenticationRequired only removes the prompt requirement, the key remains non extractable and still usable only by the owning app. It does not downgrade the key to software storage or expose it to other apps.
Just read this? Test yourself on what you have been reading.
Read the original → developer.android.com
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on android — each one lists the topics its interview covers.
See open roles