Securing Sensitive Data Android Keystore vs Whitebox Cryptography
summary
Argues that cryptographic keys must never be in the clear because static and dynamic analysis extract them; hardware options include secure elements (embedded in about one third of Android phones in 2019) or TEEs, while the Android Keystore behavior varies by device and can still expose cleartext at app entry/exit. Describes whitebox cryptography as a pure‑software solution used in payments to deliver equivalent security, enable universal deployment across phones, and a Pace third‑generation product that successfully protects IP and licensing without hardware.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 2:00Why cryptographic keys need protection
- 6:40Reverse engineering threats to apps
- 7:22Secure elements overview
- 10:15Android Keystore explained
- 13:26Android Keystore limitations
- 14:33Whitebox cryptography introduction
- 16:18Whitebox in payments industry
- 17:45Pace’s whitebox solution
- 19:10Summary and closing
