Android Keystore

Security Mid-level Kotlin 2.0+ API 24+ Reviewed 31 Oct 2026 By Best Latest Apps

Fill the blank

Create an AES key that never leaves the Keystore.

fun createKey(): javax.crypto.SecretKey {
    val generator = javax.crypto.KeyGenerator.getInstance(
        android.security.keystore.KeyProperties.KEY_ALGORITHM_AES, "____")
    generator.init(
        android.security.keystore.KeyGenParameterSpec.Builder("token_key",
            android.security.keystore.KeyProperties.PURPOSE_ENCRYPT or
                android.security.keystore.KeyProperties.PURPOSE_DECRYPT)
            .setBlockModes(android.security.keystore.KeyProperties.BLOCK_MODE_GCM)
            .setEncryptionPaddings(android.security.keystore.KeyProperties.ENCRYPTION_PADDING_NONE)
            .build())
    return generator.generateKey()
}

OptionsAndroidKeyStoreBCAESKeychain

Hint 1 of 1

The provider name is one word with capitals.

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A AndroidKeyStore

Correct. That provider name puts the key in the Keystore.

Why not the others?

B BC. Bouncy Castle keys live in app memory.
C AES. That's the algorithm, not the provider.
D Keychain. That's iOS.

30-second answer

The Keystore system lets apps create cryptographic keys that can't be exported. Operations run inside a trusted environment (TEE) or a separate secure chip (StrongBox) when available, so even if an attacker gets app files, they can't copy the key. You can require user authentication, an unlocked device, or a specific purpose (encrypt, sign) for each key.

Practise saying it · 30 s. No recording, just a timer

Explain the Android Keystore.

Say your answer out loud, then check which of these points you covered:

Non-exportable keys
TEE or StrongBox
Auth-bound keys
Invalidation on new biometrics

Deep dive

setUserAuthenticationRequired(true) ties use to a recent biometric or PIN.

setIsStrongBoxBacked(true) asks for StrongBox; catch StrongBoxUnavailableException and fall back.

Keys can be invalidated when new biometrics are enrolled.

Key attestation lets a server verify a key is hardware-backed.

Encrypting with a Keystore key Compile-checked · Kotlin 2.4.21

fun encrypt(key: javax.crypto.SecretKey, plain: ByteArray): Pair<ByteArray, ByteArray> {
    val cipher = javax.crypto.Cipher.getInstance("AES/GCM/NoPadding")
    cipher.init(javax.crypto.Cipher.ENCRYPT_MODE, key)
    return cipher.iv to cipher.doFinal(plain)
}

Common mistakes

Exporting key material to a file.
Not handling KeyPermanentlyInvalidatedException after biometric changes.
Assuming StrongBox exists on every device.

Senior take & follow-ups

Mention non-exportable keys, TEE vs StrongBox, and auth-bound keys.

Follow-up questions

Think of your answer first, then open the hint.

What happens if the user adds a new fingerprint?
Show hint
Keys created with invalidation enabled become unusable and must be recreated.
What's key attestation?
Show hint
A signed certificate chain proving where and how the key was created.

Suggest a fix if something here is wrong or out of date.