Storing Encryption Key in Application

Question

I need some string values in my app that I don't want to hard code (one of those in the public key for network communication). So I made a encrypted version using AES algorithm. Now whenever I need the original stringm I need to use my key for decryption, so where should I store this key? It doesn't seem logical to store it as an hard coded string, and I don't want to store my key on the server. What should I do?

Answer 1

A good way to encrypt and decrypt stuff in your app without hardcoding pwds in the code is using PIN protection screen on the app. Doing this you can derive a final key to encrypt sensitive data and with the same key decrypt everything. Hope this idea will help you to figure out what do you have to do.

Answer 2

You can use JCA. Use its Password-Based Encryption. This way you do not have to store your key any where. Whenever you need to decrypt the data, type your password and you are good to go.

http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html#PBEEx

Note: The same salt and iteration count that are used for encryption must be used for decryption.