title: Android credential storage: Where to save private keys?
body: <p>My application contains secure content that I want to encrypt. I want to <strong>store the secret key locally</strong>(Mostly because my users do not use any authentication mechanism for login). </p>
  
  <p>Those are the solutions that I found from Android</p>
  
  <ul>
  <li><a href="https://developer.android.com/training/articles/keystore.html#SecurityFeatures" rel="nofollow noreferrer">Android Keystore System</a>: it sounds like the perfect solution, it significantly increase the security of locally stored keys, but it only offers encryption protocols for APIS 18+ while my app needs to support API 14.</li>
  <li><a href="http://developer.android.com/reference/android/security/KeyChain.html" rel="nofollow noreferrer">KeyChain API</a>: It mostly help sharing security keys between apps, it also require user involvement in selecting certificate chains.</li>
  <li><p>From Android <a href="http://developer.android.com/google/play/billing/billing_best_practices.html#key" rel="nofollow noreferrer">Security and Design</a>, how to save Android public key:</p>
  
  <blockquote>
    <p>To keep your public key safe from malicious users and hackers, do not
    embed it in any code as a literal string. Instead, construct the
    string at runtime from pieces or use bit manipulation (for example,
    XOR with some other string) to hide the actual key. The key itself is
    not secret information, but you do not want to make it easy for a
    hacker or malicious user to replace the public key with another key.</p>
  </blockquote>
  
  <p>While it sounds like a good tip, it doesn't really add much to security.</p></li>
  </ul>
  
  <h2>So what is the best practice of saving private keys without asking for user authentication?</h2>