title: Can we extract public/private keys from the Android Keystore?
body: <p>Regarding <a href="https://developer.android.com/training/articles/keystore" rel="noreferrer">Android Keystore system</a> article,</p>
  
  <blockquote>
    <p>Key material never enters the application process. When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be signed or verified are fed to a system process which carries out the cryptographic operations. If the app's process is compromised, the attacker may be able to use the app's keys but cannot extract their key material (for example, to be used outside of the Android device)</p>
  </blockquote>
  
  <p>So, my question is why is in <a href="https://github.com/googlesamples/android-BasicAndroidKeyStore/" rel="noreferrer">BasicAndroidKeyStore</a>, developer able to <a href="https://github.com/googlesamples/android-BasicAndroidKeyStore/blob/master/Application/src/main/java/com/example/android/basicandroidkeystore/BasicAndroidKeyStoreFragment.java#L211" rel="noreferrer">get the KeyPair object</a> and then <a href="https://github.com/googlesamples/android-BasicAndroidKeyStore/blob/master/Application/src/main/java/com/example/android/basicandroidkeystore/BasicAndroidKeyStoreFragment.java#L213" rel="noreferrer">print its public/private keys</a>?</p>
  
  <p>If developer can access the keys, how this system can be considered to be secured? It's not. If an attacker compromises the app process, he can easily retrieve the kays and use outside of the device. </p>