Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Device Security Overview

The crypto module provides building blocks for protecting secrets on a device. This page states what the SDK does today; each page below gives the exact API.

AreaWhat existsPage
Key storageProvider: an AES-256 master key (alias aduki_master) in the Android Keystore, with a software fallback off AndroidKeystore
EncryptionEnvelope: AES-256-GCM with a random 12-byte IV per messageCipher
Memorywipe(), Guard: overwrite secrets after useSanitization
TransportOpt-in SPKI certificate pinning with your own pins (none shipped), TLS 1.3/1.2 connection specTLS
Device keysdpop.Key: sign-only device keys for DPoPDPoP

What is not done for you

  • The SDK does not encrypt the local ObjectBox database as a whole; it seals personal text columns (Vault) and leaves structural metadata (ids, flags, timestamps, counters) in the clear. The Android Keystore part ran on an emulator (software-backed keys); hardware backing is unverified.
  • Access and refresh tokens are held in memory only; the core SDK never writes them to disk. The optional Android module stores them sealed (Vault) in AccountManager for the account switcher.
  • The SDK does not request StrongBox; the Keystore key is generated with the platform default (hardware-backed where the device provides it).