KeyDroid: A Large-Scale Analysis of Secure Key Storage in Android Apps
Jenny Blessing, Ross J. Anderson, Alastair R. Beresford

TL;DR
This paper provides a comprehensive analysis of Android's hardware-backed key storage, revealing low adoption rates among apps handling sensitive data and evaluating the performance trade-offs of different trusted hardware implementations.
Contribution
It is the first large-scale survey of Android trusted hardware usage and performance, highlighting adoption gaps and practical limitations of secure elements.
Findings
56.3% of sensitive-data apps do not use trusted hardware
Only 5.03% of apps use the strongest hardware security
Hardware-backed cryptography is feasible for common operations, but not for high-security requirements
Abstract
Most contemporary mobile devices offer hardware-backed storage for cryptographic keys, user data, and other sensitive credentials. Such hardware protects credentials from extraction by an adversary who has compromised the main operating system, such as a malicious third-party app. Since 2011, Android app developers can access trusted hardware via the Android Keystore API. In this work, we conduct the first comprehensive survey of hardware-backed key storage in Android devices. We analyze 490 119 Android apps, collecting data on how trusted hardware is used by app developers (if used at all) and cross-referencing our findings with sensitive user data collected by each app, as self-reported by developers via the Play Store's data safety labels. We find that despite industry-wide initiatives to encourage adoption, 56.3% of apps self-reporting as processing sensitive user data do not use…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Security and Verification in Computing · Physical Unclonable Functions (PUFs) and Hardware Security
