Security Assets and Cryptographic Keys
Security Assets
APKdefender injects several security assets to the protected application. Some of these are not really secrets but hashes detected at the time of protection to prevent the modification of the app.
All of these assets are automatically stored in the protection library and do not need any extra attention from the developer.
| Security Asset. | Usage |
|---|---|
| Original application id | Used to prevent lifting and cloning attacks |
| Signing certificate hashes | Prevent repackaging and tampering |
| Protection library code hash | Prevent modifications to protection library (in addition to full apk tampering check) |
| Hashes of the protected dex files | Prevent modifications to bytecode (in addition to full apk tampering check) |
| List of allowed installers | Limiting installations from defined app stores only |
Cryptographical keys
The following cryptographic keys gets injected to application at the time of protection
| Algorithm | AES |
| Size | 256 bits |
| Mode | CBC |
| Purpose | Decrypt |
| Creation | Unique for each protection |
| Storage | Cryptovar inside protection library |
| Usage |
|
Each encrypted entity has a random IV assigned at the time of protection. Cryptovar storage means an obfuscated construct that is plaintext only when actively used and otherwise stays obfuscated.
In addition to these, some non-cryptographic strength obfuscation keys are used.