Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In my Android application, it's required to store the activation status of the software and keep track of the activation expire date. What is the best way to store this information?

Is it safe to store these information in the SQLite database? Otherwise, is it safe to use another way such as store these data in a file and use it? I know i can use data encryption if this would help. Alternatively, perhaps there is a better solution than any of these? What is the optimal solution for doing this?

share|improve this question

closed as off-topic by e-sushi, DrLecter, CodesInChaos, mikeazo Jan 3 at 21:03

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

3  
This question appears to be off-topic because it is about Android security, not cryptography. It might fit better on Android.SE or maybe even Security.SE. –  e-sushi Jan 3 at 14:39
    
I am not migrating this question to Security.SE, because it would be closed as a duplicate with this answer: The standard technique to circumvent license checks is to replace the conditional-jump after the check with an unconditional one (or a no-operation instruction, if the check is the other way round). –  Hendrik Brummermann Jan 4 at 16:14
add comment

1 Answer 1

up vote 2 down vote accepted

Crypto.SE is not the ideal place for this question, but I will answer this. Android keychain only stores keys and certs. You will have to manage security of activation status by your own.

If the data is sensitive DO NOT store it in the SQLite database in plain text. I can recommend two methods:

Method 1:

  • Encrypt data and store encrypted data in the SQLite database.
  • Store encryption keys in the Android keychain

Method 2:

If someone attacks your keychain and finds your encryption keys, he can decrypt the information. So you can try the following:

  • Hash the activation status and store in the DB.
  • Compare the stored hash against the hash of the new value of the activation status and do your processing.
share|improve this answer
1  
@figlesquidge Thanx for the edit :). –  deltaaruna Jan 4 at 11:01
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.