Android Keystore System.

Android's hardware-backed key container that confines cryptographic key material to a Trusted Execution Environment or StrongBox, exposing keys only by reference and enforcing per-key access policies such as biometric or device-credential gating. 它属于网络安全的 移动安全 分类。

Android's hardware-backed key container that confines cryptographic key material to a Trusted Execution Environment or StrongBox, exposing keys only by reference and enforcing per-key access policies such as biometric or device-credential gating.

The Android Keystore System is Android's primary API for hardware-protected key material, available via `android.security.keystore` and `KeyGenParameterSpec`. When the device supports it, keys are generated and stored inside a Trusted Execution Environment (TEE — typically ARM TrustZone) or, on devices with a discrete StrongBox security chip (e.g. Pixel Titan M), inside that chip. Application code receives only opaque key references; the actual key material never enters the Android Linux kernel or app memory. Per-key policies enforced by the keystore include user-authentication-required (biometric or device credential), validity duration after authentication, attestation-required, and unlocked-device-required. Key Attestation (`KeyMint`/`Keymaster`) lets a server verify that a given public key was generated inside a real TEE/StrongBox on a Google-attested device, which is the basis for hardware-bound mobile FIDO2 / WebAuthn passkeys. Common AppSec issues include not setting `setUserAuthenticationRequired` for sensitive keys, not setting `setInvalidatedByBiometricEnrollment(true)` (so enrolling a new fingerprint silently keeps the key valid), and bypassing the keystore entirely by holding raw keys in SharedPreferences.

针对 Android Keystore System 的防御通常结合技术控制与运营实践,详见上方完整定义。

常见的别称包括: AndroidKeystore, KeyStore (Android)。