MASTG-KNOW-0048: contradictory store() guidance for AndroidKeyStore + misleading KeyChain access claim #3855

MASTG Chapter

MASTG-KNOW-0048: KeyChain (Android > MASVS-STORAGE)

File Line Number

9-12

Context

While the document recommends using AndroidKeystore, it also advises saving the KeyStore to disk using the store(OutputStream, char[] password) method. However, AndroidKeyStore does not support exporting keys or using them with KeyStore.store(); this operation is only valid for file-based keystore types such as PKCS12, JKS, JCEKS, or BKS. Secondly, the statement "every application can access the materials stored in the KeyChain" is misleading. Access to credentials stored in the KeyChain is restricted by Android's permission mechanisms and user consent. Not every application can directly access all certificates and private keys. Furthermore, private keys are generally not transferred to applications as raw key material. Finally, the document does not explain the difference between KeyChain and AndroidKeyStore. Yet these two structures serve different purposes: KeyChain enables system-wide management of certificates and private keys, while AndroidKeyStore is used to securely store cryptographic keys for applications. A contextual transition between the two topics should be provided.

I would be happy to contribute to this matter