Android 密钥库的好位置

在开发Android应用程序时，密钥库（KeyStore）扮演着保护敏感信息的重要角色。密钥库是一个安全的存储空间，用于存储加密密钥、证书和其他敏感数据。那么，将密钥库存放在哪个位置是一个值得思考的问题。

java
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
keyStore.load(null);
// 生成密钥对
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_RSA, "AndroidKeyStore");
keyPairGenerator.initialize(new KeyGenParameterSpec.Builder(
        "alias", KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
        .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
        .build());
KeyPair keyPair = keyPairGenerator.generateKeyPair();
// 将密钥库存储在外部存储空间
File keyStoreFile = new File(Environment.getExternalStorageDirectory(), "myKeyStore");
FileOutputStream fos = new FileOutputStream(keyStoreFile);
keyStore.store(fos, null);

java
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
keyStore.load(null);
// 生成密钥对
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_RSA, "AndroidKeyStore");
keyPairGenerator.initialize(new KeyGenParameterSpec.Builder(
        "alias", KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
        .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
        .build());
KeyPair keyPair = keyPairGenerator.generateKeyPair();
// 将密钥库存储在云存储服务（Google Drive）
DriveResourceClient driveResourceClient = Drive.getDriveResourceClient(context, signInAccount);
Task createContentsTask = driveResourceClient.createContents();
createContentsTask.continueWithTask(task -> {
    DriveContents driveContents = task.getResult();
    OutputStream outputStream = driveContents.getOutputStream();
    keyStore.store(outputStream, null);
    MetadataChangeSet changeSet = new MetadataChangeSet.Builder()
            .setTitle("myKeyStore")
            .setMimeType("application/octet-stream")
            .build();
    return driveResourceClient.createFile(folder, changeSet, driveContents);
});