Mobile App Secure Storage: Keychain and Keystore (2026 Gu...

import Foundation
import Security

/// Production-ready Keychain manager for iOS
/// Comprehensive error handling and security
class KeychainManager {
    
    enum KeychainError: LocalizedError {
        case itemNotFound
        case unexpectedData
        case unhandledError(OSStatus)
        
        var errorDescription: String? {
            switch self {
            case .itemNotFound:
                return "Keychain item not found"
            case .unexpectedData:
                return "Unexpected keychain data"
            case .unhandledError(let status):
                return "Keychain error: \(status)"
            }
        }
    }
    
    private let service: String
    
    init(service: String = Bundle.main.bundleIdentifier ?? "com.yourapp.keychain") {
        self.service = service
    }
    
    /// Store data securely in Keychain
    func store(_ data: Data, forKey key: String, accessible: String = kSecAttrAccessibleWhenUnlockedThisDeviceOnly as String) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String: accessible
        ]
        
        // Delete existing item
        SecItemDelete(query as CFDictionary)
        
        // Add new item
        let status = SecItemAdd(query as CFDictionary, nil)
        
        guard status == errSecSuccess else {
            throw KeychainError.unhandledError(status)
        }
    }
    
    /// Retrieve data from Keychain
    func retrieve(forKey key: String) throws -> Data {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        
        guard status == errSecSuccess else {
            if status == errSecItemNotFound {
                throw KeychainError.itemNotFound
            }
            throw KeychainError.unhandledError(status)
        }
        
        guard let data = result as? Data else {
            throw KeychainError.unexpectedData
        }
        
        return data
    }
    
    /// Delete data from Keychain
    func delete(forKey key: String) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key
        ]
        
        let status = SecItemDelete(query as CFDictionary)
        
        guard status == errSecSuccess || status == errSecItemNotFound else {
            throw KeychainError.unhandledError(status)
        }
    }
}

// Usage
let keychain = KeychainManager()

// Store data
let password = "secret_password".data(using: .utf8)!
try keychain.store(password, forKey: "user_password")

// Retrieve data
let retrievedPassword = try keychain.retrieve(forKey: "user_password")
print(String(data: retrievedPassword, encoding: .utf8)!)

// Delete data
try keychain.delete(forKey: "user_password")

import XCTest
@testable import YourApp

class KeychainManagerTests: XCTestCase {
    var keychain: KeychainManager!
    
    override func setUp() {
        super.setUp()
        keychain = KeychainManager(service: "test.service")
    }
    
    override func tearDown() {
        // Clean up test data
        try? keychain.delete(forKey: "test_key")
        super.tearDown()
    }
    
    func testStoreAndRetrieve() throws {
        let testData = "test_data".data(using: .utf8)!
        try keychain.store(testData, forKey: "test_key")
        let retrieved = try keychain.retrieve(forKey: "test_key")
        XCTAssertEqual(testData, retrieved)
    }
    
    func testDelete() throws {
        let testData = "test".data(using: .utf8)!
        try keychain.store(testData, forKey: "test_key")
        try keychain.delete(forKey: "test_key")
        XCTAssertThrowsError(try keychain.retrieve(forKey: "test_key"))
    }
}

// KeystoreManager.kt
// Production-ready Keystore manager for Android

import android.content.Context
import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.IvParameterSpec
import android.util.Base64

class KeystoreManager(private val context: Context) {
    
    companion object {
        private const val KEYSTORE_ALIAS = "app_keystore_key"
        private const val ANDROID_KEYSTORE = "AndroidKeyStore"
        private const val TRANSFORMATION = "AES/CBC/PKCS7Padding"
    }
    
    private val keyStore: KeyStore = KeyStore.getInstance(ANDROID_KEYSTORE).apply {
        load(null)
    }
    
    /**
     * Get or create secret key
     */
    private fun getOrCreateKey(): SecretKey {
        val existingKey = keyStore.getKey(KEYSTORE_ALIAS, null) as? SecretKey
        if (existingKey != null) {
            return existingKey
        }
        
        // Generate new key
        val keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE)
        val keyGenParameterSpec = KeyGenParameterSpec.Builder(
            KEYSTORE_ALIAS,
            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
        )
            .setBlockModes(KeyProperties.BLOCK_MODE_CBC)
            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7)
            .setKeySize(256)
            .setUserAuthenticationRequired(false) // Set to true for biometric protection
            .build()
        
        keyGenerator.init(keyGenParameterSpec)
        return keyGenerator.generateKey()
    }
    
    /**
     * Encrypt data
     */
    fun encrypt(data: ByteArray): String {
        val key = getOrCreateKey()
        val cipher = Cipher.getInstance(TRANSFORMATION)
        cipher.init(Cipher.ENCRYPT_MODE, key)
        
        val iv = cipher.iv
        val encrypted = cipher.doFinal(data)
        
        // Combine IV and encrypted data, then encode to Base64
        val encryptedWithIv = ByteArray(iv.size + encrypted.size)
        System.arraycopy(iv, 0, encryptedWithIv, 0, iv.size)
        System.arraycopy(encrypted, 0, encryptedWithIv, iv.size, encrypted.size)
        
        return Base64.encodeToString(encryptedWithIv, Base64.DEFAULT)
    }
    
    /**
     * Decrypt data
     */
    fun decrypt(encryptedData: String): ByteArray {
        val key = getOrCreateKey()
        val encryptedBytes = Base64.decode(encryptedData, Base64.DEFAULT)
        
        // Extract IV (first 16 bytes for AES)
        val iv = ByteArray(16)
        System.arraycopy(encryptedBytes, 0, iv, 0, 16)
        
        // Extract encrypted data
        val encrypted = ByteArray(encryptedBytes.size - 16)
        System.arraycopy(encryptedBytes, 16, encrypted, 0, encrypted.size)
        
        val cipher = Cipher.getInstance(TRANSFORMATION)
        val spec = IvParameterSpec(iv)
        cipher.init(Cipher.DECRYPT_MODE, key, spec)
        
        return cipher.doFinal(encrypted)
    }
    
    /**
     * Store string securely
     */
    fun storeString(key: String, value: String) {
        val encrypted = encrypt(value.toByteArray())
        context.getSharedPreferences("secure_prefs", Context.MODE_PRIVATE)
            .edit()
            .putString(key, encrypted)
            .apply()
    }
    
    /**
     * Retrieve string securely
     */
    fun getString(key: String): String? {
        val encrypted = context.getSharedPreferences("secure_prefs", Context.MODE_PRIVATE)
            .getString(key, null) ?: return null
        
        return try {
            String(decrypt(encrypted))
        } catch (e: Exception) {
            null
        }
    }
}

// Usage
val keystoreManager = KeystoreManager(context)
keystoreManager.storeString("api_key", "secret-api-key")
val retrieved = keystoreManager.getString("api_key")

//
// StorageMigration.swift
// Production-ready migration from insecure to secure storage
//

import Foundation

class StorageMigration {
    private let keychain = KeychainManager()
    private let userDefaults = UserDefaults.standard
    
    /// Migrate sensitive data from UserDefaults to Keychain
    func migrateSensitiveData() {
        let sensitiveKeys = ["user_password", "api_key", "auth_token"]
        
        for key in sensitiveKeys {
            if let value = userDefaults.string(forKey: key) {
                // Store in Keychain
                if let data = value.data(using: .utf8) {
                    try? keychain.store(data, forKey: key)
                    
                    // Remove from UserDefaults
                    userDefaults.removeObject(forKey: key)
                    print("Migrated \(key) to Keychain")
                }
            }
        }
    }
    
    /// Verify migration
    func verifyMigration() -> Bool {
        let sensitiveKeys = ["user_password", "api_key", "auth_token"]
        
        for key in sensitiveKeys {
            // Check if still in UserDefaults (should be false)
            if userDefaults.string(forKey: key) != nil {
                return false
            }
            
            // Check if in Keychain (should be true)
            if (try? keychain.retrieve(forKey: key)) == nil {
                return false
            }
        }
        
        return true
    }
}

import XCTest
@testable import YourApp

class SecureStorageTests: XCTestCase {
    var keychain: KeychainManager!
    
    override func setUp() {
        super.setUp()
        keychain = KeychainManager(service: "test.service")
    }
    
    override func tearDown() {
        try? keychain.delete(forKey: "test_key")
        super.tearDown()
    }
    
    func testStoreAndRetrieve() throws {
        let data = "test_data".data(using: .utf8)!
        try keychain.store(data, forKey: "test_key")
        let retrieved = try keychain.retrieve(forKey: "test_key")
        XCTAssertEqual(data, retrieved)
    }
    
    func testDelete() throws {
        let data = "test".data(using: .utf8)!
        try keychain.store(data, forKey: "test_key")
        try keychain.delete(forKey: "test_key")
        XCTAssertThrowsError(try keychain.retrieve(forKey: "test_key"))
    }
    
    func testMigration() {
        let migration = StorageMigration()
        migration.migrateSensitiveData()
        XCTAssertTrue(migration.verifyMigration())
    }
}

//
// Cleanup.swift
// Production-ready cleanup for secure storage
//

extension KeychainManager {
    /// Clean up test data (development only)
    func cleanupTestData() {
        let testKeys = ["test_key", "test_data", "migration_test"]
        for key in testKeys {
            try? delete(forKey: key)
        }
    }
}

// Usage
deinit {
    // In production, keys remain in Keychain for security
    // Only cleanup test data in development
    #if DEBUG
    cleanupTestData()
    #endif
}

Real-World Case Study

Challenge: A password manager app stored credentials insecurely:

• Passwords in plaintext files
• API keys in SharedPreferences (Android)
• UserDefaults (iOS) storing sensitive data
• Multiple credential theft incidents

Solution: Migrated to secure storage:

• iOS Keychain for all credentials
• Android Keystore for encryption keys
• Secure key derivation
• Biometric authentication integration
• Migration from insecure storage

Results:

• 100% secure storage migration: All sensitive data protected
• Zero credential theft: Secure storage effective
• User trust restored: Security improvements visible
• Compliance achieved: Security requirements met
• Performance maintained: Minimal overhead

FAQ

Q: What data should be stored securely?

A: Passwords, API keys, tokens, certificates, encryption keys, and any sensitive user data should use secure storage.

Q: Is Keychain/Keystore 100% secure?

A: While very secure, no system is 100% secure. Use in combination with other security measures like encryption, authentication, and monitoring.

Q: Can data be synced across devices?

A: iOS Keychain can sync via iCloud Keychain with proper configuration. Android Keystore is device-specific. Consider trade-offs between security and convenience.

Code Review Checklist for Secure Storage

Storage Implementation

• Keychain/Keystore used for sensitive data
• No sensitive data in UserDefaults/SharedPreferences
• Secure storage properly implemented
• Storage API usage correct

Data Protection

• Sensitive data identified
• All sensitive data stored securely
• Insecure storage methods removed
• Data migration completed

Key Management

• Keys stored in secure enclave where possible
• Key access controlled
• Key deletion implemented
• Key backup considered

Security

• No credentials in code
• No sensitive data in logs
• Storage access restricted
• Storage encryption enabled

Testing

• Secure storage tested
• Data retrieval tested
• Storage migration tested
• Security testing performed

Conclusion

Secure storage is essential for protecting sensitive data. Use Keychain/Keystore for all sensitive data and migrate from insecure storage methods.

Action Steps

1. Identify sensitive data
2. Implement iOS Keychain storage
3. Implement Android Keystore storage
4. Migrate from insecure storage
5. Add access controls
6. Test thoroughly
7. Monitor security

Related Topics

• Mobile App Data Encryption
• Mobile App Security Best Practices

Educational Use Only: This content is for educational purposes. Implement secure storage to protect sensitive data.