compact-engine/com.midnight.kuira.core.compact.state/KeyStorePrivateStateProvider

KeyStorePrivateStateProvider

class KeyStorePrivateStateProvider(context: Context) : PrivateStateProvider

Encrypts dApp private state using Android KeyStore + AES-256-GCM.

Data is stored in SharedPreferences as Base64-encoded ciphertext. The encryption key lives in Android KeyStore (never leaves secure hardware).

Single key design: All dApp state shares one KeyStore alias. This is intentional — Android KeyStore is the trust boundary, not individual aliases. An attacker with KeyStore access can read all aliases equally. Per-contract keys would add complexity without meaningful security benefit.

Storage layout:

Pref file: "kuira_private_state"
Key format: "{len}:{contractAddress}:{stateId}" (length-prefixed, collision-safe)
Value format: Base64(ivLen(1) + IV + ciphertext + GCM tag)