Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I need to use my Android 2.3.x phone to access an OpenVPN server. I have CM 7 with built in support for OpenVPN and tun. My main concern is that I don't know where to put the keys in. If my phone gets in the wrong hands, I'm leaving the keys out in the open and I can't have that.

If I had an ICS phone, I'd have full file system encryption and I'd be safe(r). So is there an alternative or some technique I'm not aware of that can store the certificates and the key securely on the phone?

share|improve this question
add comment

2 Answers

If you maintain the OpenVPN server, you can generate keys that require a password to be used. The technique is described at http://openvpn.net/index.php/open-source/documentation/howto.html#pki.

Scroll to the section titled Generate certificates & keys for 3 clients. You will want to use the build-key-pass script to generate a password-protected key. This will prevent your key from being used maliciously if your phone falls into the wrong hands, though I am not entirely sure if CM 7's OpenVPN implementation supports it.

If you don't have the ability to use build-key-pass to generate and register your own keys, then there is really no practical way to ensure the safety of your key without full-device encryption.

share|improve this answer
    
Another option, though not as foolproof: use a remote wipe app to remotely wipe your phone if it is stolen. –  Rohan Singh Jan 24 '12 at 9:51
    
First thing any thief/finder does is get rid of the SIM card. –  sostacked Jan 25 '12 at 15:25
add comment
up vote 1 down vote accepted

OK, I've jumped the gun here and asked a question without trying things out first. The solution is simple and very secure. First, you create a PKCS12 combo-key on the server that combines the server certificate, the client certificate and key with openssl pkcs12 -export -in android.cer -inkey android.key -certfile ca.crt -name android -out certs.p12. During that you hafta issue a decrypt password. You're perfectly safe transferring that combo-key to the SD card. Next, you import that in the Android secure storage and then you can delete the PKCS12 key.

After that, you're good to go, the keys are in a password protected vault and thus inaccessible to anyone else. It goes without saying that you need to protect your phone with a unlock password.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.