Work / 02
CardNest Native
CardNest rebuilt natively for Android, with biometric unlock and better performance.
— Notes
The same idea as CardNest, written natively in Kotlin and Jetpack Compose. Going native made the app faster, and it opened up what a browser can’t do well, starting with biometrics.
How it works
The key setup matches the web version. A random data encryption key encrypts the cards, and a key derived from the user’s PIN encrypts that data key.
Biometric unlock adds one more wrapped copy of the data key. Turning on biometrics creates a key inside the Android Keystore, the phone’s secure key storage, which can only be used after a successful fingerprint or face check. That key never leaves the secure hardware; the app only stores the data key it encrypted.
Sync works like the web version: a separate password protects a copy of the data key, and the server only ever holds ciphertext.
Cryptography
- Key derivation: PBKDF2 with HMAC-SHA-512, 210,000 iterations, 128-bit salt, 256-bit keys.
- Encryption: AES-GCM with 256-bit keys, a 128-bit IV and a 128-bit authentication tag.
- Biometric key: AES-GCM, 256-bit, held in the Android Keystore.
The latest release is available as an APK on GitHub.