 <p>Your plan sounds good to me except storing keys inside the keystore. Basically, there is only one keystore instance created for all system-level and third-party apps on the device. After Android 4.0, the keystore is integrated with the unlock screen and it is unlocked when the user unlocked the device. So, if you store your key as a key/value pair inside the keystore, then your key is ready before you open your app. Or, if you store it as key/encrypted(value) pair, then you have to derive the key from the password at run-time and decrypt the encrypted value. But you may end up having two password for unlocking the phone screen and unlocking the key. I probably go with with only one password, i.e. screen unlock password. Since the keystore is mapped to the Process ID, it is only accessed from your app. However, if you are thinking to handle multi-user per phone, then the latter approach may be relevant.</p>