title: Android In App Billing: securing application public key
body: <p>From Android In App Billing version 3 (TrivialDrive)sample application coming with sdk</p>
  
  <h3>MainActivity.java</h3>
  
  <pre><code>/* base64EncodedPublicKey should be YOUR APPLICATION'S PUBLIC KEY
   * (that you got from the Google Play developer console). This is not your
   * developer public key, it's the *app-specific* public key.
   *
   * Instead of just storing the entire literal string here embedded in the
   * program,  construct the key at runtime from pieces or
   * use bit manipulation (for example, XOR with some other string) to hide
   * the actual key.  The key itself is not secret information, but we don't
   * want to make it easy for an attacker to replace the public key with one
   * of their own and then fake messages from the server.
   */
  String base64EncodedPublicKey = "CONSTRUCT_YOUR_KEY_AND_PLACE_IT_HERE";
  </code></pre>
  
  <p>Well I am not sure I understand this security measure. I know how to get the application public key (which is already base 64 encoded) from Google Play Developer Console. </p>
  
  <p>What I am not understanding is this part</p>
  
  <pre><code> /* Instead of just storing the entire literal string here embedded in the
   * program,  construct the key at runtime from pieces or
   * use bit manipulation (for example, XOR with some other string) to hide
   * the actual key
   */
  </code></pre>
  
  <p>As far as I know, this public key is a constant string, which is given from Google during application upload process. </p>
  
  <p>How can we create the same key programmatically using any bit manipulation process? Has someone done it before? Is there any sample code on how to do this?</p>