Google's Changes to SecretKeyFactory API in Android
Original post Changes to SecretKeyFactory API in Android
Article Summary
Trevor Johns from Android Developer Relations reveals a breaking change that could silently corrupt encrypted data for apps using Unicode passphrases. If your app uses PBKDF2 key derivation, this affects you.
Android 4.4 KitKat introduced a subtle but critical change to SecretKeyFactory's PBKDF2WithHmacSHA1 implementation. The update fixed compliance with PKCS #5 standards by using all Unicode character bits instead of just the lower 8 bits, but this means different encryption keys are generated from the same passphrase on Android 4.4+ versus earlier versions.
Key Takeaways
- PBKDF2WithHmacSHA1 now uses full Unicode bits, breaking backward compatibility
- Only affects apps allowing Unicode characters in passphrases
- New PBKDF2WithHmacSHA1And8bit algorithm preserves old behavior for compatibility
- ASCII-only passphrases remain unaffected by the change
Apps using Unicode passphrases with PBKDF2 must implement version-specific key generation logic or risk users losing access to encrypted data after upgrading to Android 4.4+.
Continue reading
Shorebird
Aug 5, 2026
More from Google
A more reliable way to add and edit contacts on Android
Google
Oct 21, 2026
Also on Android
Stop Using FLAG_SECURE — Here's a Better Way to Protect Sensitive Screens in Jetpack Compose
PickMe
Apr 10, 2026
What This Article Covers
When Android 4.4 KitKat arrived, its SecretKeyFactory started using the full range of Unicode bits instead of just the lower 8 bits. This broke apps that had generated keys on Android 4.3 or earlier using Unicode passphrases.
Google added a new PBKDF2WithHmacSHA1And8bit algorithm to keep the old 8-bit behavior working. Developers can check Build.VERSION.SDK_INT to use version-specific key generation logic and maintain compatibility across different Android versions.
Apps that use Unicode characters in passphrases with PBKDF2 can now use the legacy algorithm on older devices and switch to the PKCS #5-compliant version on Android 4.4 and later. This prevents data corruption from mismatched key derivation.
This page summarizes “Changes to SecretKeyFactory API in Android” by Google, published Dec 12, 2013. All credit for the original work goes to the authors.
