Generating a unique encryption key or salt per app installation

Question

I'm working on the topic on how to securely store sensitive data on an Android device. Of course there's no 100% secure method, I'd like to get as secure as possible.

I've read through the official recommendations.

Just as an example, I have an app that stores text (e.g. private diary). The text is stored in an xml file, which is encrypted (aes256) with a key, that is stored in the Android KeyStore.

This should mean that the data is stored securely in the encrypted xml file. A root user can still access the key from the KeyStore and decrypt it, or fetch the data once its decrypted by the app.

However, this also means that every app uses the same key. So I can install the app on my phone and use my key to decrypt xml diary files from other phones.

The question is, how do I create a key or at least the salt, that is unique per app installation?

Answer 1

The Key Derivation Function KFSs are just for this

From the Wikipedia;

In cryptography, a key derivation function (KDF) derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function.

You can use Argon2 was the winner of Password Hashing Competition.

Choose the IMEI number as one of the parameters, the user's password and a random number from the phone.