How to protect Google Play public key when doing InApp Billing

Question

Actually this is a little bit silly about protecting public key (what is the definition of public key then?) but as per the documentation by Google:

T

Answer 1

Do at least simple text transform. The idea is that plain dex disassembling won't reveal your public key.

Here's example of function that makes simple string encoding/decoding:

/**
 * Simple String transformation by XOR-ing all characters by value.
 */
static String stringTransform(String s, int i) {
   char[] chars = s.toCharArray();
   for(int j = 0; j

Then your private key is stored in source as encoded string (encode it with this function), and decoded at runtime with same function. This is kind of "XOR" method suggested by Google.

You make the 'i' parameter yourself, anything random such as 0x27 or other will work. If you hide more strings this way, use different 'i' for each transform.