Android Cryptography Security

Weak cryptographic algorithms:
Algorithms such as DES, 3DES, and MD5 may be considered weak
or unsuitable for protecting sensitive application data depending
on the context.

Hardcoded cryptographic keys:
Cryptographic keys embedded directly in application code or resources
may be extracted through reverse engineering. Hardcoded keys should
be treated as potentially exposed.

Android Keystore:
Android Keystore provides a mechanism for securely storing and using
cryptographic keys. The absence of Keystore does not automatically
constitute a vulnerability, but applications handling sensitive
cryptographic keys should be reviewed.

Runtime cryptographic evidence:
Runtime cipher events provide stronger evidence that a cryptographic
operation was actually executed. The algorithm, mode, padding,
key length, and key handling should be considered when assessing risk.

Important:
The presence of a weak algorithm or hardcoded key does not by itself
prove exploitability. The protected data and execution context must
also be considered.