Unhide the new AndroidKeyStore API.

Bug: 18088752
Change-Id: I93f87cbb1cd04a4a2e34f3d544d678c92cf052ee

12 files changed, 10 insertions, 129 deletions

diff --git a/keystore/java/android/security/CryptoOperationException.java b/keystore/java/android/security/CryptoOperationException.java
index 00c142f..1c9d005 100644
--- a/keystore/java/android/security/CryptoOperationException.java
+++ b/keystore/java/android/security/CryptoOperationException.java
@@ -25,8 +25,6 @@ package android.security;
  * permitted to throw a checked exception during operation. Because crypto operations can fail
  * for a variety of reasons after initialization, this base class provides type-safety for unchecked
  * exceptions that may be thrown in those cases.
- *
- * @hide
  */
 public class CryptoOperationException extends RuntimeException {
 
diff --git a/keystore/java/android/security/EcIesParameterSpec.java b/keystore/java/android/security/EcIesParameterSpec.java
index 0f19812..3826679 100644
--- a/keystore/java/android/security/EcIesParameterSpec.java
+++ b/keystore/java/android/security/EcIesParameterSpec.java
@@ -46,8 +46,6 @@ import javax.crypto.Mac;
  * MAC algorithm specified by {@link #getDemMacAlgorithm()} (e.g., {@code HmacSHA1} for standard
  * DEM1).</li>
  * </ul>
- *
- * @hide
  */
 public class EcIesParameterSpec implements AlgorithmParameterSpec {
 
@@ -124,6 +122,8 @@ public class EcIesParameterSpec implements AlgorithmParameterSpec {
 
     /**
      * Returns KEM EC curve name (e.g., {@code secp256r1}) or {@code null} if not specified.
+     *
+     * @hide
      */
     public String getKemCurveName() {
         return mKemCurveName;
@@ -200,6 +200,8 @@ public class EcIesParameterSpec implements AlgorithmParameterSpec {
          * Sets KEM EC curve name. For example, {@code P-256} or {@code secp256r1}.
          *
          * <p>NOTE: Only curves with cofactor of {@code 1} are supported.
+         *
+         * @hide
          */
         public Builder setKemCurveName(String name) {
             mKemCurveName = name;
diff --git a/keystore/java/android/security/KeyExpiredException.java b/keystore/java/android/security/KeyExpiredException.java
index 35a5acc..a02dc33 100644
--- a/keystore/java/android/security/KeyExpiredException.java
+++ b/keystore/java/android/security/KeyExpiredException.java
@@ -19,8 +19,6 @@ package android.security;
 /**
  * Indicates that a cryptographic operation failed because the employed key's validity end date
  * is in the past.
- *
- * @hide
  */
 public class KeyExpiredException extends CryptoOperationException {
 
diff --git a/keystore/java/android/security/KeyGeneratorSpec.java b/keystore/java/android/security/KeyGeneratorSpec.java
index 22db83e..7ecc47e 100644
--- a/keystore/java/android/security/KeyGeneratorSpec.java
+++ b/keystore/java/android/security/KeyGeneratorSpec.java
@@ -37,15 +37,13 @@ import javax.crypto.SecretKey;
  * <p>After generation, the {@code keyStoreAlias} is used with the
  * {@link java.security.KeyStore#getEntry(String, java.security.KeyStore.ProtectionParameter)}
  * interface to retrieve the {@link SecretKey}.
- *
- * @hide
  */
 public class KeyGeneratorSpec implements AlgorithmParameterSpec {
 
     private final Context mContext;
     private final String mKeystoreAlias;
     private final int mFlags;
-    private final Integer mKeySize;
+    private final int mKeySize;
     private final Date mKeyValidityStart;
     private final Date mKeyValidityForOriginationEnd;
     private final Date mKeyValidityForConsumptionEnd;
@@ -61,7 +59,7 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec {
             Context context,
             String keyStoreAlias,
             int flags,
-            Integer keySize,
+            int keySize,
             Date keyValidityStart,
             Date keyValidityForOriginationEnd,
             Date keyValidityForConsumptionEnd,
@@ -122,9 +120,9 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec {
     }
 
     /**
-     * Gets the requested key size or {@code null} if the default size should be used.
+     * Returns the requested key size or {@code -1} if default size should be used.
      */
-    public Integer getKeySize() {
+    public int getKeySize() {
         return mKeySize;
     }
 
@@ -216,8 +214,6 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec {
      * authenticators protecting access to this key.
      *
      * @see #getUserAuthenticators()
-     *
-     * @hide
      */
     public boolean isInvalidatedOnNewFingerprintEnrolled() {
         return mInvalidatedOnNewFingerprintEnrolled;
@@ -234,7 +230,7 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec {
         private final Context mContext;
         private String mKeystoreAlias;
         private int mFlags;
-        private Integer mKeySize;
+        private int mKeySize = -1;
         private Date mKeyValidityStart;
         private Date mKeyValidityForOriginationEnd;
         private Date mKeyValidityForConsumptionEnd;
@@ -460,8 +456,6 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec {
          * <p>By default, enrolling a new fingerprint does not invalidate the key.
          *
          * @see #setUserAuthenticators(Set)
-         *
-         * @hide
          */
         public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) {
             mInvalidatedOnNewFingerprintEnrolled = invalidated;
diff --git a/keystore/java/android/security/KeyNotYetValidException.java b/keystore/java/android/security/KeyNotYetValidException.java
index f1c2cac..964cd7e 100644
--- a/keystore/java/android/security/KeyNotYetValidException.java
+++ b/keystore/java/android/security/KeyNotYetValidException.java
@@ -19,8 +19,6 @@ package android.security;
 /**
  * Indicates that a cryptographic operation failed because the employed key's validity start date
  * is in the future.
- *
- * @hide
  */
 public class KeyNotYetValidException extends CryptoOperationException {
 
diff --git a/keystore/java/android/security/KeyPairGeneratorSpec.java b/keystore/java/android/security/KeyPairGeneratorSpec.java
index ed2d856..e297d26 100644
--- a/keystore/java/android/security/KeyPairGeneratorSpec.java
+++ b/keystore/java/android/security/KeyPairGeneratorSpec.java
@@ -311,8 +311,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
      * Gets the time instant before which the key pair is not yet valid.
      *
      * @return instant or {@code null} if not restricted.
-     *
-     * @hide
      */
     public Date getKeyValidityStart() {
         return mKeyValidityStart;
@@ -323,8 +321,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
      * verification.
      *
      * @return instant or {@code null} if not restricted.
-     *
-     * @hide
      */
     public Date getKeyValidityForConsumptionEnd() {
         return mKeyValidityForConsumptionEnd;
@@ -334,8 +330,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
      * Gets the time instant after which the key pair is no longer valid for encryption and signing.
      *
      * @return instant or {@code null} if not restricted.
-     *
-     * @hide
      */
     public Date getKeyValidityForOriginationEnd() {
         return mKeyValidityForOriginationEnd;
@@ -343,8 +337,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
 
     /**
      * Gets the set of purposes for which the key can be used.
-     *
-     * @hide
      */
     public @KeyStoreKeyProperties.PurposeEnum int getPurposes() {
         return mPurposes;
@@ -352,8 +344,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
 
     /**
      * Gets the set of digest algorithms with which the key can be used.
-     *
-     * @hide
      */
     public String[] getDigests() {
         return ArrayUtils.cloneIfNotEmpty(mDigests);
@@ -361,8 +351,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
 
     /**
      * Gets the set of padding schemes with which the key can be used when encrypting/decrypting.
-     *
-     * @hide
      */
     public String[] getEncryptionPaddings() {
         return ArrayUtils.cloneIfNotEmpty(mEncryptionPaddings);
@@ -370,8 +358,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
 
     /**
      * Gets the set of padding schemes with which the key can be used when signing/verifying.
-     *
-     * @hide
      */
     public String[] getSignaturePaddings() {
         return ArrayUtils.cloneIfNotEmpty(mSignaturePaddings);
@@ -379,8 +365,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
 
     /**
      * Gets the set of block modes with which the key can be used.
-     *
-     * @hide
      */
     public String[] getBlockModes() {
         return ArrayUtils.cloneIfNotEmpty(mBlockModes);
@@ -394,8 +378,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
      * weaknesses due to which ciphertext may leak information about plaintext.  For example, if a
      * given plaintext always produces the same ciphertext, an attacker may see the repeated
      * ciphertexts and be able to deduce something about the plaintext.
-     *
-     * @hide
      */
     public boolean isRandomizedEncryptionRequired() {
         return mRandomizedEncryptionRequired;
@@ -409,8 +391,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
      * restricted.
      *
      * @return user authenticators or {@code 0} if the key can be used without user authentication.
-     *
-     * @hide
      */
     public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() {
         return mUserAuthenticators;
@@ -425,8 +405,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
      *
      * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication
      *         is required for every use of the key.
-     *
-     * @hide
      */
     public int getUserAuthenticationValidityDurationSeconds() {
         return mUserAuthenticationValidityDurationSeconds;
@@ -438,8 +416,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
      * authenticators protecting access to this key.
      *
      * @see #getUserAuthenticators()
-     *
-     * @hide
      */
     public boolean isInvalidatedOnNewFingerprintEnrolled() {
         return mInvalidatedOnNewFingerprintEnrolled;
@@ -642,8 +618,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * <p>By default, the key is valid at any instant.
          *
          * @see #setKeyValidityEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityStart(Date startDate) {
             mKeyValidityStart = startDate;
@@ -658,8 +632,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * @see #setKeyValidityStart(Date)
          * @see #setKeyValidityForConsumptionEnd(Date)
          * @see #setKeyValidityForOriginationEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityEnd(Date endDate) {
             setKeyValidityForOriginationEnd(endDate);
@@ -673,8 +645,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * <p>By default, the key is valid at any instant.
          *
          * @see #setKeyValidityForConsumptionEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityForOriginationEnd(Date endDate) {
             mKeyValidityForOriginationEnd = endDate;
@@ -688,8 +658,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * <p>By default, the key is valid at any instant.
          *
          * @see #setKeyValidityForOriginationEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityForConsumptionEnd(Date endDate) {
             mKeyValidityForConsumptionEnd = endDate;
@@ -700,8 +668,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * Sets the set of purposes for which the key can be used.
          *
          * <p>This must be specified for all keys. There is no default.
-         *
-         * @hide
          */
         public Builder setPurposes(@KeyStoreKeyProperties.PurposeEnum int purposes) {
             mPurposes = purposes;
@@ -713,8 +679,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * to use the key with any other digest will be rejected.
          *
          * <p>This must be specified for keys which are used for signing/verification.
-         *
-         * @hide
          */
         public Builder setDigests(String... digests) {
             mDigests = ArrayUtils.cloneIfNotEmpty(digests);
@@ -727,8 +691,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * rejected.
          *
          * <p>This must be specified for keys which are used for encryption/decryption.
-         *
-         * @hide
          */
         public Builder setEncryptionPaddings(String... paddings) {
             mEncryptionPaddings = ArrayUtils.cloneIfNotEmpty(paddings);
@@ -741,8 +703,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * rejected.
          *
          * <p>This must be specified for RSA keys which are used for signing/verification.
-         *
-         * @hide
          */
         public Builder setSignaturePaddings(String... paddings) {
             mSignaturePaddings = ArrayUtils.cloneIfNotEmpty(paddings);
@@ -754,8 +714,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * Attempts to use the key with any other block modes will be rejected.
          *
          * <p>This must be specified for encryption/decryption keys.
-         *
-         * @hide
          */
         public Builder setBlockModes(String... blockModes) {
             mBlockModes = ArrayUtils.cloneIfNotEmpty(blockModes);
@@ -781,8 +739,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * <li>If you are using RSA encryption without padding, consider switching to padding
          * schemes which offer {@code IND-CPA}, such as PKCS#1 or OAEP.</li>
          * </ul>
-         *
-         * @hide
          */
         public Builder setRandomizedEncryptionRequired(boolean required) {
             mRandomizedEncryptionRequired = required;
@@ -802,8 +758,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          *        without user authentication.
          *
          * @see #setUserAuthenticationValidityDurationSeconds(int)
-         *
-         * @hide
          */
         public Builder setUserAuthenticators(
                 @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators) {
@@ -824,8 +778,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          *        every use of the key.
          *
          * @see #setUserAuthenticators(int)
-         *
-         * @hide
          */
         public Builder setUserAuthenticationValidityDurationSeconds(int seconds) {
             mUserAuthenticationValidityDurationSeconds = seconds;
@@ -840,8 +792,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
          * <p>By default, enrolling a new fingerprint does not invalidate the key.
          *
          * @see #setUserAuthenticators(Set)
-         *
-         * @hide
          */
         public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) {
             mInvalidatedOnNewFingerprintEnrolled = invalidated;
diff --git a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java
index 3b28045..72c485a 100644
--- a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java
+++ b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java
@@ -133,7 +133,7 @@ public abstract class KeyStoreKeyGeneratorSpi extends KeyGeneratorSpi {
                 throw new IllegalStateException("Digest algorithm must be specified for HMAC key");
             }
         }
-        int keySizeBits = (spec.getKeySize() != null) ? spec.getKeySize() : mDefaultKeySizeBits;
+        int keySizeBits = (spec.getKeySize() != -1) ? spec.getKeySize() : mDefaultKeySizeBits;
         args.addInt(KeymasterDefs.KM_TAG_KEY_SIZE, keySizeBits);
         @KeyStoreKeyProperties.PurposeEnum int purposes = spec.getPurposes();
         int[] keymasterBlockModes = KeymasterUtils.getKeymasterBlockModesFromJcaBlockModes(
diff --git a/keystore/java/android/security/KeyStoreKeyProperties.java b/keystore/java/android/security/KeyStoreKeyProperties.java
index 7f3f1a4..b1f330f 100644
--- a/keystore/java/android/security/KeyStoreKeyProperties.java
+++ b/keystore/java/android/security/KeyStoreKeyProperties.java
@@ -27,8 +27,6 @@ import java.util.Collection;
 
 /**
  * Properties of {@code AndroidKeyStore} keys.
- *
- * @hide
  */
 public abstract class KeyStoreKeyProperties {
     private KeyStoreKeyProperties() {}
diff --git a/keystore/java/android/security/KeyStoreKeySpec.java b/keystore/java/android/security/KeyStoreKeySpec.java
index 2ff1a64..a89e4dd 100644
--- a/keystore/java/android/security/KeyStoreKeySpec.java
+++ b/keystore/java/android/security/KeyStoreKeySpec.java
@@ -22,8 +22,6 @@ import java.util.Date;
 /**
  * Information about a key from the <a href="{@docRoot}training/articles/keystore.html">Android
  * KeyStore</a>.
- *
- * @hide
  */
 public class KeyStoreKeySpec implements KeySpec {
     private final String mKeystoreAlias;
diff --git a/keystore/java/android/security/KeyStoreParameter.java b/keystore/java/android/security/KeyStoreParameter.java
index a04bc6c..c24b74f 100644
--- a/keystore/java/android/security/KeyStoreParameter.java
+++ b/keystore/java/android/security/KeyStoreParameter.java
@@ -108,7 +108,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * Gets the time instant before which the key is not yet valid.
      *
      * @return instant or {@code null} if not restricted.
-     * @hide
      */
     public Date getKeyValidityStart() {
         return mKeyValidityStart;
@@ -118,8 +117,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * Gets the time instant after which the key is no long valid for decryption and verification.
      *
      * @return instant or {@code null} if not restricted.
-     *
-     * @hide
      */
     public Date getKeyValidityForConsumptionEnd() {
         return mKeyValidityForConsumptionEnd;
@@ -129,8 +126,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * Gets the time instant after which the key is no long valid for encryption and signing.
      *
      * @return instant or {@code null} if not restricted.
-     *
-     * @hide
      */
     public Date getKeyValidityForOriginationEnd() {
         return mKeyValidityForOriginationEnd;
@@ -138,8 +133,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
 
     /**
      * Gets the set of purposes for which the key can be used.
-     *
-     * @hide
      */
     public @KeyStoreKeyProperties.PurposeEnum int getPurposes() {
         return mPurposes;
@@ -147,8 +140,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
 
     /**
      * Gets the set of padding schemes with which the key can be used when encrypting/decrypting.
-     *
-     * @hide
      */
     public String[] getEncryptionPaddings() {
         return ArrayUtils.cloneIfNotEmpty(mEncryptionPaddings);
@@ -157,8 +148,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
     /**
      * Gets the set of padding schemes with which the key can be used when signing or verifying
      * signatures.
-     *
-     * @hide
      */
     public String[] getSignaturePaddings() {
         return ArrayUtils.cloneIfNotEmpty(mSignaturePaddings);
@@ -170,8 +159,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * @throws IllegalStateException if this set has not been specified.
      *
      * @see #isDigestsSpecified()
-     *
-     * @hide
      */
     public String[] getDigests() {
         if (mDigests == null) {
@@ -185,8 +172,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * specified.
      *
      * @see #getDigests()
-     *
-     * @hide
      */
     public boolean isDigestsSpecified() {
         return mDigests != null;
@@ -194,8 +179,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
 
     /**
      * Gets the set of block modes with which the key can be used.
-     *
-     * @hide
      */
     public String[] getBlockModes() {
         return ArrayUtils.cloneIfNotEmpty(mBlockModes);
@@ -209,8 +192,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * weaknesses due to which ciphertext may leak information about plaintext. For example, if a
      * given plaintext always produces the same ciphertext, an attacker may see the repeated
      * ciphertexts and be able to deduce something about the plaintext.
-     *
-     * @hide
      */
     public boolean isRandomizedEncryptionRequired() {
         return mRandomizedEncryptionRequired;
@@ -221,8 +202,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * used iff the user has authenticated to at least one of these user authenticators.
      *
      * @return user authenticators or {@code 0} if the key can be used without user authentication.
-     *
-     * @hide
      */
     public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() {
         return mUserAuthenticators;
@@ -234,8 +213,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      *
      * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication
      *         is required for every use of the key.
-     *
-     * @hide
      */
     public int getUserAuthenticationValidityDurationSeconds() {
         return mUserAuthenticationValidityDurationSeconds;
@@ -247,8 +224,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
      * authenticators protecting access to this key.
      *
      * @see #getUserAuthenticators()
-     *
-     * @hide
      */
     public boolean isInvalidatedOnNewFingerprintEnrolled() {
         return mInvalidatedOnNewFingerprintEnrolled;
@@ -321,8 +296,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * <p>By default, the key is valid at any instant.
          *
          * @see #setKeyValidityEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityStart(Date startDate) {
             mKeyValidityStart = startDate;
@@ -337,8 +310,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * @see #setKeyValidityStart(Date)
          * @see #setKeyValidityForConsumptionEnd(Date)
          * @see #setKeyValidityForOriginationEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityEnd(Date endDate) {
             setKeyValidityForOriginationEnd(endDate);
@@ -352,8 +323,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * <p>By default, the key is valid at any instant.
          *
          * @see #setKeyValidityForConsumptionEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityForOriginationEnd(Date endDate) {
             mKeyValidityForOriginationEnd = endDate;
@@ -367,8 +336,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * <p>By default, the key is valid at any instant.
          *
          * @see #setKeyValidityForOriginationEnd(Date)
-         *
-         * @hide
          */
         public Builder setKeyValidityForConsumptionEnd(Date endDate) {
             mKeyValidityForConsumptionEnd = endDate;
@@ -379,8 +346,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * Sets the set of purposes for which the key can be used.
          *
          * <p>This must be specified for all keys. There is no default.
-         *
-         * @hide
          */
         public Builder setPurposes(@KeyStoreKeyProperties.PurposeEnum int purposes) {
             mPurposes = purposes;
@@ -393,8 +358,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * rejected.
          *
          * <p>This must be specified for keys which are used for encryption/decryption.
-         *
-         * @hide
          */
         public Builder setEncryptionPaddings(String... paddings) {
             mEncryptionPaddings = ArrayUtils.cloneIfNotEmpty(paddings);
@@ -407,8 +370,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * rejected.
          *
          * <p>This must be specified for RSA keys which are used for signing/verification.
-         *
-         * @hide
          */
         public Builder setSignaturePaddings(String... paddings) {
             mSignaturePaddings = ArrayUtils.cloneIfNotEmpty(paddings);
@@ -422,8 +383,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          *
          * <p>For HMAC keys, the default is the digest specified in {@link Key#getAlgorithm()}. For
          * asymmetric signing keys this constraint must be specified.
-         *
-         * @hide
          */
         public Builder setDigests(String... digests) {
             mDigests = ArrayUtils.cloneIfNotEmpty(digests);
@@ -435,8 +394,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * Attempts to use the key with any other block modes will be rejected.
          *
          * <p>This must be specified for encryption/decryption keys.
-         *
-         * @hide
          */
         public Builder setBlockModes(String... blockModes) {
             mBlockModes = ArrayUtils.cloneIfNotEmpty(blockModes);
@@ -476,8 +433,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * <li>If you are using RSA encryption without padding, consider switching to padding
          * schemes which offer {@code IND-CPA}, such as PKCS#1 or OAEP.</li>
          * </ul>
-         *
-         * @hide
          */
         public Builder setRandomizedEncryptionRequired(boolean required) {
             mRandomizedEncryptionRequired = required;
@@ -494,8 +449,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          *        without user authentication.
          *
          * @see #setUserAuthenticationValidityDurationSeconds(int)
-         *
-         * @hide
          */
         public Builder setUserAuthenticators(
                 @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators) {
@@ -513,8 +466,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          *        every use of the key.
          *
          * @see #setUserAuthenticators(int)
-         *
-         * @hide
          */
         public Builder setUserAuthenticationValidityDurationSeconds(int seconds) {
             mUserAuthenticationValidityDurationSeconds = seconds;
@@ -529,8 +480,6 @@ public final class KeyStoreParameter implements ProtectionParameter {
          * <p>By default, enrolling a new fingerprint does not invalidate the key.
          *
          * @see #setUserAuthenticators(Set)
-         *
-         * @hide
          */
         public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) {
             mInvalidatedOnNewFingerprintEnrolled = invalidated;
diff --git a/keystore/java/android/security/NewFingerprintEnrolledException.java b/keystore/java/android/security/NewFingerprintEnrolledException.java
index 6da4a2a..806b214 100644
--- a/keystore/java/android/security/NewFingerprintEnrolledException.java
+++ b/keystore/java/android/security/NewFingerprintEnrolledException.java
@@ -19,8 +19,6 @@ package android.security;
 /**
  * Indicates that a cryptographic operation could not be performed because the key used by the
  * operation is permanently invalid because a new fingerprint was enrolled.
- *
- * @hide
  */
 public class NewFingerprintEnrolledException extends CryptoOperationException {
 
diff --git a/keystore/java/android/security/UserNotAuthenticatedException.java b/keystore/java/android/security/UserNotAuthenticatedException.java
index e6342ef..f5f5f41 100644
--- a/keystore/java/android/security/UserNotAuthenticatedException.java
+++ b/keystore/java/android/security/UserNotAuthenticatedException.java
@@ -19,8 +19,6 @@ package android.security;
 /**
  * Indicates that a cryptographic operation could not be performed because the user has not been
  * authenticated recently enough.
- *
- * @hide
  */
 public class UserNotAuthenticatedException extends CryptoOperationException {