* Any entries placed in the {@code KeyStore} may be retrieved later. Note that * there is only one logical instance of the {@code KeyStore} per application * UID so apps using the {@code sharedUid} facility will also share a * {@code KeyStore}. *
* Keys may be generated using the {@link KeyPairGenerator} facility with a
* {@link KeyPairGeneratorSpec} to specify the entry's {@code alias}. A
* self-signed X.509 certificate will be attached to generated entries, but that
* may be replaced at a later time by a certificate signed by a real Certificate
* Authority.
*/
public final class KeyStoreParameter implements ProtectionParameter {
private int mFlags;
private final Date mKeyValidityStart;
private final Date mKeyValidityForOriginationEnd;
private final Date mKeyValidityForConsumptionEnd;
private final @KeyStoreKeyConstraints.PurposeEnum Integer mPurposes;
private final @KeyStoreKeyConstraints.AlgorithmEnum Integer mAlgorithm;
private final @KeyStoreKeyConstraints.PaddingEnum Integer mPadding;
private final @KeyStoreKeyConstraints.DigestEnum Integer mDigest;
private final @KeyStoreKeyConstraints.BlockModeEnum Integer mBlockMode;
private final Integer mMinSecondsBetweenOperations;
private final Integer mMaxUsesPerBoot;
private final Set
* This will build protection parameters for use with the
* Android KeyStore
* facility.
*
* This can be used to require that KeyStore entries be stored encrypted.
*
* Example:
*
* By default, the key can be used for encryption, decryption, signing, and verification.
*
* @hide
*/
public Builder setPurposes(@KeyStoreKeyConstraints.PurposeEnum int purposes) {
mPurposes = purposes;
return this;
}
/**
* Sets the algorithm of the key.
*
* The algorithm of symmetric keys can be deduced from the key itself. Thus, explicitly
* specifying the algorithm of symmetric keys using this method is not necessary.
*
* @hide
*/
public Builder setAlgorithm(@KeyStoreKeyConstraints.AlgorithmEnum int algorithm) {
mAlgorithm = algorithm;
return this;
}
/**
* Restricts the key to being used only with the provided padding scheme. Attempts to use
* the key with any other padding will be rejected.
*
* This restriction must be specified for keys which are used for encryption/decryption.
*
* @hide
*/
public Builder setPadding(@KeyStoreKeyConstraints.PaddingEnum int padding) {
mPadding = padding;
return this;
}
/**
* Restricts the key to being used only with the provided digest when generating signatures
* or Message Authentication Codes (MACs). Attempts to use the key with any other digest
* will be rejected.
*
* For MAC keys, the default is to restrict to the digest specified in the key algorithm
* name. For asymmetric signing keys this constraint must be specified because there is no
* default.
*
* @see java.security.Key#getAlgorithm()
*
* @hide
*/
public Builder setDigest(@KeyStoreKeyConstraints.DigestEnum int digest) {
mDigest = digest;
return this;
}
/**
* Restricts the key to being used only with the provided block mode when encrypting or
* decrypting. Attempts to use the key with any other block modes will be rejected.
*
* This restriction must be specified for keys which are used for encryption/decryption.
*
* @hide
*/
public Builder setBlockMode(@KeyStoreKeyConstraints.BlockModeEnum int blockMode) {
mBlockMode = blockMode;
return this;
}
/**
* Sets the minimum number of seconds that must expire since the most recent use of the key
* before it can be used again.
*
* By default, there is no restriction on how frequently a key can be used.
*
* @hide
*/
public Builder setMinSecondsBetweenOperations(int seconds) {
mMinSecondsBetweenOperations = seconds;
return this;
}
/**
* Sets the maximum number of times a key can be used without rebooting the device.
*
* By default, the key can be used for an unlimited number of times.
*
* @hide
*/
public Builder setMaxUsesPerBoot(int count) {
mMaxUsesPerBoot = count;
return this;
}
/**
* Sets the user authenticators which protect access to this key. The key can only be used
* iff the user has authenticated to at least one of these user authenticators.
*
* By default, the key can be used without user authentication.
*
* @param userAuthenticators user authenticators or empty list if this key can be accessed
* without user authentication.
*
* @see #setUserAuthenticationValidityDurationSeconds(int)
*
* @hide
*/
public Builder setUserAuthenticators(Set By default, the user needs to authenticate for every use of the key.
*
* @param seconds duration in seconds or {@code 0} if the user needs to authenticate for
* every use of the key.
*
* @see #setUserAuthenticators(Set)
*
* @hide
*/
public Builder setUserAuthenticationValidityDurationSeconds(int seconds) {
mUserAuthenticationValidityDurationSeconds = seconds;
return this;
}
/**
* Sets whether this key must be invalidated (permanently) whenever a new fingerprint is
* enrolled. This only has effect if fingerprint reader is one of the user authenticators
* protecting access to the key.
*
* By default, enrolling a new fingerprint does not invalidate the key.
*
* @see #setUserAuthenticators(Set)
*
* @hide
*/
public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) {
mInvalidatedOnNewFingerprintEnrolled = invalidated;
return this;
}
/**
* Builds the instance of the {@code KeyStoreParameter}.
*
* @throws IllegalArgumentException if a required field is missing
* @return built instance of {@code KeyStoreParameter}
*/
public KeyStoreParameter build() {
return new KeyStoreParameter(mFlags,
mKeyValidityStart,
mKeyValidityForOriginationEnd,
mKeyValidityForConsumptionEnd,
mPurposes,
mAlgorithm,
mPadding,
mDigest,
mBlockMode,
mMinSecondsBetweenOperations,
mMaxUsesPerBoot,
mUserAuthenticators,
mUserAuthenticationValidityDurationSeconds,
mInvalidatedOnNewFingerprintEnrolled);
}
}
}
* KeyStoreParameter params = new KeyStoreParameter.Builder(mContext)
* .setEncryptionRequired()
* .build();
*
*/
public final static class Builder {
private int mFlags;
private Date mKeyValidityStart;
private Date mKeyValidityForOriginationEnd;
private Date mKeyValidityForConsumptionEnd;
private @KeyStoreKeyConstraints.PurposeEnum Integer mPurposes;
private @KeyStoreKeyConstraints.AlgorithmEnum Integer mAlgorithm;
private @KeyStoreKeyConstraints.PaddingEnum Integer mPadding;
private @KeyStoreKeyConstraints.DigestEnum Integer mDigest;
private @KeyStoreKeyConstraints.BlockModeEnum Integer mBlockMode;
private Integer mMinSecondsBetweenOperations;
private Integer mMaxUsesPerBoot;
private Set