Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 469cbf51 authored by Alex Klyubin's avatar Alex Klyubin
Browse files

Deprecate KeyChain.isBoundKeyAlgorithm. 

This is bad API. There was never a guarantee that when this method
returns true for a key algorithm (e.g., RSA or EC), then all keys of
that type will be imported into secure hardware. For example, the
secure hardware may reject a key if it's of unsupported size or uses
an unsupported public exponent or EC curve. In that case, the key
will be imported into keystore/KeyChain without being backed by secure
hardware.

Bug: 18088752
Change-Id: I8daa574a2e703a347d09d93401cd1ea2d0162ed9
parent 26689464

api/current.txt

+1 −1
Original line number Diff line number Diff line
@@ -28393,7 +28393,7 @@ package android.security { 
    method public static android.content.Intent createInstallIntent();

    method public static java.security.cert.X509Certificate[] getCertificateChain(android.content.Context, java.lang.String) throws java.lang.InterruptedException, android.security.KeyChainException;

    method public static java.security.PrivateKey getPrivateKey(android.content.Context, java.lang.String) throws java.lang.InterruptedException, android.security.KeyChainException;

    method public static boolean isBoundKeyAlgorithm(java.lang.String);

    method public static deprecated boolean isBoundKeyAlgorithm(java.lang.String);

    method public static boolean isKeyAlgorithmSupported(java.lang.String);

    field public static final java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";

    field public static final java.lang.String EXTRA_CERTIFICATE = "CERT";

api/system-current.txt

+1 −1
Original line number Diff line number Diff line
@@ -30426,7 +30426,7 @@ package android.security { 
    method public static android.content.Intent createInstallIntent();

    method public static java.security.cert.X509Certificate[] getCertificateChain(android.content.Context, java.lang.String) throws java.lang.InterruptedException, android.security.KeyChainException;

    method public static java.security.PrivateKey getPrivateKey(android.content.Context, java.lang.String) throws java.lang.InterruptedException, android.security.KeyChainException;

    method public static boolean isBoundKeyAlgorithm(java.lang.String);

    method public static deprecated boolean isBoundKeyAlgorithm(java.lang.String);

    method public static boolean isKeyAlgorithmSupported(java.lang.String);

    field public static final java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";

    field public static final java.lang.String EXTRA_CERTIFICATE = "CERT";

keystore/java/android/security/KeyChain.java

+15 −0
Original line number Diff line number Diff line
@@ -29,11 +29,13 @@ import android.os.Looper; 
import android.os.Process;

import android.os.RemoteException;

import android.os.UserHandle;

import android.security.keystore.KeyInfo;

import android.security.keystore.KeyProperties;



import java.io.ByteArrayInputStream;

import java.io.Closeable;

import java.security.InvalidKeyException;

import java.security.KeyFactory;

import java.security.Principal;

import java.security.PrivateKey;

import java.security.cert.Certificate;
@@ -442,7 +444,20 @@ public final class KeyChain { 
     * imported or generated. This can be used to tell if there is special

     * hardware support that can be used to bind keys to the device in a way

     * that makes it non-exportable.

     *

     * @deprecated Whether the key is bound to the secure hardware is known only

     * once the key has been imported. To find out, use:

     * <pre>{@code

     * PrivateKey key = ...; // private key from KeyChain

     *

     * KeyFactory keyFactory =

     *     KeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore");

     * KeyInfo keyInfo = keyFactory.getKeySpec(key, KeyInfo.class);

     * if (keyInfo.isInsideSecureHardware()) &#123;

     *     // The key is bound to the secure hardware of this Android

     * &#125;}</pre>

     */

    @Deprecated

    public static boolean isBoundKeyAlgorithm(

            @NonNull @KeyProperties.KeyAlgorithmEnum String algorithm) {

        if (!isKeyAlgorithmSupported(algorithm)) {

keystore/java/android/security/KeyStore.java

+1 −1
Original line number Diff line number Diff line
@@ -383,7 +383,7 @@ public class KeyStore { 
        }

    }



    // TODO remove this when it's removed from Settings

    // TODO: remove this when it's removed from Settings

    public boolean isHardwareBacked() {

        return isHardwareBacked("RSA");

    }