Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d5443f3 authored by Alex Klyubin's avatar Alex Klyubin
Browse files

Define String constants for AndroidKeyStore crypto. 

This defines the String enum values based on JCA standard names for
key algorithm, block mode, padding schemes, and digests. This should
make it safer to interact with AndroidKeyStore code that uses JCA
strings. This was requested by API Council.

Bug: 18088752
Change-Id: I241d9225a13b85479d0a84e49d0a98cbc77e5817
parent 6223ec12

api/current.txt

+55 −0
Original line number Diff line number Diff line
@@ -28742,6 +28742,53 @@ package android.security { 
  public abstract class KeyStoreKeyProperties {

  }













  public static abstract class KeyStoreKeyProperties.Algorithm {













    field public static final java.lang.String AES = "AES";













    field public static final java.lang.String EC = "EC";













    field public static final java.lang.String HMAC_SHA1 = "HmacSHA1";













    field public static final java.lang.String HMAC_SHA224 = "HmacSHA224";













    field public static final java.lang.String HMAC_SHA256 = "HmacSHA256";













    field public static final java.lang.String HMAC_SHA384 = "HmacSHA384";













    field public static final java.lang.String HMAC_SHA512 = "HmacSHA512";













    field public static final java.lang.String RSA = "RSA";













  }

























  public static abstract class KeyStoreKeyProperties.AlgorithmEnum implements java.lang.annotation.Annotation {













  }

























  public static abstract class KeyStoreKeyProperties.BlockMode {













    field public static final java.lang.String CBC = "CBC";













    field public static final java.lang.String CTR = "CTR";













    field public static final java.lang.String ECB = "ECB";













    field public static final java.lang.String GCM = "GCM";













  }

























  public static abstract class KeyStoreKeyProperties.BlockModeEnum implements java.lang.annotation.Annotation {













  }

























  public static abstract class KeyStoreKeyProperties.Digest {













    field public static final java.lang.String MD5 = "MD5";













    field public static final java.lang.String NONE = "NONE";













    field public static final java.lang.String SHA1 = "SHA-1";













    field public static final java.lang.String SHA224 = "SHA-224";













    field public static final java.lang.String SHA256 = "SHA-256";













    field public static final java.lang.String SHA384 = "SHA-384";













    field public static final java.lang.String SHA512 = "SHA-512";













  }

























  public static abstract class KeyStoreKeyProperties.DigestEnum implements java.lang.annotation.Annotation {













  }

























  public static abstract class KeyStoreKeyProperties.EncryptionPadding {













    field public static final java.lang.String NONE = "NoPadding";













    field public static final java.lang.String PKCS7 = "PKCS7Padding";













    field public static final java.lang.String RSA_OAEP = "OAEPPadding";













    field public static final java.lang.String RSA_PKCS1 = "PKCS1Padding";













  }

























  public static abstract class KeyStoreKeyProperties.EncryptionPaddingEnum implements java.lang.annotation.Annotation {













  }



























  public static abstract class KeyStoreKeyProperties.Origin {















    field public static final int GENERATED = 1; // 0x1















    field public static final int IMPORTED = 2; // 0x2









@@ -28761,6 +28808,14 @@ package android.security {













  public static abstract class KeyStoreKeyProperties.PurposeEnum implements java.lang.annotation.Annotation {















  }



























  public static abstract class KeyStoreKeyProperties.SignaturePadding {













    field public static final java.lang.String RSA_PKCS1 = "PKCS1";













    field public static final java.lang.String RSA_PSS = "PSS";













  }

























  public static abstract class KeyStoreKeyProperties.SignaturePaddingEnum implements java.lang.annotation.Annotation {













  }



























  public class KeyStoreKeySpec implements java.security.spec.KeySpec {















    method public java.lang.String[] getBlockModes();















    method public java.lang.String[] getDigests();

























api/system-current.txt



+55
−0




























Original line number
Diff line number
Diff line








@@ -30756,6 +30756,53 @@ package android.security {













  public abstract class KeyStoreKeyProperties {















  }



























  public static abstract class KeyStoreKeyProperties.Algorithm {













    field public static final java.lang.String AES = "AES";













    field public static final java.lang.String EC = "EC";













    field public static final java.lang.String HMAC_SHA1 = "HmacSHA1";













    field public static final java.lang.String HMAC_SHA224 = "HmacSHA224";













    field public static final java.lang.String HMAC_SHA256 = "HmacSHA256";













    field public static final java.lang.String HMAC_SHA384 = "HmacSHA384";













    field public static final java.lang.String HMAC_SHA512 = "HmacSHA512";













    field public static final java.lang.String RSA = "RSA";













  }

























  public static abstract class KeyStoreKeyProperties.AlgorithmEnum implements java.lang.annotation.Annotation {













  }

























  public static abstract class KeyStoreKeyProperties.BlockMode {













    field public static final java.lang.String CBC = "CBC";













    field public static final java.lang.String CTR = "CTR";













    field public static final java.lang.String ECB = "ECB";













    field public static final java.lang.String GCM = "GCM";













  }

























  public static abstract class KeyStoreKeyProperties.BlockModeEnum implements java.lang.annotation.Annotation {













  }

























  public static abstract class KeyStoreKeyProperties.Digest {













    field public static final java.lang.String MD5 = "MD5";













    field public static final java.lang.String NONE = "NONE";













    field public static final java.lang.String SHA1 = "SHA-1";













    field public static final java.lang.String SHA224 = "SHA-224";













    field public static final java.lang.String SHA256 = "SHA-256";













    field public static final java.lang.String SHA384 = "SHA-384";













    field public static final java.lang.String SHA512 = "SHA-512";













  }

























  public static abstract class KeyStoreKeyProperties.DigestEnum implements java.lang.annotation.Annotation {













  }

























  public static abstract class KeyStoreKeyProperties.EncryptionPadding {













    field public static final java.lang.String NONE = "NoPadding";













    field public static final java.lang.String PKCS7 = "PKCS7Padding";













    field public static final java.lang.String RSA_OAEP = "OAEPPadding";













    field public static final java.lang.String RSA_PKCS1 = "PKCS1Padding";













  }

























  public static abstract class KeyStoreKeyProperties.EncryptionPaddingEnum implements java.lang.annotation.Annotation {













  }



























  public static abstract class KeyStoreKeyProperties.Origin {















    field public static final int GENERATED = 1; // 0x1















    field public static final int IMPORTED = 2; // 0x2









@@ -30775,6 +30822,14 @@ package android.security {













  public static abstract class KeyStoreKeyProperties.PurposeEnum implements java.lang.annotation.Annotation {















  }



























  public static abstract class KeyStoreKeyProperties.SignaturePadding {













    field public static final java.lang.String RSA_PKCS1 = "PKCS1";













    field public static final java.lang.String RSA_PSS = "PSS";













  }

























  public static abstract class KeyStoreKeyProperties.SignaturePaddingEnum implements java.lang.annotation.Annotation {













  }



























  public class KeyStoreKeySpec implements java.security.spec.KeySpec {















    method public java.lang.String[] getBlockModes();















    method public java.lang.String[] getDigests();

























keystore/java/android/security/AndroidKeyPairGenerator.java



+11
−10




























Original line number
Diff line number
Diff line








@@ -54,13 +54,13 @@ public abstract class AndroidKeyPairGenerator extends KeyPairGeneratorSpi {





























    public static class RSA extends AndroidKeyPairGenerator {















        public RSA() {













            super("RSA");













            super(KeyStoreKeyProperties.Algorithm.RSA);















        }















    }































    public static class EC extends AndroidKeyPairGenerator {















        public EC() {













            super("EC");













            super(KeyStoreKeyProperties.Algorithm.EC);















        }















    }

























@@ -83,15 +83,15 @@ public abstract class AndroidKeyPairGenerator extends KeyPairGeneratorSpi {













    private android.security.KeyStore mKeyStore;































    private KeyPairGeneratorSpec mSpec;













    private String mKeyAlgorithm;













    private @KeyStoreKeyProperties.AlgorithmEnum String mKeyAlgorithm;















    private int mKeyType;















    private int mKeySize;





























    protected AndroidKeyPairGenerator(String algorithm) {













    protected AndroidKeyPairGenerator(@KeyStoreKeyProperties.AlgorithmEnum String algorithm) {















        mAlgorithm = algorithm;















    }





























    public String getAlgorithm() {













    public @KeyStoreKeyProperties.AlgorithmEnum String getAlgorithm() {















        return mAlgorithm;















    }


























@@ -197,7 +197,7 @@ public abstract class AndroidKeyPairGenerator extends KeyPairGeneratorSpi {













        return certGen.generate(privateKey);















    }





























    private String getKeyAlgorithm(KeyPairGeneratorSpec spec) {













    private @KeyStoreKeyProperties.AlgorithmEnum String getKeyAlgorithm(KeyPairGeneratorSpec spec) {















        String result = spec.getKeyType();















        if (result != null) {















            return result;










@@ -248,10 +248,11 @@ public abstract class AndroidKeyPairGenerator extends KeyPairGeneratorSpi {













        }















    }





























    private static String getDefaultSignatureAlgorithmForKeyAlgorithm(String algorithm) {













        if ("RSA".equalsIgnoreCase(algorithm)) {













    private static String getDefaultSignatureAlgorithmForKeyAlgorithm(













            @KeyStoreKeyProperties.AlgorithmEnum String algorithm) {













        if (KeyStoreKeyProperties.Algorithm.RSA.equalsIgnoreCase(algorithm)) {















            return "sha256WithRSA";













        } else if ("EC".equalsIgnoreCase(algorithm)) {













        } else if (KeyStoreKeyProperties.Algorithm.EC.equalsIgnoreCase(algorithm)) {















            return "sha256WithECDSA";















        } else {















            throw new IllegalArgumentException("Unsupported key type " + algorithm);










@@ -287,7 +288,7 @@ public abstract class AndroidKeyPairGenerator extends KeyPairGeneratorSpi {













        }































        KeyPairGeneratorSpec spec = (KeyPairGeneratorSpec) params;













        String keyAlgorithm = getKeyAlgorithm(spec);













        @KeyStoreKeyProperties.AlgorithmEnum String keyAlgorithm = getKeyAlgorithm(spec);















        int keyType = KeyStore.getKeyTypeForAlgorithm(keyAlgorithm);















        if (keyType == -1) {















            throw new InvalidAlgorithmParameterException(

































keystore/java/android/security/AndroidKeyStore.java



+15
−16




























Original line number
Diff line number
Diff line








@@ -128,9 +128,10 @@ public class AndroidKeyStore extends KeyStoreSpi {













                keymasterDigest = keymasterDigests.get(0);















            }





























            String keyAlgorithmString;













            @KeyStoreKeyProperties.AlgorithmEnum String keyAlgorithmString;















            try {













                keyAlgorithmString = KeymasterUtils.getJcaSecretKeyAlgorithm(













                keyAlgorithmString =













                        KeyStoreKeyProperties.Algorithm.fromKeymasterSecretKeyAlgorithm(















                                keymasterAlgorithm, keymasterDigest);















            } catch (IllegalArgumentException e) {















                throw (UnrecoverableKeyException)










@@ -451,10 +452,10 @@ public class AndroidKeyStore extends KeyStoreSpi {













        int keymasterAlgorithm;















        int keymasterDigest;















        try {













            keymasterAlgorithm = KeymasterUtils.getKeymasterAlgorithmFromJcaSecretKeyAlgorithm(













            keymasterAlgorithm = KeyStoreKeyProperties.Algorithm.toKeymasterSecretKeyAlgorithm(















                    keyAlgorithmString);















            keymasterDigest =













                    KeymasterUtils.getKeymasterDigestfromJcaSecretKeyAlgorithm(keyAlgorithmString);













                    KeyStoreKeyProperties.Algorithm.toKeymasterDigest(keyAlgorithmString);















        } catch (IllegalArgumentException e) {















            throw new KeyStoreException("Unsupported secret key algorithm: " + keyAlgorithmString);















        }









@@ -465,8 +466,7 @@ public class AndroidKeyStore extends KeyStoreSpi {













        int[] keymasterDigests;















        if (params.isDigestsSpecified()) {















            // Digest(s) specified in parameters













            keymasterDigests =













                    KeymasterUtils.getKeymasterDigestsFromJcaDigestAlgorithms(params.getDigests());













            keymasterDigests = KeyStoreKeyProperties.Digest.allToKeymaster(params.getDigests());















            if (keymasterDigest != -1) {















                // Digest also specified in the JCA key algorithm name.















                if (!com.android.internal.util.ArrayUtils.contains(










@@ -494,8 +494,8 @@ public class AndroidKeyStore extends KeyStoreSpi {













        }































        @KeyStoreKeyProperties.PurposeEnum int purposes = params.getPurposes();













        int[] keymasterBlockModes = KeymasterUtils.getKeymasterBlockModesFromJcaBlockModes(













                params.getBlockModes());













        int[] keymasterBlockModes =













                KeyStoreKeyProperties.BlockMode.allToKeymaster(params.getBlockModes());















        if (((purposes & KeyStoreKeyProperties.Purpose.ENCRYPT) != 0)















                && (params.isRandomizedEncryptionRequired())) {















            for (int keymasterBlockMode : keymasterBlockModes) {









@@ -503,8 +503,7 @@ public class AndroidKeyStore extends KeyStoreSpi {













                    throw new KeyStoreException(















                            "Randomized encryption (IND-CPA) required but may be violated by block"















                            + " mode: "













                            + KeymasterUtils.getJcaBlockModeFromKeymasterBlockMode(













                                    keymasterBlockMode)













                            + KeyStoreKeyProperties.BlockMode.fromKeymaster(keymasterBlockMode)















                            + ". See KeyStoreParameter documentation.");















                }















            }









@@ -513,11 +512,11 @@ public class AndroidKeyStore extends KeyStoreSpi {













            args.addInt(KeymasterDefs.KM_TAG_PURPOSE, keymasterPurpose);















        }















        args.addInts(KeymasterDefs.KM_TAG_BLOCK_MODE, keymasterBlockModes);













        int[] keymasterPaddings = ArrayUtils.concat(













                KeymasterUtils.getKeymasterPaddingsFromJcaEncryptionPaddings(













                        params.getEncryptionPaddings()),













                KeymasterUtils.getKeymasterPaddingsFromJcaSignaturePaddings(













                        params.getSignaturePaddings()));













        if (params.getSignaturePaddings().length > 0) {













            throw new KeyStoreException("Signature paddings not supported for symmetric keys");













        }













        int[] keymasterPaddings = KeyStoreKeyProperties.EncryptionPadding.allToKeymaster(













                params.getEncryptionPaddings());















        args.addInts(KeymasterDefs.KM_TAG_PADDING, keymasterPaddings);















        KeymasterUtils.addUserAuthArgs(args,















                params.getContext(),

































keystore/java/android/security/KeyChain.java



+10
−7




























Original line number
Diff line number
Diff line








@@ -262,7 +262,8 @@ public final class KeyChain {













     *     unavailable.















     */















    public static void choosePrivateKeyAlias(Activity activity, KeyChainAliasCallback response,













            String[] keyTypes, Principal[] issuers, String host, int port, String alias) {













            @KeyStoreKeyProperties.AlgorithmEnum String[] keyTypes, Principal[] issuers,













            String host, int port, String alias) {















        choosePrivateKeyAlias(activity, response, keyTypes, issuers, host, port, null, alias);















    }


























@@ -306,9 +307,8 @@ public final class KeyChain {













     *     unavailable.















     */















    public static void choosePrivateKeyAlias(Activity activity, KeyChainAliasCallback response,













                                             String[] keyTypes, Principal[] issuers,













                                             String host, int port, String url,













                                             String alias) {













            @KeyStoreKeyProperties.AlgorithmEnum String[] keyTypes, Principal[] issuers,













            String host, int port, String url, String alias) {















        /*















         * TODO currently keyTypes, issuers are unused. They are meant















         * to follow the semantics and purpose of X509KeyManager










@@ -431,9 +431,11 @@ public final class KeyChain {













     * specific {@code PrivateKey} type indicated by {@code algorithm} (e.g.,















     * "RSA").















     */













    public static boolean isKeyAlgorithmSupported(String algorithm) {













    public static boolean isKeyAlgorithmSupported(













            @KeyStoreKeyProperties.AlgorithmEnum String algorithm) {















        final String algUpper = algorithm.toUpperCase(Locale.US);













        return "EC".equals(algUpper) || "RSA".equals(algUpper);













        return KeyStoreKeyProperties.Algorithm.EC.equals(algUpper)













                || KeyStoreKeyProperties.Algorithm.RSA.equals(algUpper);















    }































    /**









@@ -443,7 +445,8 @@ public final class KeyChain {













     * hardware support that can be used to bind keys to the device in a way















     * that makes it non-exportable.















     */













    public static boolean isBoundKeyAlgorithm(String algorithm) {













    public static boolean isBoundKeyAlgorithm(













            @KeyStoreKeyProperties.AlgorithmEnum String algorithm) {















        if (!isKeyAlgorithmSupported(algorithm)) {















            return false;















        }