public class AndroidKeyStoreSpi extends KeyStoreSpi
KeyStore.getInstance("AndroidKeyStore")
interface. This returns a
java.security.KeyStore backed by this "AndroidKeyStore" implementation.
This is built on top of Android's keystore daemon. The convention of alias use is:
PrivateKeyEntry will have a Credentials.USER_PRIVATE_KEY as the private key, Credentials.USER_CERTIFICATE as the first certificate in the chain (the one that corresponds to the private key), and then a Credentials.CA_CERTIFICATE entry which will have the rest of the chain concatenated in BER format.
TrustedCertificateEntry will just have a Credentials.CA_CERTIFICATE entry with a single certificate.
Constructor and Description |
---|
AndroidKeyStoreSpi() |
Modifier and Type | Method and Description |
---|---|
Enumeration<String> |
engineAliases()
Lists all the alias names of this keystore.
|
boolean |
engineContainsAlias(String alias)
Checks if the given alias exists in this keystore.
|
void |
engineDeleteEntry(String alias)
Deletes the entry identified by the given alias from this keystore.
|
Certificate |
engineGetCertificate(String alias)
Returns the certificate associated with the given alias.
|
String |
engineGetCertificateAlias(Certificate cert)
Returns the (alias) name of the first keystore entry whose certificate
matches the given certificate.
|
Certificate[] |
engineGetCertificateChain(String alias)
Returns the certificate chain associated with the given alias.
|
Date |
engineGetCreationDate(String alias)
Returns the creation date of the entry identified by the given alias.
|
Key |
engineGetKey(String alias,
char[] password)
Returns the key associated with the given alias, using the given
password to recover it.
|
boolean |
engineIsCertificateEntry(String alias)
Returns true if the entry identified by the given alias
was created by a call to
setCertificateEntry ,
or created by a call to setEntry with a
TrustedCertificateEntry . |
boolean |
engineIsKeyEntry(String alias)
Returns true if the entry identified by the given alias
was created by a call to
setKeyEntry ,
or created by a call to setEntry with a
PrivateKeyEntry or a SecretKeyEntry . |
void |
engineLoad(InputStream stream,
char[] password)
Loads the keystore from the given input stream.
|
void |
engineLoad(KeyStore.LoadStoreParameter param)
Loads the keystore using the given
KeyStore.LoadStoreParameter . |
void |
engineSetCertificateEntry(String alias,
Certificate cert)
Assigns the given certificate to the given alias.
|
void |
engineSetEntry(String alias,
KeyStore.Entry entry,
KeyStore.ProtectionParameter param)
Saves a
KeyStore.Entry under the specified alias. |
void |
engineSetKeyEntry(String alias,
byte[] userKey,
Certificate[] chain)
Assigns the given key (that has already been protected) to the given
alias.
|
void |
engineSetKeyEntry(String alias,
Key key,
char[] password,
Certificate[] chain)
Assigns the given key to the given alias, protecting it with the given
password.
|
int |
engineSize()
Retrieves the number of entries in this keystore.
|
void |
engineStore(OutputStream stream,
char[] password)
Stores this keystore to the given output stream, and protects its
integrity with the given password.
|
engineEntryInstanceOf, engineGetEntry, engineStore
public static final String NAME
public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, UnrecoverableKeyException
KeyStoreSpi
setKeyEntry
,
or by a call to setEntry
with a
PrivateKeyEntry
or SecretKeyEntry
.engineGetKey
in class KeyStoreSpi
alias
- the alias namepassword
- the password for recovering the keyNoSuchAlgorithmException
- if the algorithm for recovering the
key cannot be foundUnrecoverableKeyException
- if the key cannot be recovered
(e.g., the given password is wrong).public Certificate[] engineGetCertificateChain(String alias)
KeyStoreSpi
setKeyEntry
,
or by a call to setEntry
with a
PrivateKeyEntry
.engineGetCertificateChain
in class KeyStoreSpi
alias
- the alias namepublic Certificate engineGetCertificate(String alias)
KeyStoreSpi
If the given alias name identifies an entry
created by a call to setCertificateEntry
,
or created by a call to setEntry
with a
TrustedCertificateEntry
,
then the trusted certificate contained in that entry is returned.
If the given alias name identifies an entry
created by a call to setKeyEntry
,
or created by a call to setEntry
with a
PrivateKeyEntry
,
then the first element of the certificate chain in that entry
(if a chain exists) is returned.
engineGetCertificate
in class KeyStoreSpi
alias
- the alias namepublic Date engineGetCreationDate(String alias)
KeyStoreSpi
engineGetCreationDate
in class KeyStoreSpi
alias
- the alias namepublic void engineSetKeyEntry(String alias, Key key, char[] password, Certificate[] chain) throws KeyStoreException
KeyStoreSpi
If the given key is of type java.security.PrivateKey
,
it must be accompanied by a certificate chain certifying the
corresponding public key.
If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).
engineSetKeyEntry
in class KeyStoreSpi
alias
- the alias namekey
- the key to be associated with the aliaspassword
- the password to protect the keychain
- the certificate chain for the corresponding public
key (only required if the given key is of type
java.security.PrivateKey
).KeyStoreException
- if the given key cannot be protected, or
this operation fails for some other reasonpublic void engineSetKeyEntry(String alias, byte[] userKey, Certificate[] chain) throws KeyStoreException
KeyStoreSpi
If the protected key is of type
java.security.PrivateKey
,
it must be accompanied by a certificate chain certifying the
corresponding public key.
If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).
engineSetKeyEntry
in class KeyStoreSpi
alias
- the alias nameuserKey
- the key (in protected format) to be associated with the aliaschain
- the certificate chain for the corresponding public
key (only useful if the protected key is of type
java.security.PrivateKey
).KeyStoreException
- if this operation fails.public void engineSetCertificateEntry(String alias, Certificate cert) throws KeyStoreException
KeyStoreSpi
If the given alias identifies an existing entry
created by a call to setCertificateEntry
,
or created by a call to setEntry
with a
TrustedCertificateEntry
,
the trusted certificate in the existing entry
is overridden by the given certificate.
engineSetCertificateEntry
in class KeyStoreSpi
alias
- the alias namecert
- the certificateKeyStoreException
- if the given alias already exists and does
not identify an entry containing a trusted certificate,
or this operation fails for some other reason.public void engineDeleteEntry(String alias) throws KeyStoreException
KeyStoreSpi
engineDeleteEntry
in class KeyStoreSpi
alias
- the alias nameKeyStoreException
- if the entry cannot be removed.public Enumeration<String> engineAliases()
KeyStoreSpi
engineAliases
in class KeyStoreSpi
public boolean engineContainsAlias(String alias)
KeyStoreSpi
engineContainsAlias
in class KeyStoreSpi
alias
- the alias namepublic int engineSize()
KeyStoreSpi
engineSize
in class KeyStoreSpi
public boolean engineIsKeyEntry(String alias)
KeyStoreSpi
setKeyEntry
,
or created by a call to setEntry
with a
PrivateKeyEntry
or a SecretKeyEntry
.engineIsKeyEntry
in class KeyStoreSpi
alias
- the alias for the keystore entry to be checkedpublic boolean engineIsCertificateEntry(String alias)
KeyStoreSpi
setCertificateEntry
,
or created by a call to setEntry
with a
TrustedCertificateEntry
.engineIsCertificateEntry
in class KeyStoreSpi
alias
- the alias for the keystore entry to be checkedpublic String engineGetCertificateAlias(Certificate cert)
KeyStoreSpi
This method attempts to match the given certificate with each
keystore entry. If the entry being considered was
created by a call to setCertificateEntry
,
or created by a call to setEntry
with a
TrustedCertificateEntry
,
then the given certificate is compared to that entry's certificate.
If the entry being considered was
created by a call to setKeyEntry
,
or created by a call to setEntry
with a
PrivateKeyEntry
,
then the given certificate is compared to the first
element of that entry's certificate chain.
engineGetCertificateAlias
in class KeyStoreSpi
cert
- the certificate to match with.public void engineStore(OutputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException
KeyStoreSpi
engineStore
in class KeyStoreSpi
stream
- the output stream to which this keystore is written.password
- the password to generate the keystore integrity checkIOException
- if there was an I/O problem with dataNoSuchAlgorithmException
- if the appropriate data integrity
algorithm could not be foundCertificateException
- if any of the certificates included in
the keystore data could not be storedpublic void engineLoad(InputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException
KeyStoreSpi
A password may be given to unlock the keystore (e.g. the keystore resides on a hardware token device), or to check the integrity of the keystore data. If a password is not given for integrity checking, then integrity checking is not performed.
engineLoad
in class KeyStoreSpi
stream
- the input stream from which the keystore is loaded,
or null
password
- the password used to check the integrity of
the keystore, the password used to unlock the keystore,
or null
IOException
- if there is an I/O or format problem with the
keystore data, if a password is required but not given,
or if the given password was incorrect. If the error is due to a
wrong password, the cause
of the
IOException
should be an
UnrecoverableKeyException
NoSuchAlgorithmException
- if the algorithm used to check
the integrity of the keystore cannot be foundCertificateException
- if any of the certificates in the
keystore could not be loadedpublic void engineLoad(KeyStore.LoadStoreParameter param) throws IOException, NoSuchAlgorithmException, CertificateException
KeyStoreSpi
KeyStore.LoadStoreParameter
.
Note that if this KeyStore has already been loaded, it is reinitialized and loaded again from the given parameter.
engineLoad
in class KeyStoreSpi
param
- the KeyStore.LoadStoreParameter
that specifies how to load the keystore,
which may be null
IOException
- if there is an I/O or format problem with the
keystore data. If the error is due to an incorrect
ProtectionParameter
(e.g. wrong password)
the cause
of the
IOException
should be an
UnrecoverableKeyException
NoSuchAlgorithmException
- if the algorithm used to check
the integrity of the keystore cannot be foundCertificateException
- if any of the certificates in the
keystore could not be loadedpublic void engineSetEntry(String alias, KeyStore.Entry entry, KeyStore.ProtectionParameter param) throws KeyStoreException
KeyStoreSpi
KeyStore.Entry
under the specified alias.
The specified protection parameter is used to protect the
Entry
.
If an entry already exists for the specified alias, it is overridden.
engineSetEntry
in class KeyStoreSpi
alias
- save the KeyStore.Entry
under this aliasentry
- the Entry
to saveparam
- the ProtectionParameter
used to protect the Entry
,
which may be null
KeyStoreException
- if this operation fails