public class KeyInfo extends Object implements KeySpec
GCM
mode, or signing only), whether the key should be
encrypted at rest, the key's and validity start and end dates.
Instances of this class are immutable.
KeyInfo
describing the provided Android
Keystore SecretKey
.
SecretKey key = ...; // Android Keystore key
SecretKeyFactory factory = SecretKeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore");
KeyInfo keyInfo;
try {
keyInfo = (KeyInfo) factory.getKeySpec(key, KeyInfo.class);
} catch (InvalidKeySpecException e) {
// Not an Android KeyStore key.
}
KeyInfo
describing the provided
Android KeyStore PrivateKey
.
PrivateKey key = ...; // Android KeyStore key
KeyFactory factory = KeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore");
KeyInfo keyInfo;
try {
keyInfo = factory.getKeySpec(key, KeyInfo.class);
} catch (InvalidKeySpecException e) {
// Not an Android KeyStore key.
}
Constructor and Description |
---|
KeyInfo(String keystoreKeyAlias,
boolean insideSecureHardware,
int origin,
int keySize,
Date keyValidityStart,
Date keyValidityForOriginationEnd,
Date keyValidityForConsumptionEnd,
int purposes,
String[] encryptionPaddings,
String[] signaturePaddings,
String[] digests,
String[] blockModes,
boolean userAuthenticationRequired,
int userAuthenticationValidityDurationSeconds,
boolean userAuthenticationRequirementEnforcedBySecureHardware,
boolean userAuthenticationValidWhileOnBody,
boolean invalidatedByBiometricEnrollment) |
Modifier and Type | Method and Description |
---|---|
String[] |
getBlockModes()
Gets the set of block modes (e.g.,
GCM , CBC ) with which the key can be used
when encrypting/decrypting. |
String[] |
getDigests()
Gets the set of digest algorithms (e.g.,
SHA-256 , SHA-384 ) with which the key
can be used. |
String[] |
getEncryptionPaddings()
Gets the set of padding schemes (e.g.,
PKCS7Padding , PKCS1Padding ,
NoPadding ) with which the key can be used when encrypting/decrypting. |
int |
getKeySize()
Gets the size of the key in bits.
|
String |
getKeystoreAlias()
Gets the entry alias under which the key is stored in the
AndroidKeyStore . |
Date |
getKeyValidityForConsumptionEnd()
Gets the time instant after which the key is no long valid for decryption and verification.
|
Date |
getKeyValidityForOriginationEnd()
Gets the time instant after which the key is no long valid for encryption and signing.
|
Date |
getKeyValidityStart()
Gets the time instant before which the key is not yet valid.
|
int |
getOrigin()
Gets the origin of the key.
|
int |
getPurposes()
Gets the set of purposes (e.g., encrypt, decrypt, sign) for which the key can be used.
|
String[] |
getSignaturePaddings()
Gets the set of padding schemes (e.g.,
PSS , PKCS#1 ) with which the key
can be used when signing/verifying. |
int |
getUserAuthenticationValidityDurationSeconds()
Gets the duration of time (seconds) for which this key is authorized to be used after the
user is successfully authenticated.
|
boolean |
isInsideSecureHardware()
Returns
true if the key resides inside secure hardware (e.g., Trusted Execution
Environment (TEE) or Secure Element (SE)). |
boolean |
isInvalidatedByBiometricEnrollment()
Returns
true if the key will be invalidated by enrollment of a new fingerprint or
removal of all fingerprints. |
boolean |
isUserAuthenticationRequired()
Returns
true if the key is authorized to be used only if the user has been
authenticated. |
boolean |
isUserAuthenticationRequirementEnforcedBySecureHardware()
Returns
true if the requirement that this key can only be used if the user has been
authenticated is enforced by secure hardware (e.g., Trusted Execution Environment (TEE) or
Secure Element (SE)). |
boolean |
isUserAuthenticationValidWhileOnBody()
Returns
true if this key will become unusable when the device is removed from the
user's body. |
public KeyInfo(String keystoreKeyAlias, boolean insideSecureHardware, int origin, int keySize, Date keyValidityStart, Date keyValidityForOriginationEnd, Date keyValidityForConsumptionEnd, int purposes, String[] encryptionPaddings, String[] signaturePaddings, String[] digests, String[] blockModes, boolean userAuthenticationRequired, int userAuthenticationValidityDurationSeconds, boolean userAuthenticationRequirementEnforcedBySecureHardware, boolean userAuthenticationValidWhileOnBody, boolean invalidatedByBiometricEnrollment)
public String getKeystoreAlias()
AndroidKeyStore
.public boolean isInsideSecureHardware()
true
if the key resides inside secure hardware (e.g., Trusted Execution
Environment (TEE) or Secure Element (SE)). Key material of such keys is available in
plaintext only inside the secure hardware and is not exposed outside of it.public int getOrigin()
KeyProperties
.ORIGIN
constants.public int getKeySize()
public Date getKeyValidityStart()
null
if not restricted.public Date getKeyValidityForConsumptionEnd()
null
if not restricted.public Date getKeyValidityForOriginationEnd()
null
if not restricted.public int getPurposes()
See KeyProperties
.PURPOSE
flags.
public String[] getBlockModes()
GCM
, CBC
) with which the key can be used
when encrypting/decrypting. Attempts to use the key with any other block modes will be
rejected.
See KeyProperties
.BLOCK_MODE
constants.
public String[] getEncryptionPaddings()
PKCS7Padding
, PKCS1Padding
,
NoPadding
) with which the key can be used when encrypting/decrypting. Attempts to use
the key with any other padding scheme will be rejected.
See KeyProperties
.ENCRYPTION_PADDING
constants.
public String[] getSignaturePaddings()
PSS
, PKCS#1
) with which the key
can be used when signing/verifying. Attempts to use the key with any other padding scheme
will be rejected.
See KeyProperties
.SIGNATURE_PADDING
constants.
public String[] getDigests()
SHA-256
, SHA-384
) with which the key
can be used.
See KeyProperties
.DIGEST
constants.
public boolean isUserAuthenticationRequired()
true
if the key is authorized to be used only if the user has been
authenticated.
This authorization applies only to secret key and private key operations. Public key operations are not restricted.
public int getUserAuthenticationValidityDurationSeconds()
isUserAuthenticationRequired()
).
This authorization applies only to secret key and private key operations. Public key operations are not restricted.
-1
if authentication is required for every use of the
key.isUserAuthenticationRequired()
public boolean isUserAuthenticationRequirementEnforcedBySecureHardware()
true
if the requirement that this key can only be used if the user has been
authenticated is enforced by secure hardware (e.g., Trusted Execution Environment (TEE) or
Secure Element (SE)).isUserAuthenticationRequired()
public boolean isUserAuthenticationValidWhileOnBody()
true
if this key will become unusable when the device is removed from the
user's body. This is possible only for keys with a specified validity duration, and only on
devices with an on-body sensor. Always returns false
on devices that lack an on-body
sensor.public boolean isInvalidatedByBiometricEnrollment()
true
if the key will be invalidated by enrollment of a new fingerprint or
removal of all fingerprints.