KeyProtection

public final class KeyProtection
extends Object implements KeyStore.ProtectionParameter

指定将密钥或密钥对导入Android Keystore system时的安全方式 。 该类指定了导入密钥的授权使用，例如使用密钥是否需要用户验证，密钥被授权（例如，解密，但不签名）哪些操作（使用什么参数）（例如，仅使用特定填充方案或摘要）以及密钥的有效开始和结束日期。 此类中表示的密钥使用授权仅适用于密钥和私钥 - 公钥可用于任何支持的操作。

要将密钥或密钥对导入Android Keystore，请使用 KeyProtection.Builder创建此类的实例，并将该实例传递到 KeyStore.setEntry ，同时导入密钥或密钥对。

要从Android密钥库中获取密钥/对称密钥或私钥，请使用KeyStore.getKey(String, null)或KeyStore.getEntry(String, null) 。 要从Android密钥库获取公钥，请使用getCertificate(String) ，然后使用getPublicKey() 。

为了帮助获取存储在Android密钥库密钥对的具体算法，公共参数，其私钥，实现 ECKey或者 RSAKey接口，而它的公共密钥实现 ECPublicKey或者 RSAPublicKey接口。

注：存储在Android密钥库中的密钥的密钥材料不可访问。

这个类的实例是不可变的。

Known issues

 PublicKey unrestrictedPublicKey =
         KeyFactory.getInstance(publicKey.getAlgorithm()).generatePublic(
                 new X509EncodedKeySpec(publicKey.getEncoded()));
 

Example: AES key for encryption/decryption in GCM mode

 SecretKey key = ...; // AES key

 KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
 keyStore.load(null);
 keyStore.setEntry(
         "key1",
         new KeyStore.SecretKeyEntry(key),
         new KeyProtection.Builder(KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
                 .setBlockMode(KeyProperties.BLOCK_MODE_GCM)
                 .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                 .build());
 // Key imported, obtain a reference to it.
 SecretKey keyStoreKey = (SecretKey) keyStore.getKey("key1", null);
 // The original key can now be discarded.

 Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
 cipher.init(Cipher.ENCRYPT_MODE, keyStoreKey);
 ...
 

Example: HMAC key for generating MACs using SHA-512

 SecretKey key = ...; // HMAC key of algorithm "HmacSHA512".

 KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
 keyStore.load(null);
 keyStore.setEntry(
         "key1",
         new KeyStore.SecretKeyEntry(key),
         new KeyProtection.Builder(KeyProperties.PURPOSE_SIGN).build());
 // Key imported, obtain a reference to it.
 SecretKey keyStoreKey = (SecretKey) keyStore.getKey("key1", null);
 // The original key can now be discarded.

 Mac mac = Mac.getInstance("HmacSHA512");
 mac.init(keyStoreKey);
 ...
 

Example: EC key pair for signing/verification using ECDSA

 PrivateKey privateKey = ...;   // EC private key
 Certificate[] certChain = ...; // Certificate chain with the first certificate
                                // containing the corresponding EC public key.

 KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
 keyStore.load(null);
 keyStore.setEntry(
         "key2",
         new KeyStore.PrivateKeyEntry(privateKey, certChain),
         new KeyProtection.Builder(KeyProperties.PURPOSE_SIGN)
                 .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                 .build());
 // Key pair imported, obtain a reference to it.
 PrivateKey keyStorePrivateKey = (PrivateKey) keyStore.getKey("key2", null);
 PublicKey publicKey = keyStore.getCertificate("key2").getPublicKey();
 // The original private key can now be discarded.

 Signature signature = Signature.getInstance("SHA256withECDSA");
 signature.initSign(keyStorePrivateKey);
 ...
 

Example: RSA key pair for signing/verification using PKCS#1 padding

 PrivateKey privateKey = ...;   // RSA private key
 Certificate[] certChain = ...; // Certificate chain with the first certificate
                                // containing the corresponding RSA public key.

 KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
 keyStore.load(null);
 keyStore.setEntry(
         "key2",
         new KeyStore.PrivateKeyEntry(privateKey, certChain),
         new KeyProtection.Builder(KeyProperties.PURPOSE_SIGN)
                 .setDigests(KeyProperties.DIGEST_SHA256)
                 .setSignaturePaddings(KeyProperties.SIGNATURE_PADDING_RSA_PKCS1)
                 // Only permit this key to be used if the user
                 // authenticated within the last ten minutes.
                 .setUserAuthenticationRequired(true)
                 .setUserAuthenticationValidityDurationSeconds(10 * 60)
                 .build());
 // Key pair imported, obtain a reference to it.
 PrivateKey keyStorePrivateKey = (PrivateKey) keyStore.getKey("key2", null);
 PublicKey publicKey = keyStore.getCertificate("key2").getPublicKey();
 // The original private key can now be discarded.

 Signature signature = Signature.getInstance("SHA256withRSA");
 signature.initSign(keyStorePrivateKey);
 ...
 

Example: RSA key pair for encryption/decryption using PKCS#1 padding

 PrivateKey privateKey = ...;   // RSA private key
 Certificate[] certChain = ...; // Certificate chain with the first certificate
                                // containing the corresponding RSA public key.

 KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
 keyStore.load(null);
 keyStore.setEntry(
         "key2",
         new KeyStore.PrivateKeyEntry(privateKey, certChain),
         new KeyProtection.Builder(KeyProperties.PURPOSE_DECRYPT)
                 .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
                 .build());
 // Key pair imported, obtain a reference to it.
 PrivateKey keyStorePrivateKey = (PrivateKey) keyStore.getKey("key2", null);
 PublicKey publicKey = keyStore.getCertificate("key2").getPublicKey();
 // The original private key can now be discarded.

 Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
 cipher.init(Cipher.DECRYPT_MODE, keyStorePrivateKey);
 ...
 

Summary

Inherited methods

From class java.lang.Object Object clone() 创建并返回此对象的副本。 boolean equals(Object obj) 指示其他某个对象是否“等于”这一个。 void finalize() 当垃圾收集确定没有更多对该对象的引用时，由对象上的垃圾回收器调用。 final Class<?> getClass() 返回此 Object的运行时类。 int hashCode() 返回对象的哈希码值。 final void notify() 唤醒正在等待该对象监视器的单个线程。 final void notifyAll() 唤醒在该对象监视器上等待的所有线程。 String toString() 返回对象的字符串表示形式。 final void wait(long millis, int nanos) 导致当前线程等待，直到另一个线程调用此对象的 notify()方法或 notifyAll()方法，或者某个其他线程中断当前线程，或经过一定的实时时间。 final void wait(long millis) 导致当前线程等待，直到另一个线程调用此对象的 notify()方法或 notifyAll()方法或经过了指定的时间量。 final void wait() 导致当前线程等待，直到另一个线程调用此对象的 notify()方法或 notifyAll()方法。

Public methods

String[] getBlockModes ()

String[] getDigests ()

String[] getEncryptionPaddings ()

Date getKeyValidityForConsumptionEnd ()

Date getKeyValidityForOriginationEnd ()

Date getKeyValidityStart ()

int getPurposes ()

String[] getSignaturePaddings ()

int getUserAuthenticationValidityDurationSeconds ()

boolean isDigestsSpecified ()

boolean isInvalidatedByBiometricEnrollment ()

boolean isRandomizedEncryptionRequired ()

boolean isUserAuthenticationRequired ()

boolean isUserAuthenticationValidWhileOnBody ()