Applications accessing the {@code KeyChain} normally go through * these steps: * *
An application may remember the value of a selected alias to * avoid prompting the user with {@link #choosePrivateKeyAlias * choosePrivateKeyAlias} on subsequent connections. If the alias is * no longer valid, null will be returned on lookups using that value * *
An application can request the installation of private keys and * certificates via the {@code Intent} provided by {@link * #createInstallIntent}. Private keys installed via this {@code * Intent} will be accessible via {@link #choosePrivateKeyAlias} while * Certificate Authority (CA) certificates will be trusted by all * applications through the default {@code X509TrustManager}. */ // TODO reference intent for credential installation when public public final class KeyChain { /** * @hide */ public static final String LOG = "KeyChain"; /** * @hide Also used by KeyChainService implementation */ public static final String ACCOUNT_TYPE = "com.android.keychain"; /** * Package name for KeyChain chooser. */ private static final String KEYCHAIN_PACKAGE = "com.android.keychain"; /** * Action to bring up the KeyChainActivity */ private static final String ACTION_CHOOSER = "com.android.keychain.CHOOSER"; /** * Package name for the Certificate Installer. */ private static final String CERT_INSTALLER_PACKAGE = "com.android.certinstaller"; /** * Package name for Settings. */ private static final String SETTINGS_PACKAGE = "com.android.settings"; /** * Extra for use with {@link #ACTION_CHOOSER} * @hide Also used by KeyChainActivity implementation */ public static final String EXTRA_RESPONSE = "response"; /** * Extra for use with {@link #ACTION_CHOOSER} * @hide Also used by KeyChainActivity implementation */ public static final String EXTRA_URI = "uri"; /** * Extra for use with {@link #ACTION_CHOOSER} * @hide Also used by KeyChainActivity implementation */ public static final String EXTRA_ALIAS = "alias"; /** * Extra for use with {@link #ACTION_CHOOSER} * @hide Also used by KeyChainActivity implementation */ public static final String EXTRA_SENDER = "sender"; /** * Extra for use with {@link #ACTION_CHOOSER} * @hide Also used by KeyChainActivity implementation */ public static final String EXTRA_KEY_TYPES = "key_types"; /** * Extra for use with {@link #ACTION_CHOOSER} * @hide Also used by KeyChainActivity implementation */ public static final String EXTRA_ISSUERS = "issuers"; /** * Action to bring up the CertInstaller. */ private static final String ACTION_INSTALL = "android.credentials.INSTALL"; /** * Optional extra to specify a {@code String} credential name on * the {@code Intent} returned by {@link #createInstallIntent}. */ // Compatible with old com.android.certinstaller.CredentialHelper.CERT_NAME_KEY public static final String EXTRA_NAME = "name"; /** * Optional extra to specify an X.509 certificate to install on * the {@code Intent} returned by {@link #createInstallIntent}. * The extra value should be a PEM or ASN.1 DER encoded {@code * byte[]}. An {@link X509Certificate} can be converted to DER * encoded bytes with {@link X509Certificate#getEncoded}. * *
{@link #EXTRA_NAME} may be used to provide a default alias * name for the installed certificate. */ // Compatible with old android.security.Credentials.CERTIFICATE public static final String EXTRA_CERTIFICATE = "CERT"; /** * Optional extra for use with the {@code Intent} returned by * {@link #createInstallIntent} to specify a PKCS#12 key store to * install. The extra value should be a {@code byte[]}. The bytes * may come from an external source or be generated with {@link * java.security.KeyStore#store} on a "PKCS12" instance. * *
The user will be prompted for the password to load the key store. * *
The key store will be scanned for {@link * java.security.KeyStore.PrivateKeyEntry} entries and both the * private key and associated certificate chain will be installed. * *
{@link #EXTRA_NAME} may be used to provide a default alias * name for the installed credentials. */ // Compatible with old android.security.Credentials.PKCS12 public static final String EXTRA_PKCS12 = "PKCS12"; /** * Extra used by {@link #createManageCredentialsIntent(AppUriAuthenticationPolicy)} to specify * the authentication policy of the credential management app. * *
The authentication policy declares which alias for a private key and certificate pair * should be used for authentication, given a list of apps and URIs. * *
The extra value should be a {@link AppUriAuthenticationPolicy}. * * @hide */ public static final String EXTRA_AUTHENTICATION_POLICY = "android.security.extra.AUTHENTICATION_POLICY"; /** * Broadcast Action: Indicates the trusted storage has changed. Sent when * one of this happens: * *
Alternatively, {@link #EXTRA_CERTIFICATE} or {@link * #EXTRA_PKCS12} maybe used to specify the bytes of an X.509 * certificate or a PKCS#12 key store for installation. These * extras may be combined with {@link #EXTRA_NAME} to provide a * default alias name for credentials being installed. * *
When used with {@link Activity#startActivityForResult}, * {@link Activity#RESULT_OK} will be returned if a credential was * successfully installed, otherwise {@link * Activity#RESULT_CANCELED} will be returned. * *
Starting from {@link android.os.Build.VERSION_CODES#R}, the intent returned by this * method cannot be used for installing CA certificates. Since CA certificates can only be * installed via Settings, the app should provide the user with a file containing the * CA certificate. One way to do this would be to use the {@link android.provider.MediaStore} * API to write the certificate to the {@link android.provider.MediaStore.Downloads} * collection. */ @NonNull public static Intent createInstallIntent() { Intent intent = new Intent(ACTION_INSTALL); intent.setClassName(CERT_INSTALLER_PACKAGE, "com.android.certinstaller.CertInstallerMain"); return intent; } /** * Returns an {@code Intent} that should be used by an app to request to manage the user's * credentials. This is limited to unmanaged devices. The authentication policy must be * provided to be able to make this request successfully. * *
This intent should be started using {@link Activity#startActivityForResult(Intent, int)} * to verify whether the request was successful and whether the user accepted or denied the * request. If the user successfully receives and accepts the request, the result code will be * {@link Activity#RESULT_OK}, otherwise the result code will be * {@link Activity#RESULT_CANCELED}. * *
{@link KeyChain#isCredentialManagementApp(Context)} should be used to determine whether * an app is already the credential management app. * * @param policy The authentication policy determines which alias for a private key and * certificate pair should be used for authentication. */ @NonNull public static Intent createManageCredentialsIntent(@NonNull AppUriAuthenticationPolicy policy) { Intent intent = new Intent(ACTION_MANAGE_CREDENTIALS); intent.setComponent(ComponentName.createRelative(SETTINGS_PACKAGE, ".security.RequestManageCredentials")); intent.putExtra(EXTRA_AUTHENTICATION_POLICY, policy); return intent; } /** * Launches an {@code Activity} for the user to select the alias * for a private key and certificate pair for authentication. The * selected alias or null will be returned via the * KeyChainAliasCallback callback. * *
A device policy controller (as a device or profile owner) can * intercept the request before the activity is shown, to pick a * specific private key alias by implementing * {@link android.app.admin.DeviceAdminReceiver#onChoosePrivateKeyAlias * onChoosePrivateKeyAlias}. * *
{@code keyTypes} and {@code issuers} may be used to * narrow down suggested choices to the user. If either {@code keyTypes} * or {@code issuers} is specified and non-empty, and there are no * matching certificates in the KeyChain, then the certificate * selection prompt would be suppressed entirely. * *
{@code host} and {@code port} may be used to give the user * more context about the server requesting the credentials. * *
{@code alias} allows the caller to preselect an existing * alias which will still be subject to user confirmation. * * @param activity The {@link Activity} context to use for * launching the new sub-Activity to prompt the user to select * a private key; used only to call startActivity(); must not * be null. * @param response Callback to invoke when the request completes; * must not be null. * @param keyTypes The acceptable types of asymmetric keys such as * "RSA", "EC" or null. * @param issuers The acceptable certificate issuers for the * certificate matching the private key, or null. * @param host The host name of the server requesting the * certificate, or null if unavailable. * @param port The port number of the server requesting the * certificate, or -1 if unavailable. * @param alias The alias to preselect if available, or null if * unavailable. */ public static void choosePrivateKeyAlias(@NonNull Activity activity, @NonNull KeyChainAliasCallback response, @Nullable @KeyProperties.KeyAlgorithmEnum String[] keyTypes, @Nullable Principal[] issuers, @Nullable String host, int port, @Nullable String alias) { Uri uri = null; if (host != null) { uri = new Uri.Builder() .authority(host + (port != -1 ? ":" + port : "")) .build(); } choosePrivateKeyAlias(activity, response, keyTypes, issuers, uri, alias); } /** * Launches an {@code Activity} for the user to select the alias * for a private key and certificate pair for authentication. The * selected alias or null will be returned via the * KeyChainAliasCallback callback. * *
A device policy controller (as a device or profile owner) can * intercept the request before the activity is shown, to pick a * specific private key alias by implementing * {@link android.app.admin.DeviceAdminReceiver#onChoosePrivateKeyAlias * onChoosePrivateKeyAlias}. * *
{@code keyTypes} and {@code issuers} may be used to * narrow down suggested choices to the user. If either {@code keyTypes} * or {@code issuers} is specified and non-empty, and there are no * matching certificates in the KeyChain, then the certificate * selection prompt would be suppressed entirely. * *
{@code uri} may be used to give the user more context about * the server requesting the credentials. * *
{@code alias} allows the caller to preselect an existing
* alias which will still be subject to user confirmation.
*
* @param activity The {@link Activity} context to use for
* launching the new sub-Activity to prompt the user to select
* a private key; used only to call startActivity(); must not
* be null.
* @param response Callback to invoke when the request completes;
* must not be null.
* @param keyTypes The acceptable types of asymmetric keys such as
* "RSA", "EC" or null.
* @param issuers The acceptable certificate issuers for the
* certificate matching the private key, or null.
* @param uri The full URI the server is requesting the certificate
* for, or null if unavailable.
* @param alias The alias to preselect if available, or null if
* unavailable.
* @throws IllegalArgumentException if the specified issuers are not
* of type {@code X500Principal}.
*/
public static void choosePrivateKeyAlias(@NonNull Activity activity,
@NonNull KeyChainAliasCallback response,
@Nullable @KeyProperties.KeyAlgorithmEnum String[] keyTypes,
@Nullable Principal[] issuers,
@Nullable Uri uri, @Nullable String alias) {
/*
* Specifying keyTypes excludes certificates with different key types
* from the list of certificates presented to the user.
* In practice today, most servers would require RSA or EC
* certificates.
*
* Specifying issuers narrows down the list by filtering out
* certificates with issuers which are not matching the provided ones.
* This has been reported to Chrome several times (crbug.com/731769).
* There's no concrete description on what to do when the client has no
* certificates that match the provided issuers.
* To be conservative, Android will not present the user with any
* certificates to choose from.
* If the list of issuers is empty then the client may send any
* certificate, see:
* https://tools.ietf.org/html/rfc5246#section-7.4.4
*/
if (activity == null) {
throw new NullPointerException("activity == null");
}
if (response == null) {
throw new NullPointerException("response == null");
}
Intent intent = new Intent(ACTION_CHOOSER);
intent.setPackage(KEYCHAIN_PACKAGE);
intent.putExtra(EXTRA_RESPONSE, new AliasResponse(response));
intent.putExtra(EXTRA_URI, uri);
intent.putExtra(EXTRA_ALIAS, alias);
intent.putExtra(EXTRA_KEY_TYPES, keyTypes);
ArrayList {@link KeyChain#createManageCredentialsIntent} should be used by an app to request to
* become the credential management app. The user must approve this request before the app can
* manage the user's credentials. There can only be one credential management on the device.
*
* @return {@code true} if the caller is the credential management app.
*/
@WorkerThread
public static boolean isCredentialManagementApp(@NonNull Context context) {
boolean isCredentialManagementApp = false;
try (KeyChainConnection keyChainConnection = KeyChain.bind(context)) {
isCredentialManagementApp = keyChainConnection.getService()
.isCredentialManagementApp(context.getPackageName());
} catch (RemoteException e) {
e.rethrowAsRuntimeException();
} catch (InterruptedException e) {
throw new RuntimeException("Interrupted while checking whether the caller is the "
+ "credential management app.", e);
} catch (SecurityException e) {
isCredentialManagementApp = false;
}
return isCredentialManagementApp;
}
/**
* Called by the credential management app to get the authentication policy
* {@link AppUriAuthenticationPolicy}.
*
* @return the credential management app's authentication policy.
* @throws SecurityException if the caller is not the credential management app.
*/
@WorkerThread
@NonNull
public static AppUriAuthenticationPolicy getCredentialManagementAppPolicy(
@NonNull Context context) throws SecurityException {
AppUriAuthenticationPolicy policy = null;
try (KeyChainConnection keyChainConnection = KeyChain.bind(context)) {
policy = keyChainConnection.getService().getCredentialManagementAppPolicy();
} catch (RemoteException e) {
e.rethrowAsRuntimeException();
} catch (InterruptedException e) {
throw new RuntimeException(
"Interrupted while getting credential management app policy.", e);
}
return policy;
}
/**
* Set a credential management app. The credential management app has the ability to manage
* the user's KeyChain credentials on unmanaged devices.
*
* There can only be one credential management on the device. If another app requests to
* become the credential management app, then the existing credential management app will
* no longer be able to manage credentials.
*
* @param packageName The package name of the credential management app
* @param authenticationPolicy The authentication policy of the credential management app. This
* policy determines which alias for a private key and certificate
* pair should be used for authentication.
* @return {@code true} if the credential management app was successfully added.
* @hide
*/
@TestApi
@WorkerThread
@RequiresPermission(Manifest.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP)
public static boolean setCredentialManagementApp(@NonNull Context context,
@NonNull String packageName, @NonNull AppUriAuthenticationPolicy authenticationPolicy) {
try (KeyChainConnection keyChainConnection = KeyChain.bind(context)) {
keyChainConnection.getService()
.setCredentialManagementApp(packageName, authenticationPolicy);
return true;
} catch (RemoteException | InterruptedException e) {
Log.w(LOG, "Set credential management app failed", e);
Thread.currentThread().interrupt();
return false;
}
}
/**
* Called by the credential management app {@code CredentialManagementApp} to unregister as
* the credential management app and stop managing the user's credentials.
*
* All credentials previously installed by the credential management app will be removed
* from the user's device.
*
* An app holding {@code MANAGE_CREDENTIAL_MANAGEMENT_APP} permission can also call this
* method to remove the current credential management app, even if it's not the current
* credential management app itself.
*
* @return {@code true} if the credential management app was successfully removed.
*/
@WorkerThread
@RequiresPermission(value = Manifest.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP,
conditional = true)
public static boolean removeCredentialManagementApp(@NonNull Context context) {
try (KeyChainConnection keyChainConnection = KeyChain.bind(context)) {
keyChainConnection.getService().removeCredentialManagementApp();
return true;
} catch (RemoteException | InterruptedException e) {
Log.w(LOG, "Remove credential management app failed", e);
Thread.currentThread().interrupt();
return false;
}
}
private static class AliasResponse extends IKeyChainAliasCallback.Stub {
private final KeyChainAliasCallback keyChainAliasResponse;
private AliasResponse(KeyChainAliasCallback keyChainAliasResponse) {
this.keyChainAliasResponse = keyChainAliasResponse;
}
@Override public void alias(String alias) {
keyChainAliasResponse.alias(alias);
}
}
/**
* Returns the {@code PrivateKey} for the requested alias, or null if the alias does not exist
* or the caller has no permission to access it (see note on exceptions below).
*
* This method may block while waiting for a connection to another process, and must never
* be called from the main thread.
* As {@link Activity} and {@link Service} contexts are short-lived and can be destroyed
* at any time from the main thread, it is safer to rely on a long-lived context such as one
* returned from {@link Context#getApplicationContext()}.
*
* If the caller provides a valid alias to which it was not granted access, then the
* caller must invoke {@link #choosePrivateKeyAlias} again to get another valid alias
* or a grant to access the same alias.
* On Android versions prior to Q, when a key associated with the specified alias is
* unavailable, the method will throw a {@code KeyChainException} rather than return null.
* If the exception's cause (as obtained by calling {@code KeyChainException.getCause()})
* is a throwable of type {@code IllegalStateException} then the caller lacks a grant
* to access the key and certificates associated with this alias.
*
* @param alias The alias of the desired private key, typically returned via
* {@link KeyChainAliasCallback#alias}.
* @throws KeyChainException if the alias was valid but there was some problem accessing it.
* @throws IllegalStateException if called from the main thread.
*/
@Nullable @WorkerThread
public static PrivateKey getPrivateKey(@NonNull Context context, @NonNull String alias)
throws KeyChainException, InterruptedException {
KeyPair keyPair = getKeyPair(context, alias);
if (keyPair != null) {
return keyPair.getPrivate();
}
return null;
}
/**
* This prefix is used to disambiguate grant aliase strings from normal key alias strings.
* Technically, a key alias string can use the same prefix. However, a collision does not
* lead to privilege escalation, because grants are access controlled in the Keystore daemon.
* @hide
*/
public static final String GRANT_ALIAS_PREFIX = "ks2_keychain_grant_id:";
private static KeyDescriptor getGrantDescriptor(String keyid) {
KeyDescriptor result = new KeyDescriptor();
result.domain = Domain.GRANT;
result.blob = null;
result.alias = null;
try {
result.nspace = Long.parseUnsignedLong(
keyid.substring(GRANT_ALIAS_PREFIX.length()), 16 /* radix */);
} catch (NumberFormatException e) {
return null;
}
return result;
}
/** @hide */
public static String getGrantString(KeyDescriptor key) {
return String.format(GRANT_ALIAS_PREFIX + "%016X", key.nspace);
}
/** @hide */
@Nullable @WorkerThread
public static KeyPair getKeyPair(@NonNull Context context, @NonNull String alias)
throws KeyChainException, InterruptedException {
if (alias == null) {
throw new NullPointerException("alias == null");
}
if (context == null) {
throw new NullPointerException("context == null");
}
final String keyId;
try (KeyChainConnection keyChainConnection = bind(context.getApplicationContext())) {
keyId = keyChainConnection.getService().requestPrivateKey(alias);
} catch (RemoteException e) {
throw new KeyChainException(e);
} catch (RuntimeException e) {
// only certain RuntimeExceptions can be propagated across the IKeyChainService call
throw new KeyChainException(e);
}
if (keyId == null) {
return null;
}
try {
return android.security.keystore2.AndroidKeyStoreProvider
.loadAndroidKeyStoreKeyPairFromKeystore(
KeyStore2.getInstance(),
getGrantDescriptor(keyId));
} catch (UnrecoverableKeyException | KeyPermanentlyInvalidatedException e) {
throw new KeyChainException(e);
}
}
/**
* Returns the {@code X509Certificate} chain for the requested alias, or null if the alias
* does not exist or the caller has no permission to access it (see note on exceptions
* in {@link #getPrivateKey}).
*
*
* Note: If a certificate chain was explicitly specified when the alias was
* installed, this method will return that chain. If only the client certificate was specified
* at the installation time, this method will try to build a certificate chain using all
* available trust anchors (preinstalled and user-added).
*
* This method may block while waiting for a connection to another process, and must never
* be called from the main thread.
* As {@link Activity} and {@link Service} contexts are short-lived and can be destroyed
* at any time from the main thread, it is safer to rely on a long-lived context such as one
* returned from {@link Context#getApplicationContext()}.
* In case the caller specifies an alias for which it lacks a grant, it must call
* {@link #choosePrivateKeyAlias} again. See {@link #getPrivateKey} for more details on
* coping with this scenario.
*
* @param alias The alias of the desired certificate chain, typically
* returned via {@link KeyChainAliasCallback#alias}.
* @throws KeyChainException if the alias was valid but there was some problem accessing it.
* @throws IllegalStateException if called from the main thread.
*/
@Nullable @WorkerThread
public static X509Certificate[] getCertificateChain(@NonNull Context context,
@NonNull String alias) throws KeyChainException, InterruptedException {
if (alias == null) {
throw new NullPointerException("alias == null");
}
final byte[] certificateBytes;
final byte[] certChainBytes;
try (KeyChainConnection keyChainConnection = bind(context.getApplicationContext())) {
IKeyChainService keyChainService = keyChainConnection.getService();
certificateBytes = keyChainService.getCertificate(alias);
if (certificateBytes == null) {
return null;
}
certChainBytes = keyChainService.getCaCertificates(alias);
} catch (RemoteException e) {
throw new KeyChainException(e);
} catch (RuntimeException e) {
// only certain RuntimeExceptions can be propagated across the IKeyChainService call
throw new KeyChainException(e);
}
try {
X509Certificate leafCert = toCertificate(certificateBytes);
// If the keypair is installed with a certificate chain by either
// DevicePolicyManager.installKeyPair or CertInstaller, return that chain.
if (certChainBytes != null && certChainBytes.length != 0) {
Collection{@code
* PrivateKey key = ...; // private key from KeyChain
*
* KeyFactory keyFactory =
* KeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore");
* KeyInfo keyInfo = keyFactory.getKeySpec(key, KeyInfo.class);
* if (keyInfo.isInsideSecureHardware()) {
* // The key is bound to the secure hardware of this Android
* }}
*/
@Deprecated
public static boolean isBoundKeyAlgorithm(
@NonNull @KeyProperties.KeyAlgorithmEnum String algorithm) {
// All supported algorithms are hardware backed. Individual keys may not be.
return true;
}
/** @hide */
@NonNull
public static X509Certificate toCertificate(@NonNull byte[] bytes) {
if (bytes == null) {
throw new IllegalArgumentException("bytes == null");
}
try {
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
Certificate cert = certFactory.generateCertificate(new ByteArrayInputStream(bytes));
return (X509Certificate) cert;
} catch (CertificateException e) {
throw new AssertionError(e);
}
}
/** @hide */
@NonNull
public static Collection