Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keystore 2.0 SPI: Make Recoverable keystore tolerate the Keystore 2.0 SPI

Browse Source 
This patch adds support for using the Legacy Keystore provider when the
Keystore 2.0 provider is installed. This is the first step
towards the transition to Keystore 2.0.

Installation of the new provider can be triggered by setting the
platform property ro.android.security.keystore2.enable=true.

Bug: 171305545
Test: None
Change-Id: I3825f40558b4c25cb64caa25c0029cea76333c44
This commit is contained in:
Janis Danisevskis
2020-10-20 09:30:51 -07:00
parent a637f2771d
commit 2ed9b9b276
2 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/core/java/com/android/server/locksettings/recoverablekeystore/KeyStoreProxyImpl.java
View File

@@ -16,23 +16,38 @@
package com.android.server.locksettings.recoverablekeystore;
import android.security.keystore2.AndroidKeyStoreProvider;
import java.io.IOException;
import java.security.cert.CertificateException;
import java.security.Key;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
/**
* Implementation of {@link KeyStoreProxy} that delegates all method calls to the {@link KeyStore}.
*/
public class KeyStoreProxyImpl implements KeyStoreProxy {
private static final String ANDROID_KEY_STORE_PROVIDER = "AndroidKeyStore";
private final KeyStore mKeyStore;
/**
* TODO This function redirects keystore access to the legacy keystore during a transitional
* phase during which not all calling code has been adjusted to use Keystore 2.0.
* This can be reverted to a constant of "AndroidKeyStore" when b/171305684 is complete.
* The specific bug for this component is b/171305545.
*/
static String androidKeystoreProviderName() {
if (AndroidKeyStoreProvider.isInstalled()) {
return "AndroidKeyStoreLegacy";
} else {
return "AndroidKeyStore";
}
}
/**
* A new instance, delegating to {@code keyStore}.
*/
@@ -69,7 +84,7 @@ public class KeyStoreProxyImpl implements KeyStoreProxy {
* @throws KeyStoreException if there was a problem getting or initializing the key store.
*/
public static KeyStore getAndLoadAndroidKeyStore() throws KeyStoreException {
KeyStore keyStore = KeyStore.getInstance(ANDROID_KEY_STORE_PROVIDER);
KeyStore keyStore = KeyStore.getInstance(androidKeystoreProviderName());
try {
keyStore.load(/*param=*/ null);
} catch (CertificateException | IOException | NoSuchAlgorithmException e) {

4
services/core/java/com/android/server/locksettings/recoverablekeystore/PlatformKeyManager.java
View File

@@ -86,8 +86,6 @@ public class PlatformKeyManager {
private final KeyStoreProxy mKeyStore;
private final RecoverableKeyStoreDb mDatabase;
private static final String ANDROID_KEY_STORE_PROVIDER = "AndroidKeyStore";
/**
* A new instance operating on behalf of {@code userId}, storing its prefs in the location
* defined by {@code context}.
@@ -486,7 +484,7 @@ public class PlatformKeyManager {
* @throws KeyStoreException if there was a problem getting or initializing the key store.
*/
private static KeyStore getAndLoadAndroidKeyStore() throws KeyStoreException {
KeyStore keyStore = KeyStore.getInstance(ANDROID_KEY_STORE_PROVIDER);
KeyStore keyStore = KeyStore.getInstance(KeyStoreProxyImpl.androidKeystoreProviderName());
try {
keyStore.load(/*param=*/ null);
} catch (CertificateException | IOException | NoSuchAlgorithmException e) {