Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't fail if self-signed certificate can't be signed.

Browse Source 
This makes Android Keystore's KeyPairGenerator fall back to generating
a self-signed certificate with an invalid/fake signature when the
attempt to generate a self-signed certificate with a valid signature
fails.

There is a growing number of reasons/authorizations due to which the
generated private key cannot be used to sign the self-signed
certificate. It's safer for KeyPairGenerator to succeed than to fail.

Bug: 22033161
Change-Id: I1ecbd421346166bfd536b5cfbaea169b11f0b1c8
This commit is contained in:
Alex Klyubin
2015-06-23 10:54:44 -07:00
parent 6d2268a576
commit 856aebe571
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java
View File

@@ -515,15 +515,23 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
return generateSelfSignedCertificateWithFakeSignature(publicKey);
} else {
// Key can be used to sign a certificate
return generateSelfSignedCertificateWithValidSignature(
privateKey, publicKey, signatureAlgorithm);
try {
return generateSelfSignedCertificateWithValidSignature(
privateKey, publicKey, signatureAlgorithm);
} catch (Exception e) {
// Failed to generate the self-signed certificate with valid signature. Fall back
// to generating a self-signed certificate with a fake signature. This is done for
// all exception types because we prefer key pair generation to succeed and end up
// producing a self-signed certificate with an invalid signature to key pair
// generation failing.
return generateSelfSignedCertificateWithFakeSignature(publicKey);
}
}
}
@SuppressWarnings("deprecation")
private X509Certificate generateSelfSignedCertificateWithValidSignature(
PrivateKey privateKey, PublicKey publicKey, String signatureAlgorithm)
throws Exception {
PrivateKey privateKey, PublicKey publicKey, String signatureAlgorithm) throws Exception {
final X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
certGen.setPublicKey(publicKey);
certGen.setSerialNumber(mSpec.getCertificateSerialNumber());

2
keystore/java/android/security/keystore/KeyGenParameterSpec.java
View File

@@ -71,6 +71,8 @@ import javax.security.auth.x500.X500Principal;
* <li>{@link KeyProperties#PURPOSE_SIGN},</li>
* <li>operation without requiring the user to be authenticated (see
* {@link Builder#setUserAuthenticationRequired(boolean)}),</li>
* <li>signing/origination at this moment in time (see {@link Builder#setKeyValidityStart(Date)}
* and {@link Builder#setKeyValidityForOriginationEnd(Date)}),</li>
* <li>suitable digest or {@link KeyProperties#DIGEST_NONE},</li>
* <li>(RSA keys only) padding scheme {@link KeyProperties#SIGNATURE_PADDING_RSA_PKCS1} or
* {@link KeyProperties#ENCRYPTION_PADDING_NONE}.</li>