From 9b3e005a4ebd94af2d234cc5470e9691437d3888 Mon Sep 17 00:00:00 2001 From: Alex Klyubin Date: Mon, 13 Apr 2015 11:12:57 -0700 Subject: [PATCH] Unhide the new AndroidKeyStore API. Bug: 18088752 Change-Id: I93f87cbb1cd04a4a2e34f3d544d678c92cf052ee --- api/current.txt | 195 ++++++++++++++++++ api/system-current.txt | 195 ++++++++++++++++++ docs/html/training/articles/keystore.jd | 21 +- .../security/CryptoOperationException.java | 2 - .../android/security/EcIesParameterSpec.java | 6 +- .../android/security/KeyExpiredException.java | 2 - .../android/security/KeyGeneratorSpec.java | 16 +- .../security/KeyNotYetValidException.java | 2 - .../security/KeyPairGeneratorSpec.java | 50 ----- .../security/KeyStoreKeyGeneratorSpi.java | 2 +- .../security/KeyStoreKeyProperties.java | 2 - .../android/security/KeyStoreKeySpec.java | 2 - .../android/security/KeyStoreParameter.java | 51 ----- .../NewFingerprintEnrolledException.java | 2 - .../UserNotAuthenticatedException.java | 2 - 15 files changed, 414 insertions(+), 136 deletions(-) diff --git a/api/current.txt b/api/current.txt index 66c0447867bd6..bec686dab7e02 100644 --- a/api/current.txt +++ b/api/current.txt @@ -28040,6 +28040,43 @@ package android.sax { package android.security { + public class CryptoOperationException extends java.lang.RuntimeException { + ctor public CryptoOperationException(); + ctor public CryptoOperationException(java.lang.String); + ctor public CryptoOperationException(java.lang.String, java.lang.Throwable); + ctor public CryptoOperationException(java.lang.Throwable); + } + + public class EcIesParameterSpec implements java.security.spec.AlgorithmParameterSpec { + method public int getDemCipherKeySize(); + method public java.lang.String getDemCipherTransformation(); + method public java.lang.String getDemMacAlgorithm(); + method public int getDemMacKeySize(); + method public java.lang.String getKemKdfAlgorithm(); + method public int getKemPointFormat(); + field public static final android.security.EcIesParameterSpec DEFAULT; + } + + public static class EcIesParameterSpec.Builder { + ctor public EcIesParameterSpec.Builder(); + method public android.security.EcIesParameterSpec build(); + method public android.security.EcIesParameterSpec.Builder setDemCipherKeySize(int); + method public android.security.EcIesParameterSpec.Builder setDemCipherTransformation(java.lang.String); + method public android.security.EcIesParameterSpec.Builder setDemMacAlgorithm(java.lang.String); + method public android.security.EcIesParameterSpec.Builder setDemMacKeySize(int); + method public android.security.EcIesParameterSpec.Builder setKemKdfAlgorithm(java.lang.String); + method public android.security.EcIesParameterSpec.Builder setKemPointFormat(int); + } + + public static abstract class EcIesParameterSpec.PointFormat { + field public static final int COMPRESSED = 1; // 0x1 + field public static final int UNCOMPRESSED = 0; // 0x0 + field public static final int UNSPECIFIED = -1; // 0xffffffff + } + + public static abstract class EcIesParameterSpec.PointFormatEnum implements java.lang.annotation.Annotation { + } + public final class KeyChain { ctor public KeyChain(); method public static void choosePrivateKeyAlias(android.app.Activity, android.security.KeyChainAliasCallback, java.lang.String[], java.security.Principal[], java.lang.String, int, java.lang.String); @@ -28066,17 +28103,77 @@ package android.security { ctor public KeyChainException(java.lang.Throwable); } + public class KeyExpiredException extends android.security.CryptoOperationException { + ctor public KeyExpiredException(); + ctor public KeyExpiredException(java.lang.String); + ctor public KeyExpiredException(java.lang.String, java.lang.Throwable); + } + + public class KeyGeneratorSpec implements java.security.spec.AlgorithmParameterSpec { + method public java.lang.String[] getBlockModes(); + method public android.content.Context getContext(); + method public java.lang.String[] getEncryptionPaddings(); + method public int getKeySize(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); + method public java.lang.String getKeystoreAlias(); + method public int getPurposes(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); + method public boolean isEncryptionRequired(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isRandomizedEncryptionRequired(); + } + + public static class KeyGeneratorSpec.Builder { + ctor public KeyGeneratorSpec.Builder(android.content.Context); + method public android.security.KeyGeneratorSpec build(); + method public android.security.KeyGeneratorSpec.Builder setAlias(java.lang.String); + method public android.security.KeyGeneratorSpec.Builder setBlockModes(java.lang.String...); + method public android.security.KeyGeneratorSpec.Builder setEncryptionPaddings(java.lang.String...); + method public android.security.KeyGeneratorSpec.Builder setEncryptionRequired(boolean); + method public android.security.KeyGeneratorSpec.Builder setInvalidatedOnNewFingerprintEnrolled(boolean); + method public android.security.KeyGeneratorSpec.Builder setKeySize(int); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityEnd(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityForConsumptionEnd(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityForOriginationEnd(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityStart(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setPurposes(int); + method public android.security.KeyGeneratorSpec.Builder setRandomizedEncryptionRequired(boolean); + method public android.security.KeyGeneratorSpec.Builder setUserAuthenticationValidityDurationSeconds(int); + method public android.security.KeyGeneratorSpec.Builder setUserAuthenticators(int); + } + + public class KeyNotYetValidException extends android.security.CryptoOperationException { + ctor public KeyNotYetValidException(); + ctor public KeyNotYetValidException(java.lang.String); + ctor public KeyNotYetValidException(java.lang.String, java.lang.Throwable); + } + public final class KeyPairGeneratorSpec implements java.security.spec.AlgorithmParameterSpec { method public java.security.spec.AlgorithmParameterSpec getAlgorithmParameterSpec(); + method public java.lang.String[] getBlockModes(); method public android.content.Context getContext(); + method public java.lang.String[] getDigests(); + method public java.lang.String[] getEncryptionPaddings(); method public java.util.Date getEndDate(); method public int getKeySize(); method public java.lang.String getKeyType(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); method public java.lang.String getKeystoreAlias(); + method public int getPurposes(); method public java.math.BigInteger getSerialNumber(); + method public java.lang.String[] getSignaturePaddings(); method public java.util.Date getStartDate(); method public javax.security.auth.x500.X500Principal getSubjectDN(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); method public boolean isEncryptionRequired(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isRandomizedEncryptionRequired(); } public static final class KeyPairGeneratorSpec.Builder { @@ -28084,23 +28181,110 @@ package android.security { method public android.security.KeyPairGeneratorSpec build(); method public android.security.KeyPairGeneratorSpec.Builder setAlgorithmParameterSpec(java.security.spec.AlgorithmParameterSpec); method public android.security.KeyPairGeneratorSpec.Builder setAlias(java.lang.String); + method public android.security.KeyPairGeneratorSpec.Builder setBlockModes(java.lang.String...); + method public android.security.KeyPairGeneratorSpec.Builder setDigests(java.lang.String...); + method public android.security.KeyPairGeneratorSpec.Builder setEncryptionPaddings(java.lang.String...); method public android.security.KeyPairGeneratorSpec.Builder setEncryptionRequired(); method public android.security.KeyPairGeneratorSpec.Builder setEndDate(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setInvalidatedOnNewFingerprintEnrolled(boolean); method public android.security.KeyPairGeneratorSpec.Builder setKeySize(int); method public android.security.KeyPairGeneratorSpec.Builder setKeyType(java.lang.String) throws java.security.NoSuchAlgorithmException; + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityEnd(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityForConsumptionEnd(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityForOriginationEnd(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityStart(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setPurposes(int); + method public android.security.KeyPairGeneratorSpec.Builder setRandomizedEncryptionRequired(boolean); method public android.security.KeyPairGeneratorSpec.Builder setSerialNumber(java.math.BigInteger); + method public android.security.KeyPairGeneratorSpec.Builder setSignaturePaddings(java.lang.String...); method public android.security.KeyPairGeneratorSpec.Builder setStartDate(java.util.Date); method public android.security.KeyPairGeneratorSpec.Builder setSubject(javax.security.auth.x500.X500Principal); + method public android.security.KeyPairGeneratorSpec.Builder setUserAuthenticationValidityDurationSeconds(int); + method public android.security.KeyPairGeneratorSpec.Builder setUserAuthenticators(int); + } + + public abstract class KeyStoreKeyProperties { + } + + public static abstract class KeyStoreKeyProperties.Origin { + field public static final int GENERATED = 1; // 0x1 + field public static final int IMPORTED = 2; // 0x2 + } + + public static abstract class KeyStoreKeyProperties.OriginEnum implements java.lang.annotation.Annotation { + } + + public static abstract class KeyStoreKeyProperties.Purpose { + field public static final int DECRYPT = 2; // 0x2 + field public static final int ENCRYPT = 1; // 0x1 + field public static final int SIGN = 4; // 0x4 + field public static final int VERIFY = 8; // 0x8 + } + + public static abstract class KeyStoreKeyProperties.PurposeEnum implements java.lang.annotation.Annotation { + } + + public static abstract class KeyStoreKeyProperties.UserAuthenticator { + field public static final int FINGERPRINT_READER = 2; // 0x2 + field public static final int LOCK_SCREEN = 1; // 0x1 + } + + public static abstract class KeyStoreKeyProperties.UserAuthenticatorEnum implements java.lang.annotation.Annotation { + } + + public class KeyStoreKeySpec implements java.security.spec.KeySpec { + method public java.lang.String[] getBlockModes(); + method public java.lang.String[] getDigests(); + method public java.lang.String[] getEncryptionPaddings(); + method public int getKeySize(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); + method public java.lang.String getKeystoreAlias(); + method public int getOrigin(); + method public int getPurposes(); + method public java.lang.String[] getSignaturePaddings(); + method public int getTeeEnforcedUserAuthenticators(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isTeeBacked(); } public final class KeyStoreParameter implements java.security.KeyStore.ProtectionParameter { + method public java.lang.String[] getBlockModes(); + method public java.lang.String[] getDigests(); + method public java.lang.String[] getEncryptionPaddings(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); + method public int getPurposes(); + method public java.lang.String[] getSignaturePaddings(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); + method public boolean isDigestsSpecified(); method public boolean isEncryptionRequired(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isRandomizedEncryptionRequired(); } public static final class KeyStoreParameter.Builder { ctor public KeyStoreParameter.Builder(android.content.Context); method public android.security.KeyStoreParameter build(); + method public android.security.KeyStoreParameter.Builder setBlockModes(java.lang.String...); + method public android.security.KeyStoreParameter.Builder setDigests(java.lang.String...); + method public android.security.KeyStoreParameter.Builder setEncryptionPaddings(java.lang.String...); method public android.security.KeyStoreParameter.Builder setEncryptionRequired(boolean); + method public android.security.KeyStoreParameter.Builder setInvalidatedOnNewFingerprintEnrolled(boolean); + method public android.security.KeyStoreParameter.Builder setKeyValidityEnd(java.util.Date); + method public android.security.KeyStoreParameter.Builder setKeyValidityForConsumptionEnd(java.util.Date); + method public android.security.KeyStoreParameter.Builder setKeyValidityForOriginationEnd(java.util.Date); + method public android.security.KeyStoreParameter.Builder setKeyValidityStart(java.util.Date); + method public android.security.KeyStoreParameter.Builder setPurposes(int); + method public android.security.KeyStoreParameter.Builder setRandomizedEncryptionRequired(boolean); + method public android.security.KeyStoreParameter.Builder setSignaturePaddings(java.lang.String...); + method public android.security.KeyStoreParameter.Builder setUserAuthenticationValidityDurationSeconds(int); + method public android.security.KeyStoreParameter.Builder setUserAuthenticators(int); } public class NetworkSecurityPolicy { @@ -28108,6 +28292,17 @@ package android.security { method public boolean isCleartextTrafficPermitted(); } + public class NewFingerprintEnrolledException extends android.security.CryptoOperationException { + ctor public NewFingerprintEnrolledException(); + ctor public NewFingerprintEnrolledException(java.lang.String); + } + + public class UserNotAuthenticatedException extends android.security.CryptoOperationException { + ctor public UserNotAuthenticatedException(); + ctor public UserNotAuthenticatedException(java.lang.String); + ctor public UserNotAuthenticatedException(java.lang.String, java.lang.Throwable); + } + } package android.service.carrier { diff --git a/api/system-current.txt b/api/system-current.txt index 7694bf563c19c..2cfa9a7eade01 100644 --- a/api/system-current.txt +++ b/api/system-current.txt @@ -30040,6 +30040,43 @@ package android.sax { package android.security { + public class CryptoOperationException extends java.lang.RuntimeException { + ctor public CryptoOperationException(); + ctor public CryptoOperationException(java.lang.String); + ctor public CryptoOperationException(java.lang.String, java.lang.Throwable); + ctor public CryptoOperationException(java.lang.Throwable); + } + + public class EcIesParameterSpec implements java.security.spec.AlgorithmParameterSpec { + method public int getDemCipherKeySize(); + method public java.lang.String getDemCipherTransformation(); + method public java.lang.String getDemMacAlgorithm(); + method public int getDemMacKeySize(); + method public java.lang.String getKemKdfAlgorithm(); + method public int getKemPointFormat(); + field public static final android.security.EcIesParameterSpec DEFAULT; + } + + public static class EcIesParameterSpec.Builder { + ctor public EcIesParameterSpec.Builder(); + method public android.security.EcIesParameterSpec build(); + method public android.security.EcIesParameterSpec.Builder setDemCipherKeySize(int); + method public android.security.EcIesParameterSpec.Builder setDemCipherTransformation(java.lang.String); + method public android.security.EcIesParameterSpec.Builder setDemMacAlgorithm(java.lang.String); + method public android.security.EcIesParameterSpec.Builder setDemMacKeySize(int); + method public android.security.EcIesParameterSpec.Builder setKemKdfAlgorithm(java.lang.String); + method public android.security.EcIesParameterSpec.Builder setKemPointFormat(int); + } + + public static abstract class EcIesParameterSpec.PointFormat { + field public static final int COMPRESSED = 1; // 0x1 + field public static final int UNCOMPRESSED = 0; // 0x0 + field public static final int UNSPECIFIED = -1; // 0xffffffff + } + + public static abstract class EcIesParameterSpec.PointFormatEnum implements java.lang.annotation.Annotation { + } + public final class KeyChain { ctor public KeyChain(); method public static void choosePrivateKeyAlias(android.app.Activity, android.security.KeyChainAliasCallback, java.lang.String[], java.security.Principal[], java.lang.String, int, java.lang.String); @@ -30066,17 +30103,77 @@ package android.security { ctor public KeyChainException(java.lang.Throwable); } + public class KeyExpiredException extends android.security.CryptoOperationException { + ctor public KeyExpiredException(); + ctor public KeyExpiredException(java.lang.String); + ctor public KeyExpiredException(java.lang.String, java.lang.Throwable); + } + + public class KeyGeneratorSpec implements java.security.spec.AlgorithmParameterSpec { + method public java.lang.String[] getBlockModes(); + method public android.content.Context getContext(); + method public java.lang.String[] getEncryptionPaddings(); + method public int getKeySize(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); + method public java.lang.String getKeystoreAlias(); + method public int getPurposes(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); + method public boolean isEncryptionRequired(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isRandomizedEncryptionRequired(); + } + + public static class KeyGeneratorSpec.Builder { + ctor public KeyGeneratorSpec.Builder(android.content.Context); + method public android.security.KeyGeneratorSpec build(); + method public android.security.KeyGeneratorSpec.Builder setAlias(java.lang.String); + method public android.security.KeyGeneratorSpec.Builder setBlockModes(java.lang.String...); + method public android.security.KeyGeneratorSpec.Builder setEncryptionPaddings(java.lang.String...); + method public android.security.KeyGeneratorSpec.Builder setEncryptionRequired(boolean); + method public android.security.KeyGeneratorSpec.Builder setInvalidatedOnNewFingerprintEnrolled(boolean); + method public android.security.KeyGeneratorSpec.Builder setKeySize(int); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityEnd(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityForConsumptionEnd(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityForOriginationEnd(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setKeyValidityStart(java.util.Date); + method public android.security.KeyGeneratorSpec.Builder setPurposes(int); + method public android.security.KeyGeneratorSpec.Builder setRandomizedEncryptionRequired(boolean); + method public android.security.KeyGeneratorSpec.Builder setUserAuthenticationValidityDurationSeconds(int); + method public android.security.KeyGeneratorSpec.Builder setUserAuthenticators(int); + } + + public class KeyNotYetValidException extends android.security.CryptoOperationException { + ctor public KeyNotYetValidException(); + ctor public KeyNotYetValidException(java.lang.String); + ctor public KeyNotYetValidException(java.lang.String, java.lang.Throwable); + } + public final class KeyPairGeneratorSpec implements java.security.spec.AlgorithmParameterSpec { method public java.security.spec.AlgorithmParameterSpec getAlgorithmParameterSpec(); + method public java.lang.String[] getBlockModes(); method public android.content.Context getContext(); + method public java.lang.String[] getDigests(); + method public java.lang.String[] getEncryptionPaddings(); method public java.util.Date getEndDate(); method public int getKeySize(); method public java.lang.String getKeyType(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); method public java.lang.String getKeystoreAlias(); + method public int getPurposes(); method public java.math.BigInteger getSerialNumber(); + method public java.lang.String[] getSignaturePaddings(); method public java.util.Date getStartDate(); method public javax.security.auth.x500.X500Principal getSubjectDN(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); method public boolean isEncryptionRequired(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isRandomizedEncryptionRequired(); } public static final class KeyPairGeneratorSpec.Builder { @@ -30084,23 +30181,110 @@ package android.security { method public android.security.KeyPairGeneratorSpec build(); method public android.security.KeyPairGeneratorSpec.Builder setAlgorithmParameterSpec(java.security.spec.AlgorithmParameterSpec); method public android.security.KeyPairGeneratorSpec.Builder setAlias(java.lang.String); + method public android.security.KeyPairGeneratorSpec.Builder setBlockModes(java.lang.String...); + method public android.security.KeyPairGeneratorSpec.Builder setDigests(java.lang.String...); + method public android.security.KeyPairGeneratorSpec.Builder setEncryptionPaddings(java.lang.String...); method public android.security.KeyPairGeneratorSpec.Builder setEncryptionRequired(); method public android.security.KeyPairGeneratorSpec.Builder setEndDate(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setInvalidatedOnNewFingerprintEnrolled(boolean); method public android.security.KeyPairGeneratorSpec.Builder setKeySize(int); method public android.security.KeyPairGeneratorSpec.Builder setKeyType(java.lang.String) throws java.security.NoSuchAlgorithmException; + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityEnd(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityForConsumptionEnd(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityForOriginationEnd(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setKeyValidityStart(java.util.Date); + method public android.security.KeyPairGeneratorSpec.Builder setPurposes(int); + method public android.security.KeyPairGeneratorSpec.Builder setRandomizedEncryptionRequired(boolean); method public android.security.KeyPairGeneratorSpec.Builder setSerialNumber(java.math.BigInteger); + method public android.security.KeyPairGeneratorSpec.Builder setSignaturePaddings(java.lang.String...); method public android.security.KeyPairGeneratorSpec.Builder setStartDate(java.util.Date); method public android.security.KeyPairGeneratorSpec.Builder setSubject(javax.security.auth.x500.X500Principal); + method public android.security.KeyPairGeneratorSpec.Builder setUserAuthenticationValidityDurationSeconds(int); + method public android.security.KeyPairGeneratorSpec.Builder setUserAuthenticators(int); + } + + public abstract class KeyStoreKeyProperties { + } + + public static abstract class KeyStoreKeyProperties.Origin { + field public static final int GENERATED = 1; // 0x1 + field public static final int IMPORTED = 2; // 0x2 + } + + public static abstract class KeyStoreKeyProperties.OriginEnum implements java.lang.annotation.Annotation { + } + + public static abstract class KeyStoreKeyProperties.Purpose { + field public static final int DECRYPT = 2; // 0x2 + field public static final int ENCRYPT = 1; // 0x1 + field public static final int SIGN = 4; // 0x4 + field public static final int VERIFY = 8; // 0x8 + } + + public static abstract class KeyStoreKeyProperties.PurposeEnum implements java.lang.annotation.Annotation { + } + + public static abstract class KeyStoreKeyProperties.UserAuthenticator { + field public static final int FINGERPRINT_READER = 2; // 0x2 + field public static final int LOCK_SCREEN = 1; // 0x1 + } + + public static abstract class KeyStoreKeyProperties.UserAuthenticatorEnum implements java.lang.annotation.Annotation { + } + + public class KeyStoreKeySpec implements java.security.spec.KeySpec { + method public java.lang.String[] getBlockModes(); + method public java.lang.String[] getDigests(); + method public java.lang.String[] getEncryptionPaddings(); + method public int getKeySize(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); + method public java.lang.String getKeystoreAlias(); + method public int getOrigin(); + method public int getPurposes(); + method public java.lang.String[] getSignaturePaddings(); + method public int getTeeEnforcedUserAuthenticators(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isTeeBacked(); } public final class KeyStoreParameter implements java.security.KeyStore.ProtectionParameter { + method public java.lang.String[] getBlockModes(); + method public java.lang.String[] getDigests(); + method public java.lang.String[] getEncryptionPaddings(); + method public java.util.Date getKeyValidityForConsumptionEnd(); + method public java.util.Date getKeyValidityForOriginationEnd(); + method public java.util.Date getKeyValidityStart(); + method public int getPurposes(); + method public java.lang.String[] getSignaturePaddings(); + method public int getUserAuthenticationValidityDurationSeconds(); + method public int getUserAuthenticators(); + method public boolean isDigestsSpecified(); method public boolean isEncryptionRequired(); + method public boolean isInvalidatedOnNewFingerprintEnrolled(); + method public boolean isRandomizedEncryptionRequired(); } public static final class KeyStoreParameter.Builder { ctor public KeyStoreParameter.Builder(android.content.Context); method public android.security.KeyStoreParameter build(); + method public android.security.KeyStoreParameter.Builder setBlockModes(java.lang.String...); + method public android.security.KeyStoreParameter.Builder setDigests(java.lang.String...); + method public android.security.KeyStoreParameter.Builder setEncryptionPaddings(java.lang.String...); method public android.security.KeyStoreParameter.Builder setEncryptionRequired(boolean); + method public android.security.KeyStoreParameter.Builder setInvalidatedOnNewFingerprintEnrolled(boolean); + method public android.security.KeyStoreParameter.Builder setKeyValidityEnd(java.util.Date); + method public android.security.KeyStoreParameter.Builder setKeyValidityForConsumptionEnd(java.util.Date); + method public android.security.KeyStoreParameter.Builder setKeyValidityForOriginationEnd(java.util.Date); + method public android.security.KeyStoreParameter.Builder setKeyValidityStart(java.util.Date); + method public android.security.KeyStoreParameter.Builder setPurposes(int); + method public android.security.KeyStoreParameter.Builder setRandomizedEncryptionRequired(boolean); + method public android.security.KeyStoreParameter.Builder setSignaturePaddings(java.lang.String...); + method public android.security.KeyStoreParameter.Builder setUserAuthenticationValidityDurationSeconds(int); + method public android.security.KeyStoreParameter.Builder setUserAuthenticators(int); } public class NetworkSecurityPolicy { @@ -30108,6 +30292,17 @@ package android.security { method public boolean isCleartextTrafficPermitted(); } + public class NewFingerprintEnrolledException extends android.security.CryptoOperationException { + ctor public NewFingerprintEnrolledException(); + ctor public NewFingerprintEnrolledException(java.lang.String); + } + + public class UserNotAuthenticatedException extends android.security.CryptoOperationException { + ctor public UserNotAuthenticatedException(); + ctor public UserNotAuthenticatedException(java.lang.String); + ctor public UserNotAuthenticatedException(java.lang.String, java.lang.Throwable); + } + } package android.service.carrier { diff --git a/docs/html/training/articles/keystore.jd b/docs/html/training/articles/keystore.jd index bbbda67e6fd01..a4fc2d23adfe5 100644 --- a/docs/html/training/articles/keystore.jd +++ b/docs/html/training/articles/keystore.jd @@ -26,11 +26,10 @@ page.title=Android Keystore System -

The Android Keystore system lets you store private keys - in a container to make it more difficult to extract from the - device. Once keys are in the keystore, they can be used for - cryptographic operations with the private key material remaining - non-exportable.

+

The Android Keystore system lets you store cryptographic keys in a container + to make it more difficult to extract from the device. Once keys are in the + keystore, they can be used for cryptographic operations with the key material + remaining non-exportable.

The Keystore system is used by the {@link android.security.KeyChain} API as well as the Android @@ -59,7 +58,8 @@ Android Keystore Provider

To use this feature, you use the standard {@link java.security.KeyStore} -and {@link java.security.KeyPairGenerator} classes along with the +and {@link java.security.KeyPairGenerator} or +{@link javax.crypto.KeyGenerator} classes along with the {@code AndroidKeyStore} provider introduced in Android 4.3 (API level 18).

{@code AndroidKeyStore} is registered as a {@link @@ -67,7 +67,9 @@ and {@link java.security.KeyPairGenerator} classes along with the java.security.KeyStore#getInstance(String) KeyStore.getInstance(type)} method and as a provider for use with the {@link java.security.KeyPairGenerator#getInstance(String, String) - KeyPairGenerator.getInstance(algorithm, provider)} method.

+ KeyPairGenerator.getInstance(algorithm, provider)} and {@link + javax.crypto.KeyGenerator#getInstance(String, String) + KeyGenerator.getInstance(algorithm, provider)} methods.

Generating a New Private Key

@@ -81,6 +83,11 @@ and {@link java.security.KeyPairGenerator} classes along with the {@sample development/samples/ApiDemos/src/com/example/android/apis/security/KeyStoreUsage.java generate} +

Generating a New Secret Key

+ +

To generate the key, use a {@link javax.crypto.KeyGenerator} with + {@link android.security.KeyGeneratorSpec}. +

Working with Keystore Entries

Using the {@code AndroidKeyStore} provider takes place through diff --git a/keystore/java/android/security/CryptoOperationException.java b/keystore/java/android/security/CryptoOperationException.java index 00c142fbec9d3..1c9d005e00f9f 100644 --- a/keystore/java/android/security/CryptoOperationException.java +++ b/keystore/java/android/security/CryptoOperationException.java @@ -25,8 +25,6 @@ package android.security; * permitted to throw a checked exception during operation. Because crypto operations can fail * for a variety of reasons after initialization, this base class provides type-safety for unchecked * exceptions that may be thrown in those cases. - * - * @hide */ public class CryptoOperationException extends RuntimeException { diff --git a/keystore/java/android/security/EcIesParameterSpec.java b/keystore/java/android/security/EcIesParameterSpec.java index 0f198127cd3c2..38266795f38ed 100644 --- a/keystore/java/android/security/EcIesParameterSpec.java +++ b/keystore/java/android/security/EcIesParameterSpec.java @@ -46,8 +46,6 @@ import javax.crypto.Mac; * MAC algorithm specified by {@link #getDemMacAlgorithm()} (e.g., {@code HmacSHA1} for standard * DEM1). * - * - * @hide */ public class EcIesParameterSpec implements AlgorithmParameterSpec { @@ -124,6 +122,8 @@ public class EcIesParameterSpec implements AlgorithmParameterSpec { /** * Returns KEM EC curve name (e.g., {@code secp256r1}) or {@code null} if not specified. + * + * @hide */ public String getKemCurveName() { return mKemCurveName; @@ -200,6 +200,8 @@ public class EcIesParameterSpec implements AlgorithmParameterSpec { * Sets KEM EC curve name. For example, {@code P-256} or {@code secp256r1}. * *

NOTE: Only curves with cofactor of {@code 1} are supported. + * + * @hide */ public Builder setKemCurveName(String name) { mKemCurveName = name; diff --git a/keystore/java/android/security/KeyExpiredException.java b/keystore/java/android/security/KeyExpiredException.java index 35a5accbc94c7..a02dc33c489cd 100644 --- a/keystore/java/android/security/KeyExpiredException.java +++ b/keystore/java/android/security/KeyExpiredException.java @@ -19,8 +19,6 @@ package android.security; /** * Indicates that a cryptographic operation failed because the employed key's validity end date * is in the past. - * - * @hide */ public class KeyExpiredException extends CryptoOperationException { diff --git a/keystore/java/android/security/KeyGeneratorSpec.java b/keystore/java/android/security/KeyGeneratorSpec.java index 22db83e6759f2..7ecc47e4014f4 100644 --- a/keystore/java/android/security/KeyGeneratorSpec.java +++ b/keystore/java/android/security/KeyGeneratorSpec.java @@ -37,15 +37,13 @@ import javax.crypto.SecretKey; *

After generation, the {@code keyStoreAlias} is used with the * {@link java.security.KeyStore#getEntry(String, java.security.KeyStore.ProtectionParameter)} * interface to retrieve the {@link SecretKey}. - * - * @hide */ public class KeyGeneratorSpec implements AlgorithmParameterSpec { private final Context mContext; private final String mKeystoreAlias; private final int mFlags; - private final Integer mKeySize; + private final int mKeySize; private final Date mKeyValidityStart; private final Date mKeyValidityForOriginationEnd; private final Date mKeyValidityForConsumptionEnd; @@ -61,7 +59,7 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { Context context, String keyStoreAlias, int flags, - Integer keySize, + int keySize, Date keyValidityStart, Date keyValidityForOriginationEnd, Date keyValidityForConsumptionEnd, @@ -122,9 +120,9 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { } /** - * Gets the requested key size or {@code null} if the default size should be used. + * Returns the requested key size or {@code -1} if default size should be used. */ - public Integer getKeySize() { + public int getKeySize() { return mKeySize; } @@ -216,8 +214,6 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { * authenticators protecting access to this key. * * @see #getUserAuthenticators() - * - * @hide */ public boolean isInvalidatedOnNewFingerprintEnrolled() { return mInvalidatedOnNewFingerprintEnrolled; @@ -234,7 +230,7 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { private final Context mContext; private String mKeystoreAlias; private int mFlags; - private Integer mKeySize; + private int mKeySize = -1; private Date mKeyValidityStart; private Date mKeyValidityForOriginationEnd; private Date mKeyValidityForConsumptionEnd; @@ -460,8 +456,6 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { *

By default, enrolling a new fingerprint does not invalidate the key. * * @see #setUserAuthenticators(Set) - * - * @hide */ public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) { mInvalidatedOnNewFingerprintEnrolled = invalidated; diff --git a/keystore/java/android/security/KeyNotYetValidException.java b/keystore/java/android/security/KeyNotYetValidException.java index f1c2cac672b93..964cd7ed24dfc 100644 --- a/keystore/java/android/security/KeyNotYetValidException.java +++ b/keystore/java/android/security/KeyNotYetValidException.java @@ -19,8 +19,6 @@ package android.security; /** * Indicates that a cryptographic operation failed because the employed key's validity start date * is in the future. - * - * @hide */ public class KeyNotYetValidException extends CryptoOperationException { diff --git a/keystore/java/android/security/KeyPairGeneratorSpec.java b/keystore/java/android/security/KeyPairGeneratorSpec.java index ed2d8568ad88b..e297d26a013ce 100644 --- a/keystore/java/android/security/KeyPairGeneratorSpec.java +++ b/keystore/java/android/security/KeyPairGeneratorSpec.java @@ -311,8 +311,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * Gets the time instant before which the key pair is not yet valid. * * @return instant or {@code null} if not restricted. - * - * @hide */ public Date getKeyValidityStart() { return mKeyValidityStart; @@ -323,8 +321,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * verification. * * @return instant or {@code null} if not restricted. - * - * @hide */ public Date getKeyValidityForConsumptionEnd() { return mKeyValidityForConsumptionEnd; @@ -334,8 +330,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * Gets the time instant after which the key pair is no longer valid for encryption and signing. * * @return instant or {@code null} if not restricted. - * - * @hide */ public Date getKeyValidityForOriginationEnd() { return mKeyValidityForOriginationEnd; @@ -343,8 +337,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { /** * Gets the set of purposes for which the key can be used. - * - * @hide */ public @KeyStoreKeyProperties.PurposeEnum int getPurposes() { return mPurposes; @@ -352,8 +344,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { /** * Gets the set of digest algorithms with which the key can be used. - * - * @hide */ public String[] getDigests() { return ArrayUtils.cloneIfNotEmpty(mDigests); @@ -361,8 +351,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { /** * Gets the set of padding schemes with which the key can be used when encrypting/decrypting. - * - * @hide */ public String[] getEncryptionPaddings() { return ArrayUtils.cloneIfNotEmpty(mEncryptionPaddings); @@ -370,8 +358,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { /** * Gets the set of padding schemes with which the key can be used when signing/verifying. - * - * @hide */ public String[] getSignaturePaddings() { return ArrayUtils.cloneIfNotEmpty(mSignaturePaddings); @@ -379,8 +365,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { /** * Gets the set of block modes with which the key can be used. - * - * @hide */ public String[] getBlockModes() { return ArrayUtils.cloneIfNotEmpty(mBlockModes); @@ -394,8 +378,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * weaknesses due to which ciphertext may leak information about plaintext. For example, if a * given plaintext always produces the same ciphertext, an attacker may see the repeated * ciphertexts and be able to deduce something about the plaintext. - * - * @hide */ public boolean isRandomizedEncryptionRequired() { return mRandomizedEncryptionRequired; @@ -409,8 +391,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * restricted. * * @return user authenticators or {@code 0} if the key can be used without user authentication. - * - * @hide */ public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() { return mUserAuthenticators; @@ -425,8 +405,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication * is required for every use of the key. - * - * @hide */ public int getUserAuthenticationValidityDurationSeconds() { return mUserAuthenticationValidityDurationSeconds; @@ -438,8 +416,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * authenticators protecting access to this key. * * @see #getUserAuthenticators() - * - * @hide */ public boolean isInvalidatedOnNewFingerprintEnrolled() { return mInvalidatedOnNewFingerprintEnrolled; @@ -642,8 +618,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { *

By default, the key is valid at any instant. * * @see #setKeyValidityEnd(Date) - * - * @hide */ public Builder setKeyValidityStart(Date startDate) { mKeyValidityStart = startDate; @@ -658,8 +632,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * @see #setKeyValidityStart(Date) * @see #setKeyValidityForConsumptionEnd(Date) * @see #setKeyValidityForOriginationEnd(Date) - * - * @hide */ public Builder setKeyValidityEnd(Date endDate) { setKeyValidityForOriginationEnd(endDate); @@ -673,8 +645,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { *

By default, the key is valid at any instant. * * @see #setKeyValidityForConsumptionEnd(Date) - * - * @hide */ public Builder setKeyValidityForOriginationEnd(Date endDate) { mKeyValidityForOriginationEnd = endDate; @@ -688,8 +658,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { *

By default, the key is valid at any instant. * * @see #setKeyValidityForOriginationEnd(Date) - * - * @hide */ public Builder setKeyValidityForConsumptionEnd(Date endDate) { mKeyValidityForConsumptionEnd = endDate; @@ -700,8 +668,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * Sets the set of purposes for which the key can be used. * *

This must be specified for all keys. There is no default. - * - * @hide */ public Builder setPurposes(@KeyStoreKeyProperties.PurposeEnum int purposes) { mPurposes = purposes; @@ -713,8 +679,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * to use the key with any other digest will be rejected. * *

This must be specified for keys which are used for signing/verification. - * - * @hide */ public Builder setDigests(String... digests) { mDigests = ArrayUtils.cloneIfNotEmpty(digests); @@ -727,8 +691,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * rejected. * *

This must be specified for keys which are used for encryption/decryption. - * - * @hide */ public Builder setEncryptionPaddings(String... paddings) { mEncryptionPaddings = ArrayUtils.cloneIfNotEmpty(paddings); @@ -741,8 +703,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * rejected. * *

This must be specified for RSA keys which are used for signing/verification. - * - * @hide */ public Builder setSignaturePaddings(String... paddings) { mSignaturePaddings = ArrayUtils.cloneIfNotEmpty(paddings); @@ -754,8 +714,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * Attempts to use the key with any other block modes will be rejected. * *

This must be specified for encryption/decryption keys. - * - * @hide */ public Builder setBlockModes(String... blockModes) { mBlockModes = ArrayUtils.cloneIfNotEmpty(blockModes); @@ -781,8 +739,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { *

  • If you are using RSA encryption without padding, consider switching to padding * schemes which offer {@code IND-CPA}, such as PKCS#1 or OAEP.
    • * - * - * @hide */ public Builder setRandomizedEncryptionRequired(boolean required) { mRandomizedEncryptionRequired = required; @@ -802,8 +758,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * without user authentication. * * @see #setUserAuthenticationValidityDurationSeconds(int) - * - * @hide */ public Builder setUserAuthenticators( @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators) { @@ -824,8 +778,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * every use of the key. * * @see #setUserAuthenticators(int) - * - * @hide */ public Builder setUserAuthenticationValidityDurationSeconds(int seconds) { mUserAuthenticationValidityDurationSeconds = seconds; @@ -840,8 +792,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { *

    By default, enrolling a new fingerprint does not invalidate the key. * * @see #setUserAuthenticators(Set) - * - * @hide */ public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) { mInvalidatedOnNewFingerprintEnrolled = invalidated; diff --git a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java index 3b2804531283c..72c485ad56d91 100644 --- a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java +++ b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java @@ -133,7 +133,7 @@ public abstract class KeyStoreKeyGeneratorSpi extends KeyGeneratorSpi { throw new IllegalStateException("Digest algorithm must be specified for HMAC key"); } } - int keySizeBits = (spec.getKeySize() != null) ? spec.getKeySize() : mDefaultKeySizeBits; + int keySizeBits = (spec.getKeySize() != -1) ? spec.getKeySize() : mDefaultKeySizeBits; args.addInt(KeymasterDefs.KM_TAG_KEY_SIZE, keySizeBits); @KeyStoreKeyProperties.PurposeEnum int purposes = spec.getPurposes(); int[] keymasterBlockModes = KeymasterUtils.getKeymasterBlockModesFromJcaBlockModes( diff --git a/keystore/java/android/security/KeyStoreKeyProperties.java b/keystore/java/android/security/KeyStoreKeyProperties.java index 7f3f1a4a487d3..b1f330f355ef9 100644 --- a/keystore/java/android/security/KeyStoreKeyProperties.java +++ b/keystore/java/android/security/KeyStoreKeyProperties.java @@ -27,8 +27,6 @@ import java.util.Collection; /** * Properties of {@code AndroidKeyStore} keys. - * - * @hide */ public abstract class KeyStoreKeyProperties { private KeyStoreKeyProperties() {} diff --git a/keystore/java/android/security/KeyStoreKeySpec.java b/keystore/java/android/security/KeyStoreKeySpec.java index 2ff1a64381bf0..a89e4dd0f5b10 100644 --- a/keystore/java/android/security/KeyStoreKeySpec.java +++ b/keystore/java/android/security/KeyStoreKeySpec.java @@ -22,8 +22,6 @@ import java.util.Date; /** * Information about a key from the Android * KeyStore. - * - * @hide */ public class KeyStoreKeySpec implements KeySpec { private final String mKeystoreAlias; diff --git a/keystore/java/android/security/KeyStoreParameter.java b/keystore/java/android/security/KeyStoreParameter.java index a04bc6c882a37..c24b74f42e202 100644 --- a/keystore/java/android/security/KeyStoreParameter.java +++ b/keystore/java/android/security/KeyStoreParameter.java @@ -108,7 +108,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * Gets the time instant before which the key is not yet valid. * * @return instant or {@code null} if not restricted. - * @hide */ public Date getKeyValidityStart() { return mKeyValidityStart; @@ -118,8 +117,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * Gets the time instant after which the key is no long valid for decryption and verification. * * @return instant or {@code null} if not restricted. - * - * @hide */ public Date getKeyValidityForConsumptionEnd() { return mKeyValidityForConsumptionEnd; @@ -129,8 +126,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * Gets the time instant after which the key is no long valid for encryption and signing. * * @return instant or {@code null} if not restricted. - * - * @hide */ public Date getKeyValidityForOriginationEnd() { return mKeyValidityForOriginationEnd; @@ -138,8 +133,6 @@ public final class KeyStoreParameter implements ProtectionParameter { /** * Gets the set of purposes for which the key can be used. - * - * @hide */ public @KeyStoreKeyProperties.PurposeEnum int getPurposes() { return mPurposes; @@ -147,8 +140,6 @@ public final class KeyStoreParameter implements ProtectionParameter { /** * Gets the set of padding schemes with which the key can be used when encrypting/decrypting. - * - * @hide */ public String[] getEncryptionPaddings() { return ArrayUtils.cloneIfNotEmpty(mEncryptionPaddings); @@ -157,8 +148,6 @@ public final class KeyStoreParameter implements ProtectionParameter { /** * Gets the set of padding schemes with which the key can be used when signing or verifying * signatures. - * - * @hide */ public String[] getSignaturePaddings() { return ArrayUtils.cloneIfNotEmpty(mSignaturePaddings); @@ -170,8 +159,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * @throws IllegalStateException if this set has not been specified. * * @see #isDigestsSpecified() - * - * @hide */ public String[] getDigests() { if (mDigests == null) { @@ -185,8 +172,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * specified. * * @see #getDigests() - * - * @hide */ public boolean isDigestsSpecified() { return mDigests != null; @@ -194,8 +179,6 @@ public final class KeyStoreParameter implements ProtectionParameter { /** * Gets the set of block modes with which the key can be used. - * - * @hide */ public String[] getBlockModes() { return ArrayUtils.cloneIfNotEmpty(mBlockModes); @@ -209,8 +192,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * weaknesses due to which ciphertext may leak information about plaintext. For example, if a * given plaintext always produces the same ciphertext, an attacker may see the repeated * ciphertexts and be able to deduce something about the plaintext. - * - * @hide */ public boolean isRandomizedEncryptionRequired() { return mRandomizedEncryptionRequired; @@ -221,8 +202,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * used iff the user has authenticated to at least one of these user authenticators. * * @return user authenticators or {@code 0} if the key can be used without user authentication. - * - * @hide */ public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() { return mUserAuthenticators; @@ -234,8 +213,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication * is required for every use of the key. - * - * @hide */ public int getUserAuthenticationValidityDurationSeconds() { return mUserAuthenticationValidityDurationSeconds; @@ -247,8 +224,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * authenticators protecting access to this key. * * @see #getUserAuthenticators() - * - * @hide */ public boolean isInvalidatedOnNewFingerprintEnrolled() { return mInvalidatedOnNewFingerprintEnrolled; @@ -321,8 +296,6 @@ public final class KeyStoreParameter implements ProtectionParameter { *

    By default, the key is valid at any instant. * * @see #setKeyValidityEnd(Date) - * - * @hide */ public Builder setKeyValidityStart(Date startDate) { mKeyValidityStart = startDate; @@ -337,8 +310,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * @see #setKeyValidityStart(Date) * @see #setKeyValidityForConsumptionEnd(Date) * @see #setKeyValidityForOriginationEnd(Date) - * - * @hide */ public Builder setKeyValidityEnd(Date endDate) { setKeyValidityForOriginationEnd(endDate); @@ -352,8 +323,6 @@ public final class KeyStoreParameter implements ProtectionParameter { *

    By default, the key is valid at any instant. * * @see #setKeyValidityForConsumptionEnd(Date) - * - * @hide */ public Builder setKeyValidityForOriginationEnd(Date endDate) { mKeyValidityForOriginationEnd = endDate; @@ -367,8 +336,6 @@ public final class KeyStoreParameter implements ProtectionParameter { *

    By default, the key is valid at any instant. * * @see #setKeyValidityForOriginationEnd(Date) - * - * @hide */ public Builder setKeyValidityForConsumptionEnd(Date endDate) { mKeyValidityForConsumptionEnd = endDate; @@ -379,8 +346,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * Sets the set of purposes for which the key can be used. * *

    This must be specified for all keys. There is no default. - * - * @hide */ public Builder setPurposes(@KeyStoreKeyProperties.PurposeEnum int purposes) { mPurposes = purposes; @@ -393,8 +358,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * rejected. * *

    This must be specified for keys which are used for encryption/decryption. - * - * @hide */ public Builder setEncryptionPaddings(String... paddings) { mEncryptionPaddings = ArrayUtils.cloneIfNotEmpty(paddings); @@ -407,8 +370,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * rejected. * *

    This must be specified for RSA keys which are used for signing/verification. - * - * @hide */ public Builder setSignaturePaddings(String... paddings) { mSignaturePaddings = ArrayUtils.cloneIfNotEmpty(paddings); @@ -422,8 +383,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * *

    For HMAC keys, the default is the digest specified in {@link Key#getAlgorithm()}. For * asymmetric signing keys this constraint must be specified. - * - * @hide */ public Builder setDigests(String... digests) { mDigests = ArrayUtils.cloneIfNotEmpty(digests); @@ -435,8 +394,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * Attempts to use the key with any other block modes will be rejected. * *

    This must be specified for encryption/decryption keys. - * - * @hide */ public Builder setBlockModes(String... blockModes) { mBlockModes = ArrayUtils.cloneIfNotEmpty(blockModes); @@ -476,8 +433,6 @@ public final class KeyStoreParameter implements ProtectionParameter { *

  • If you are using RSA encryption without padding, consider switching to padding * schemes which offer {@code IND-CPA}, such as PKCS#1 or OAEP.
    • * - * - * @hide */ public Builder setRandomizedEncryptionRequired(boolean required) { mRandomizedEncryptionRequired = required; @@ -494,8 +449,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * without user authentication. * * @see #setUserAuthenticationValidityDurationSeconds(int) - * - * @hide */ public Builder setUserAuthenticators( @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators) { @@ -513,8 +466,6 @@ public final class KeyStoreParameter implements ProtectionParameter { * every use of the key. * * @see #setUserAuthenticators(int) - * - * @hide */ public Builder setUserAuthenticationValidityDurationSeconds(int seconds) { mUserAuthenticationValidityDurationSeconds = seconds; @@ -529,8 +480,6 @@ public final class KeyStoreParameter implements ProtectionParameter { *

    By default, enrolling a new fingerprint does not invalidate the key. * * @see #setUserAuthenticators(Set) - * - * @hide */ public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) { mInvalidatedOnNewFingerprintEnrolled = invalidated; diff --git a/keystore/java/android/security/NewFingerprintEnrolledException.java b/keystore/java/android/security/NewFingerprintEnrolledException.java index 6da4a2a194001..806b214d5f44d 100644 --- a/keystore/java/android/security/NewFingerprintEnrolledException.java +++ b/keystore/java/android/security/NewFingerprintEnrolledException.java @@ -19,8 +19,6 @@ package android.security; /** * Indicates that a cryptographic operation could not be performed because the key used by the * operation is permanently invalid because a new fingerprint was enrolled. - * - * @hide */ public class NewFingerprintEnrolledException extends CryptoOperationException { diff --git a/keystore/java/android/security/UserNotAuthenticatedException.java b/keystore/java/android/security/UserNotAuthenticatedException.java index e6342ef79673d..f5f5f41d941eb 100644 --- a/keystore/java/android/security/UserNotAuthenticatedException.java +++ b/keystore/java/android/security/UserNotAuthenticatedException.java @@ -19,8 +19,6 @@ package android.security; /** * Indicates that a cryptographic operation could not be performed because the user has not been * authenticated recently enough. - * - * @hide */ public class UserNotAuthenticatedException extends CryptoOperationException {