From 6f023640a3847540cff5282e82844e3d0c59fae1 Mon Sep 17 00:00:00 2001 From: Alex Klyubin Date: Wed, 22 Jul 2015 12:03:19 -0700 Subject: [PATCH] Document what algorithms Android Keystore supports. This updates the Android platform SDK documentation to list which algorithms are supported by Android Keystore on which Android platforms. The list is similar in design to the one in SSLSocket and SSLEngine. Bug: 22661043 Change-Id: I08fcf65ca58ead644100b673dceb93c67f34f507 --- docs/html/training/articles/keystore.jd | 467 +++++++++++++++++++++++- 1 file changed, 464 insertions(+), 3 deletions(-) diff --git a/docs/html/training/articles/keystore.jd b/docs/html/training/articles/keystore.jd index 52cb13eb5a03d..aa1ed0acb3a7e 100644 --- a/docs/html/training/articles/keystore.jd +++ b/docs/html/training/articles/keystore.jd @@ -7,14 +7,15 @@ page.title=Android Keystore System
  1. Security Features
  2. Choosing Between a Keychain or the Android Keystore Provider
    3. -
  3. Using Android Keystore Provider -
    4. +
  4. Using Android Keystore Provider
    1. Generating a New Private Key
    2. Working with Keystore Entries
    3. Listing Entries
    4. Signing and Verifying Data
    +
    5. +
  5. Supported Algorithms

Blog articles

@@ -27,6 +28,14 @@ page.title=Android Keystore System + +

The Android Keystore system lets you store cryptographic keys in a container to make it more difficult to extract from the device. Once keys are in the keystore, they can be used for cryptographic operations with the key material @@ -213,4 +222,456 @@ operate in one of the two modes: {@link android.hardware.fingerprint.FingerprintManager#hasEnrolledFingerprints() FingerprintManager.hasEnrolledFingerprints}). These keys become permanently invalidated once a new fingerprint is enrolled or all fingerprints are unenrolled. - \ No newline at end of file + + +

Supported Algorithms

+ + + +

Cipher

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
AlgorithmSupported (API Levels)Notes
AES/CBC/NoPadding23+
AES/CBC/PKCS7Padding23+
AES/CTR/NoPadding23+
AES/ECB/NoPadding23+
AES/ECB/PKCS7Padding23+
AES/GCM/NoPadding23+Only 12-byte long IVs supported.
RSA/ECB/NoPadding18+
RSA/ECB/PKCS1Padding18+
RSA/ECB/OAEPWithSHA-1AndMGF1Padding23+
RSA/ECB/OAEPWithSHA-224AndMGF1Padding23+
RSA/ECB/OAEPWithSHA-256AndMGF1Padding23+
RSA/ECB/OAEPWithSHA-384AndMGF1Padding23+
RSA/ECB/OAEPWithSHA-512AndMGF1Padding23+
RSA/ECB/OAEPPadding23+
+ +

KeyGenerator

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
AlgorithmSupported (API Levels)Notes
AES23+Supported sizes: 128, 192, 256
HmacSHA123+ +
    +
  • Supported sizes: 8--1024 (inclusive), must be multiple of 8
    • +
  • Default size: 160
    • +
      +
HmacSHA22423+ +
    +
  • Supported sizes: 8--1024 (inclusive), must be multiple of 8
    • +
  • Default size: 224
    • +
      +
HmacSHA25623+ +
    +
  • Supported sizes: 8--1024 (inclusive), must be multiple of 8
    • +
  • Default size: 256
    • +
      +
HmacSHA38423+ +
    +
  • Supported sizes: 8--1024 (inclusive), must be multiple of 8
    • +
  • Default size: 384
    • +
      +
HmacSHA51223+ +
    +
  • Supported sizes: 8--1024 (inclusive), must be multiple of 8
    • +
  • Default size: 512
    • +
      +
+ +

KeyFactory

+ + + + + + + + + + + + + + + + + + + + +
AlgorithmSupported (API Levels)Notes
EC23+Supported key specs: {@link android.security.keystore.KeyInfo} (private key only), + {@link java.security.spec.ECPublicKeySpec} (public key only), + {@link java.security.spec.X509EncodedKeySpec} (public key only) +
RSA23+Supported key specs: {@link android.security.keystore.KeyInfo} (private key only), + {@link java.security.spec.RSAPublicKeySpec} (public key only), + {@link java.security.spec.X509EncodedKeySpec} (public key only) +
+ +

KeyStore

+KeyStore supports the same key types as +{@code KeyPairGenerator} and +{@code KeyGenerator}. + +

KeyPairGenerator

+ + + + + + + + + + + + + + + + + + + + + + + + + +
AlgorithmSupported (API Levels)Notes
DSA19–22
EC23+ +
    +
  • Supported sizes: 224, 256, 384, 521
    • +
  • Supported named curves: P-224 (secp256r1), P-256 (aka secp256r1 and prime256v1), P-384 + (aka secp384r1), P-521 (aka secp521r1)
    • +
+ +

Prior to API Level 23, EC keys can be generated using KeyPairGenerator of algorithm "RSA" + initialized {@link android.security.KeyPairGeneratorSpec} whose key type is set to "EC" + using {@link android.security.KeyPairGeneratorSpec.Builder#setKeyType(String)}. EC curve + name cannot be specified using this method -- a NIST P-curve is automatically chosen based + on the requested key size. +

RSA18+ +
    +
  • Supported sizes: 512, 768, 1024, 2048, 3072, 4096
    • +
  • Supported public exponents: 3, 65537
    • +
  • Default public exponent: 65537
    • +
+
+ +

Mac

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
AlgorithmSupported (API Levels)Notes
HmacSHA123+
HmacSHA22423+
HmacSHA25623+
HmacSHA38423+
HmacSHA51223+
+ +

Signature

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
AlgorithmSupported (API Levels)Notes
MD5withRSA18+
NONEwithECDSA23+
NONEwithRSA18+
SHA1withDSA19–22
SHA1withECDSA19+
SHA1withRSA18+
SHA1withRSA/PSS23+
SHA224withDSA20–22
SHA224withECDSA20+
SHA224withRSA20+
SHA224withRSA/PSS23+
SHA256withDSA19–22
SHA256withECDSA19+
SHA256withRSA18+
SHA256withRSA/PSS23+
SHA384withDSA19–22
SHA384withECDSA19+
SHA384withRSA18+
SHA384withRSA/PSS23+
SHA512withDSA19–22
SHA512withECDSA19+
SHA512withRSA18+
SHA512withRSA/PSS23+
+ +

SecretKeyFactory

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
AlgorithmSupported (API Levels)Notes
AES23+Supported key specs: {@link android.security.keystore.KeyInfo}
HmacSHA123+Supported key specs: {@link android.security.keystore.KeyInfo}
HmacSHA22423+Supported key specs: {@link android.security.keystore.KeyInfo}
HmacSHA25623+Supported key specs: {@link android.security.keystore.KeyInfo}
HmacSHA38423+Supported key specs: {@link android.security.keystore.KeyInfo}
HmacSHA51223+Supported key specs: {@link android.security.keystore.KeyInfo}
\ No newline at end of file