Android KeyStore-密钥并非总是持久存在 [英] Android KeyStore - keys not always persisted

问题描述

在我的应用程序中，我们使用的是RSA密钥，该应用程序在首次启动时会生成(使用android密钥存储区).由于未知原因，该应用无法从某些设备上的密钥存储中检索密钥.我已经检查了日志，但找不到此错误与特定操作系统版本或特定设备型号之间的关联.另外，我肯定知道该应用程序仅在创建密钥后才尝试读取它.所以-我的问题是:据我所知，Android密钥存储区应该是持久性的.什么会导致这种错误?

In my app we are using RSA key, that the app generate (using android key store) on the first launch. From unknown reason, the app failed to retrieved the key from the key store on some of the devices. I've checked the logs, and I could not find a correlation between this bug to a specific OS version or to a specific device model. Also, I know for sure the app tried to read it only after the key created. So - my question is that: As far as I know, android key store should be persistent. What can cause such a bug?

下面是相关的代码示例.

Bellow are relevant code samples.

密钥生成:

try {
        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA", keyStore.getProvider());

        if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M){
            KeyGenParameterSpec spec;
            spec = new KeyGenParameterSpec.Builder(alias, KeyProperties.PURPOSE_DECRYPT | KeyProperties.PURPOSE_ENCRYPT| KeyProperties.PURPOSE_SIGN| KeyProperties.PURPOSE_VERIFY)
                    .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
                    .setSignaturePaddings(KeyProperties.SIGNATURE_PADDING_RSA_PKCS1)
                    .setKeySize(2048)
                    .build();

            generator.initialize(spec);
        } else {
            Calendar start = new GregorianCalendar();
            Calendar end = new GregorianCalendar();
            end.add(Calendar.YEAR, 500);

            KeyPairGeneratorSpec spec = new KeyPairGeneratorSpec.Builder(context)
                    .setAlias(alias)
                    .setSubject(new X500Principal("CN="+ subject))
                    .setSerialNumber(BigInteger.valueOf(new Random().nextInt(Integer.MAX_VALUE)))
                    .setStartDate(start.getTime())
                    .setEndDate(end.getTime())
                    .setKeySize(2048)
                    .build();

            generator.initialize(spec);
        }
        return generator.generateKeyPair();
    } catch (Exception e) {
        logger.warn("Failed to create private key in store", e);
        return null;
    }

密钥库本身使用以下代码初始化:

The keystore itself intialized using the following code:

KeyStore androidKeyStore = KeyStore.getInstance("AndroidKeyStore");
            androidKeyStore.load(null);
            return androidKeyStore;

我们使用以下代码来检索密钥，该错误是在某些设备上，密钥库返回null:

And we use the following code to retrieve the key, the bug is that on some devices the keystore returns null:

        try {
        Key key = keyStore.getKey(alias, null);

        if (key == null){
            logger.warn("Key not found in key store");
            return null;
        }

        if (key instanceof PrivateKey) {
            // Get certificate of public key
            Certificate cert = keyStore.getCertificate(alias);

            // Get public key
            PublicKey publicKey = cert.getPublicKey();

            // Return a key pair
            return new KeyPair(publicKey, (PrivateKey) key);
        } else {
            logger.warn("Key found, but not from current type. type found: " + key.getClass().getSimpleName());
        }
        return null;
    }catch (Exception e){
        logger.warn("Failed to get private key in store", e);
        return null;
    }

谢谢，厄默尔

推荐答案

是在生成后立即丢失密钥还是在一段时间后丢失了密钥?看看这个问题 AndroidKeyStore getEntry在某点之后始终失败a>链接到这篇出色的文章: http://doridori.github.io/android-security-the-forgetful-keystore/

Is it that you appear to lose your keys immediately after generation or some time later they are lost? Take a look at this question AndroidKeyStore getEntry is consistently failing after certain point which links to this great article: http://doridori.github.io/android-security-the-forgetful-keystore/

这个故事的寓意是，如果您使用AndroidKeyStore，准备在某些情况下丢失密钥！

The moral of this story is if you use the AndroidKeyStore be prepared to lose your keys under certain circumstances!

这篇关于Android KeyStore-密钥并非总是持久存在的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！