# Print output for @column tags ?>
public
class
KeyInfo
extends Object
implements
KeySpec
java.lang.Object | |
↳ | android.security.keystore.KeyInfo |
Information about a key from the Android
Keystore system. This class describes whether the key material is available in
plaintext outside of secure hardware, whether user authentication is required for using the key
and whether this requirement is enforced by secure hardware, the key's origin, what uses the key
is authorized for (e.g., only in GCM
mode, or signing only), whether the key should be
encrypted at rest, the key's and validity start and end dates.
Instances of this class are immutable.
KeyInfo
describing the provided Android
Keystore SecretKey
.
SecretKey key = ...; // Android Keystore key
SecretKeyFactory factory = SecretKeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore");
KeyInfo keyInfo;
try {
keyInfo = (KeyInfo) factory.getKeySpec(key, KeyInfo.class);
} catch (InvalidKeySpecException e) {
// Not an Android KeyStore key.
}
KeyInfo
describing the provided
Android KeyStore PrivateKey
.
PrivateKey key = ...; // Android KeyStore key
KeyFactory factory = KeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore");
KeyInfo keyInfo;
try {
keyInfo = factory.getKeySpec(key, KeyInfo.class);
} catch (InvalidKeySpecException e) {
// Not an Android KeyStore key.
}
Public methods | |
---|---|
String[]
|
getBlockModes()
Gets the set of block modes (e.g., |
String[]
|
getDigests()
Gets the set of digest algorithms (e.g., |
String[]
|
getEncryptionPaddings()
Gets the set of padding schemes (e.g., |
int
|
getKeySize()
Gets the size of the key in bits. |
Date
|
getKeyValidityForConsumptionEnd()
Gets the time instant after which the key is no long valid for decryption and verification. |
Date
|
getKeyValidityForOriginationEnd()
Gets the time instant after which the key is no long valid for encryption and signing. |
Date
|
getKeyValidityStart()
Gets the time instant before which the key is not yet valid. |
String
|
getKeystoreAlias()
Gets the entry alias under which the key is stored in the |
int
|
getOrigin()
Gets the origin of the key. |
int
|
getPurposes()
Gets the set of purposes (e.g., encrypt, decrypt, sign) for which the key can be used. |
String[]
|
getSignaturePaddings()
Gets the set of padding schemes (e.g., |
int
|
getUserAuthenticationType()
Gets the acceptable user authentication types for which this key can be authorized to be used. |
int
|
getUserAuthenticationValidityDurationSeconds()
Gets the duration of time (seconds) for which this key is authorized to be used after the user is successfully authenticated. |
boolean
|
isInsideSecureHardware()
Returns |
boolean
|
isInvalidatedByBiometricEnrollment()
Returns |
boolean
|
isTrustedUserPresenceRequired()
Returns |
boolean
|
isUserAuthenticationRequired()
Returns |
boolean
|
isUserAuthenticationRequirementEnforcedBySecureHardware()
Returns |
boolean
|
isUserAuthenticationValidWhileOnBody()
Returns |
boolean
|
isUserConfirmationRequired()
Returns |
Inherited methods | |
---|---|
public String[] getBlockModes ()
Gets the set of block modes (e.g., GCM
, CBC
) with which the key can be used
when encrypting/decrypting. Attempts to use the key with any other block modes will be
rejected.
See KeyProperties
.BLOCK_MODE
constants.
Returns | |
---|---|
String[] |
This value cannot be null .
Value is KeyProperties.BLOCK_MODE_ECB , KeyProperties.BLOCK_MODE_CBC , KeyProperties.BLOCK_MODE_CTR , or KeyProperties.BLOCK_MODE_GCM |
public String[] getDigests ()
Gets the set of digest algorithms (e.g., SHA-256
, SHA-384
) with which the key
can be used.
See KeyProperties
.DIGEST
constants.
Returns | |
---|---|
String[] |
This value cannot be null .
Value is KeyProperties.DIGEST_NONE , KeyProperties.DIGEST_MD5 , KeyProperties.DIGEST_SHA1 , KeyProperties.DIGEST_SHA224 , KeyProperties.DIGEST_SHA256 , KeyProperties.DIGEST_SHA384 , or KeyProperties.DIGEST_SHA512 |
public String[] getEncryptionPaddings ()
Gets the set of padding schemes (e.g., PKCS7Padding
, PKCS1Padding
,
NoPadding
) with which the key can be used when encrypting/decrypting. Attempts to use
the key with any other padding scheme will be rejected.
See KeyProperties
.ENCRYPTION_PADDING
constants.
Returns | |
---|---|
String[] |
This value cannot be null .
Value is KeyProperties.ENCRYPTION_PADDING_NONE , KeyProperties.ENCRYPTION_PADDING_PKCS7 , KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1 , or KeyProperties.ENCRYPTION_PADDING_RSA_OAEP |
public int getKeySize ()
Gets the size of the key in bits.
Returns | |
---|---|
int |
public Date getKeyValidityForConsumptionEnd ()
Gets the time instant after which the key is no long valid for decryption and verification.
Returns | |
---|---|
Date |
instant or null if not restricted. |
public Date getKeyValidityForOriginationEnd ()
Gets the time instant after which the key is no long valid for encryption and signing.
Returns | |
---|---|
Date |
instant or null if not restricted. |
public Date getKeyValidityStart ()
Gets the time instant before which the key is not yet valid.
Returns | |
---|---|
Date |
instant or null if not restricted. |
public String getKeystoreAlias ()
Gets the entry alias under which the key is stored in the AndroidKeyStore
.
Returns | |
---|---|
String |
public int getOrigin ()
Gets the origin of the key. See KeyProperties
.ORIGIN
constants.
Returns | |
---|---|
int |
Value is KeyProperties.ORIGIN_GENERATED , KeyProperties.ORIGIN_IMPORTED , or KeyProperties.ORIGIN_UNKNOWN |
public int getPurposes ()
Gets the set of purposes (e.g., encrypt, decrypt, sign) for which the key can be used. Attempts to use the key for any other purpose will be rejected.
See KeyProperties
.PURPOSE
flags.
Returns | |
---|---|
int |
Value is either 0 or a combination of KeyProperties.PURPOSE_ENCRYPT , KeyProperties.PURPOSE_DECRYPT , KeyProperties.PURPOSE_SIGN , KeyProperties.PURPOSE_VERIFY , and KeyProperties.PURPOSE_WRAP_KEY |
public String[] getSignaturePaddings ()
Gets the set of padding schemes (e.g., PSS
, PKCS#1
) with which the key
can be used when signing/verifying. Attempts to use the key with any other padding scheme
will be rejected.
See KeyProperties
.SIGNATURE_PADDING
constants.
Returns | |
---|---|
String[] |
This value cannot be null .
Value is KeyProperties.SIGNATURE_PADDING_RSA_PKCS1 , or KeyProperties.SIGNATURE_PADDING_RSA_PSS |
public int getUserAuthenticationType ()
Gets the acceptable user authentication types for which this key can be authorized to be
used. This has effect only if user authentication is required (see
isUserAuthenticationRequired()
).
This authorization applies only to secret key and private key operations. Public key operations are not restricted.
Returns | |
---|---|
int |
integer representing the accepted forms of user authentication for this key
Value is either 0 or a combination of KeyProperties.AUTH_BIOMETRIC_STRONG , and KeyProperties.AUTH_DEVICE_CREDENTIAL |
See also:
public int getUserAuthenticationValidityDurationSeconds ()
Gets the duration of time (seconds) for which this key is authorized to be used after the
user is successfully authenticated. This has effect only if user authentication is required
(see isUserAuthenticationRequired()
).
This authorization applies only to secret key and private key operations. Public key operations are not restricted.
Returns | |
---|---|
int |
duration in seconds or -1 if authentication is required for every use of the
key. |
See also:
public boolean isInsideSecureHardware ()
Returns true
if the key resides inside secure hardware (e.g., Trusted Execution
Environment (TEE) or Secure Element (SE)). Key material of such keys is available in
plaintext only inside the secure hardware and is not exposed outside of it.
Returns | |
---|---|
boolean |
public boolean isInvalidatedByBiometricEnrollment ()
Returns true
if the key will be invalidated by enrollment of a new fingerprint or
removal of all fingerprints.
Returns | |
---|---|
boolean |
public boolean isTrustedUserPresenceRequired ()
Returns true
if the key can only be only be used if a test for user presence has
succeeded since Signature.initSign() has been called.
Returns | |
---|---|
boolean |
public boolean isUserAuthenticationRequired ()
Returns true
if the key is authorized to be used only if the user has been
authenticated.
This authorization applies only to secret key and private key operations. Public key operations are not restricted.
Returns | |
---|---|
boolean |
public boolean isUserAuthenticationRequirementEnforcedBySecureHardware ()
Returns true
if the requirement that this key can only be used if the user has been
authenticated is enforced by secure hardware (e.g., Trusted Execution Environment (TEE) or
Secure Element (SE)).
Returns | |
---|---|
boolean |
See also:
public boolean isUserAuthenticationValidWhileOnBody ()
Returns true
if this key will become unusable when the device is removed from the
user's body. This is possible only for keys with a specified validity duration, and only on
devices with an on-body sensor. Always returns false
on devices that lack an on-body
sensor.
Returns | |
---|---|
boolean |
public boolean isUserConfirmationRequired ()
Returns true
if the key is authorized to be used only for messages confirmed by the
user.
Confirmation is separate from user authentication (see
isUserAuthenticationRequired()
). Keys can be created that require confirmation but
not user authentication, or user authentication but not confirmation, or both. Confirmation
verifies that some user with physical possession of the device has approved a displayed
message. User authentication verifies that the correct user is present and has
authenticated.
This authorization applies only to secret key and private key operations. Public key operations are not restricted.
Returns | |
---|---|
boolean |