com.google.crypto.tink.integration.android

Class AndroidKeystore

java.lang.Object

com.google.crypto.tink.integration.android.AndroidKeystore

public final class AndroidKeystore
extends Object

API to store and use AEAD keys in the Android Keystore.

Android Keystore is only supported on Android M (API level 23) or newer.

Warning: This API is not thread-safe.

Method Summary

Modifier and Type	Method and Description
static void	deleteKey(String alias) Deletes a key in Android Keystore if it exists.
static void	generateNewAes256GcmKey(String alias) Generates a new 256-bit AES-GCM key in Android Keystore, with the given alias.
static void	generateNewKeyWithSpec(KeyGenParameterSpec spec) Generates a new key in Android Keystore with the given KeyGenParameterSpec.
static Aead	getAead(String alias) Returns an Aead backed by a key in Android Keystore specified by alias.
static boolean	hasKey(String alias) Returns true if there is a key in Android Keystore.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

generateNewAes256GcmKey

@RequiresApi(value=23)
public static void generateNewAes256GcmKey(String alias)
                                                           throws GeneralSecurityException

Generates a new 256-bit AES-GCM key in Android Keystore, with the given alias.

Warning: Existing keys with the same alias will be overwritten.

Throws:

GeneralSecurityException

generateNewKeyWithSpec

@RequiresApi(value=23)
public static void generateNewKeyWithSpec(KeyGenParameterSpec spec)
                                                          throws GeneralSecurityException

Generates a new key in Android Keystore with the given KeyGenParameterSpec.

This can be used to generate keys with Android Keystore specific properties. It is the user's responsibility to ensure that the values in the KeyGenParameterSpec are correctly set.

Warning: Existing keys with the same alias will be overwritten.

Throws:

GeneralSecurityException

getAead

public static Aead getAead(String alias)
                    throws GeneralSecurityException

Returns an Aead backed by a key in Android Keystore specified by alias.

Warning: Android Keystore can only handle a limited number of requests in parallel. If too many calls are made at the same time, both encrypt or decrypt may fail with a GeneralSecurityException. But if you avoid calling keystore from many threads at the same time, then such failures are unlikely and retrying is not necessary.

See KeyStore2 for more information.

If decryption throws a BadPaddingException (which includes AEADBadTagException), then the ciphertext is not decryptable and retrying will not help.

Throws:

GeneralSecurityException

deleteKey

public static void deleteKey(String alias)
                      throws GeneralSecurityException

Deletes a key in Android Keystore if it exists.

Throws:

GeneralSecurityException

hasKey

public static boolean hasKey(String alias)
                      throws GeneralSecurityException

Returns true if there is a key in Android Keystore.

Throws:

GeneralSecurityException