KeyChain

ACTION_STORAGE_CHANGED

String ACTION_STORAGE_CHANGED

Broadcast Action: Indicates the trusted storage has changed. Sent when one of this happens:

• a new CA is added,
• an existing CA is removed or disabled,
• a disabled CA is enabled,
• trusted storage is reset (all user certs are cleared),
• when permission to access a private key is changed.

Constant Value: "android.security.STORAGE_CHANGED"

EXTRA_CERTIFICATE

String EXTRA_CERTIFICATE

Optional extra to specify an X.509 certificate to install on the Intent returned by createInstallIntent(). The extra value should be a PEM or ASN.1 DER encoded byte[]. An X509Certificate can be converted to DER encoded bytes with getEncoded().

EXTRA_NAME may be used to provide a default alias name for the installed certificate.

Constant Value: "CERT"

EXTRA_NAME

String EXTRA_NAME

Optional extra to specify a String credential name on the Intent returned by createInstallIntent().

Constant Value: "name"

EXTRA_PKCS12

String EXTRA_PKCS12

Optional extra for use with the Intent returned by createInstallIntent() to specify a PKCS#12 key store to install. The extra value should be a byte[]. The bytes may come from an external source or be generated with store(OutputStream, char[]) on a "PKCS12" instance.

The user will be prompted for the password to load the key store.

The key store will be scanned for KeyStore.PrivateKeyEntry entries and both the private key and associated certificate chain will be installed.

EXTRA_NAME may be used to provide a default alias name for the installed credentials.

Constant Value: "PKCS12"

KeyChain

KeyChain ()

choosePrivateKeyAlias

void choosePrivateKeyAlias (Activity activity, 
                KeyChainAliasCallback response, 
                String[] keyTypes, 
                Principal[] issuers, 
                String host, 
                int port, 
                String alias)

Launches an Activity for the user to select the alias for a private key and certificate pair for authentication. The selected alias or null will be returned via the KeyChainAliasCallback callback.

The device or profile owner can intercept this before the activity is shown, to pick a specific private key alias.

keyTypes and issuers may be used to highlight suggested choices to the user, although to cope with sometimes erroneous values provided by servers, the user may be able to override these suggestions.

host and port may be used to give the user more context about the server requesting the credentials.

alias allows the chooser to preselect an existing alias which will still be subject to user confirmation.

choosePrivateKeyAlias

void choosePrivateKeyAlias (Activity activity, 
                KeyChainAliasCallback response, 
                String[] keyTypes, 
                Principal[] issuers, 
                Uri uri, 
                String alias)

Launches an Activity for the user to select the alias for a private key and certificate pair for authentication. The selected alias or null will be returned via the KeyChainAliasCallback callback.

The device or profile owner can intercept this before the activity is shown, to pick a specific private key alias.

keyTypes and issuers may be used to highlight suggested choices to the user, although to cope with sometimes erroneous values provided by servers, the user may be able to override these suggestions.

host and port may be used to give the user more context about the server requesting the credentials.

alias allows the chooser to preselect an existing alias which will still be subject to user confirmation.

createInstallIntent

Intent createInstallIntent ()

Returns an Intent that can be used for credential installation. The intent may be used without any extras, in which case the user will be able to install credentials from their own source.

Alternatively, EXTRA_CERTIFICATE or EXTRA_PKCS12 maybe used to specify the bytes of an X.509 certificate or a PKCS#12 key store for installation. These extras may be combined with EXTRA_NAME to provide a default alias name for credentials being installed.

When used with startActivityForResult(Intent, int), RESULT_OK will be returned if a credential was successfully installed, otherwise RESULT_CANCELED will be returned.

getCertificateChain

X509Certificate[] getCertificateChain (Context context, 
                String alias)

Returns the X509Certificate chain for the requested alias, or null if there is no result.

Note: If a certificate chain was explicitly specified when the alias was installed, this method will return that chain. If only the client certificate was specified at the installation time, this method will try to build a certificate chain using all available trust anchors (preinstalled and user-added).

This method may block while waiting for a connection to another process, and must never be called from the main thread.

getPrivateKey

PrivateKey getPrivateKey (Context context, 
                String alias)

Returns the PrivateKey for the requested alias, or null if there is no result.

This method may block while waiting for a connection to another process, and must never be called from the main thread.

isBoundKeyAlgorithm

boolean isBoundKeyAlgorithm (String algorithm)

This method was deprecated in API level 23.
Whether the key is bound to the secure hardware is known only once the key has been imported. To find out, use:

PrivateKey key = ...; // private key from KeyChain

 KeyFactory keyFactory =
     KeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore");
 KeyInfo keyInfo = keyFactory.getKeySpec(key, KeyInfo.class);
 if (keyInfo.isInsideSecureHardware()) {
     // The key is bound to the secure hardware of this Android
 }

Returns true if the current device's KeyChain binds any PrivateKey of the given algorithm to the device once imported or generated. This can be used to tell if there is special hardware support that can be used to bind keys to the device in a way that makes it non-exportable.

isKeyAlgorithmSupported

boolean isKeyAlgorithmSupported (String algorithm)

Returns true if the current device's KeyChain supports a specific PrivateKey type indicated by algorithm (e.g., "RSA").