Im recently working with Android keystore system.
A Xiaomi 9 phone and Huawei P20(updated to Android 9) were used for test which might not support StrongBox according to the GrapheneOS/AttestationSamples provided from this link.
Furthermore, below code returned false indicate that the device doesn't have StrongBox Feature.
private boolean hasStrongBox(Context context){
return context.getPackageManager().hasSystemFeature(PackageManager.FEATURE_STRONGBOX_KEYSTORE);
}
However, during the test, when I'm generating AES encryption key by using the code below , both of the phone doesn't throw StrongBoxUnavailableException:
protected int createAndroidKeyStoreSymmetricKey() throws NoSuchProviderException, NoSuchAlgorithmException, InvalidAlgorithmParameterException {
KeyGenerator keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
KeyGenParameterSpec.Builder builder = new KeyGenParameterSpec.Builder(ALIAS_MASTER_KEY, KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
.setBlockModes(KeyProperties.BLOCK_MODE_CBC)
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7);
.setIsStrongBoxBacked(true);
keyGenerator.init(builder.build());
secretKey = keyGenerator.generateKey();
if(secretKey != null ){
return 0;
} else {
return -1;
}
}
While generating RSA encryption key, they both did throw StrongBoxUnavailableException:
private KeyPair genKeyPair(String alias, boolean isStrongBoxBacked) throws Exception {
KeyPairGenerator kpg =
KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_RSA, "AndroidKeyStore");
KeyGenParameterSpec.Builder keyBuilder = new KeyGenParameterSpec.Builder(
alias,
KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
.setBlockModes(KeyProperties.BLOCK_MODE_ECB)
.setKeySize(CRYPTO_BITS)
.setIsStrongBoxBacked(true);
kpg.initialize(keyBuilder.build());
return kpg.generateKeyPair();
}
android.security.keystore.StrongBoxUnavailableException: Failed to generate key pair
Is there any spec configuration was done wrong during the Key generation? As The expecting result is StrongBoxUnavailableException is thrown even during the AES generation.