Check android keystore keypass for correctness

Question

I'm automating some things that involve the android keytool and jarsigner. The tool takes a keystore, the password for the keystore, the alias name, and the password for the alias / key, and I'm trying to find a way to explicitly check to see if the supplied password for the alias / key is correct.

Any ideas? Also, I need to check it without a jar file to sign - getting that file in my context is lengthy, so I want to abort sooner rather than later.

Rhumb

can you change the correct answer? – Floozy

Yep! Although but damn it's been awhile since I touched any of this. – Rhumb

Answer 1

You can also check if the password is correct without attempting to change the password. I did it by listing the properties of the keystore with this command:

keytool -list -keystore <keystorefile> -storepass <passwordtocheck>

Kelvin

I am getting this - The syntax of the command is incorrect. – Spinoza

Note that this doesn't test correctness of the alias password – Twill

@VijayKumar The answer below uses keytool -keypasswd to try and change the alias' password (to the same password), which will fail if the password is incorrect. – Twill

Answer 2

You can do it a couple of ways:

A. With keytool

If you run the command keytool -keypasswd -keystore <keystore> -alias <alias> -storepass <storepass> -keypass <keypass> -new <keypass> then you will get the error Keystore was tampered with, or password was incorrect if the keystore password is wrong, or the error Cannot recover key if the alias password is wrong. Unfortunately the return code is 1 in both cases, so you will need to do parsing of the program's output if you want to be smart about the type of error.

B. With a small Java program

Something along these lines:

KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

try (FileInputStream fis = new FileInputStream(keystore)) {
    ks.load(fis, ksPw.toCharArray());
}

ks.getEntry(alias, new KeyStore.PasswordProtection(aliasPw.toCharArray()));

will fail at line 4 with a java.io.IOException if the key store password is wrong, or with a java.security.UnrecoverableKeyException at line 7 if the alias password is wrong.

Clubby

You save my day! My password was corrected but I was wrong with alias. Thanks! – Flosi