Encryption & Decryption of username using KeyStore in Android M & older version?

Question

i'm trying to encrypt and decrypt username in app using KeyStore,

Using KeyPairGeneratorSpec to create the key in older version like 18 to 22,

KeyPairGeneratorSpec as been depricated in version 23 of android M, But Android M supports KeyGenParameterSpec.

Does this KeyGenParameterSpec supports backward comparability or how do i do this ?

Im trying out some thing like this , is there any better solution for this. This works fine as off now!

At the time of Ciper.getInstance in encryption and Decryption i need to do this. is there any single parameter "RSA/ECB/OAEPWithSHA-256AndMGF1Padding" or "RSA/ECB/PKCS1Padding" i can pass for both the version ?

if(android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M){
            c =  Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
        }else{
            c =  Cipher.getInstance("RSA/ECB/PKCS1Padding");
        }

Below code works fine as off now , let me know how do i improve this.

Key Generator :

genkey(){
KeyPairGenerator generator = KeyPairGenerator .getInstance(KeyProperties.KEY_ALGORITHM_RSA, "AndroidKeyStore");
            if(android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M){
                TCLog.e(TAG,"Current version is 23(MashMello)");
                //Api level 23

                KeyGenParameterSpec spec = new  KeyGenParameterSpec.Builder(
                             keyName,
                            KeyProperties.PURPOSE_DECRYPT | KeyProperties.PURPOSE_ENCRYPT )
                            .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)
                            .build();
                generator.initialize(spec);
            }else{
                TCLog.e(TAG,"Current version is < 23(MashMello)");
                //api level 17+ 4.4.3
                KeyPairGeneratorSpec spec = new KeyPairGeneratorSpec.Builder(getActivity())
                        .setAlias(keyName)
                        .setSubject(new X500Principal("CN=Sample Name, O=Android Authority"))
                        .setSerialNumber(BigInteger.ONE)
                        .setStartDate(start.getTime())
                        .setEndDate(end.getTime())
                        .build();
                generator.initialize(spec);
            }
           KeyPair keyPair = generator.generateKeyPair();
}

Encryption code :

doEncription(){
 try {
        KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry) ks.getEntry(keyName, null);
        PublicKey publicKey = (PublicKey) privateKeyEntry.getCertificate().getPublicKey();
        Cipher c;
        if(android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M){
            c =  Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
        }else{
            c =  Cipher.getInstance("RSA/ECB/PKCS1Padding");
        }

        c.init(Cipher.ENCRYPT_MODE, publicKey);
        encodedUser = c.doFinal(userName.getBytes());
        encodedPassword = c.doFinal(userPassword.getBytes());

        userName = Base64.encodeToString(encodedUser, Base64.DEFAULT);
        userPassword = Base64.encodeToString(encodedPassword, Base64.DEFAULT);
        // Log.e("MainActivity","AES Encription Error.!");
    } catch (Exception e) {
        Log.e("MainActivity", "AES Encription Error.!");
    }
}

Decryption Code :

doDecryption(){
    try {
        KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry) ks.getEntry(keyName, null);
        PrivateKey privateKey = (PrivateKey) privateKeyEntry.getPrivateKey();

        Cipher c;
        if(android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M){
            c =  Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
        }else{
            c =  Cipher.getInstance("RSA/ECB/PKCS1Padding");
        }
        c.init(Cipher.DECRYPT_MODE, privateKey);
        decodedUser = c.doFinal(encodedUser);
        decodedPassword = c.doFinal(encodedPassword);

    } catch (Exception e) {
        Log.e("MainActivity", "AES Decryption Error.!");
    }

}

Stearoptene

@nikolay-elenkov could you please quick look at this code? is it safe for ciphering sensitive data? – Rollerskate

can you tell me a link where can i find the full code or where you get the code? – Schoolfellow

Answer 1

the cypher transformation depends on what parameters you give to KeyGenParameterSpec or KeyPairGeneratorSpec. If you want to use "RSA/ECB/PKCS1Padding" in both cases (Android M and below) change

spec.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)

to

spec.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)

You can check which algorithms are available with the following piece of code:

    Provider[] providers = Security.getProviders();
    for (Provider p : providers) {
        Log.d(TAG, "provider: " + p.getName());
        Set<Provider.Service> services = p.getServices();
        for (Provider.Service s : services) {
            Log.d(TAG, "--> algorithm: " + s.getAlgorithm());
        }
    }

I avoided writing a lot of if-else by declaring an interface IKeyStoreHandler which provides all the necessary methods (add / remove keys, list all keys by their aliases, get private / public key, decrypt / encrypt text) and implementing it for both cases.

Gimmick