KeyStore getEntry return null after change password

Question

Hi I have a program that need store a key in the keystore, I generate a pair keys and I sign a value and this works perfectly all time. The problem comes when the user goes to preferences and changes the password or change the password mode to pin mode. After that, when I try to access to the private key the keystore return to me a null value.

I know that the keysotore values are signed with the unlock password value, but I believed that if the user changed the password the keystore would be to resign with the new key, but this is not the case.

I'm doing something wrong? If it is not the case, exist any way to take the password change and do manually?

this is the code that I'm using.

KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore");
kpg.initialize(new KeyPairGeneratorSpec.Builder(context)
        .setAlias(ALIAS)
        .setStartDate(now)
        .setEndDate(end)
        .setSerialNumber(BigInteger.valueOf(1))
        .setSubject(new X500Principal("CN=test1"))
        .build());

KeyPair kp = kpg.generateKeyPair();

an this is the code of obtain keystore

    KeyStore ks = KeyStore.getInstance("AndroidKeyStore");
    ks.load(null);
    KeyStore.Entry entry = ks.getEntry(ALIAS, null);
    if (!(entry instanceof KeyStore.PrivateKeyEntry)) {
        Log.w("borrar", "Not an instance of a PrivateKeyEntry");
        return null;
    } 

Thank you,

Witt

@CommonsWare Please answer this. – Bedfast

I have an library, I will publish on some days, that work with this one, after some tests, If the user change the pin the key is invalidate. The only way that works with change pin its the app run with system privileges(android:sharedUserId="android.uid.system"), but you can do this one only if you are working with custom rom, any work arround is welcome. – Witt

Any workaround found for native ROM ? This issue is very annoying... and so far no solution found to stop keypair changed after pin code changes or unlock/lock lockscreen. – Creese

@Witt Hello, did you done with your library? Please share with us if you done. – Bedfast

yes, it's there github.com/flipper83/secure-preferences but only works on api 18, check the instructions for work on native roms – Witt

@Witt I was also trying same way which you have followed. Here, I would like add known issue : If data to be encrypted is greater than cipher's output block size (usually 256), it throws exception. You need to encrypt data in blocks of 256 and at the end merge complete encrypted data blocks. – Beta

thank you @harry I will try to add this fix on the github project as soon as I can. – Witt