如何在API 18中使用Android KeyStore API？

Question

当我针对API 18时,如何获得以下等效代码？以下代码仅适用于API 23及更高版本.API 18代码的安全性是多少,因为我们无法使用KeyGenParameterSpecAPI 18代码可能会使用已弃用的API？

KeyGenerator keyGenerator = KeyGenerator.getInstance(
    KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");

keyGenerator.init(new KeyGenParameterSpec.Builder(alias,
    KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
    .setBlockModes(KeyProperties.BLOCK_MODE_CBC)
    .setKeySize(256)
    .setUserAuthenticationRequired(true)
    .setUserAuthenticationValidityDurationSeconds(400)
    .setRandomizedEncryptionRequired(false)
    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7)
    .build());

SecretKey key = keyGenerator.generateKey();

Answer 1

从Android 6.0(API Level 23)开始支持Android KeyStore中的对称密钥生成和存储.

Android 4.3(API级别18)以后支持Android KeyStore中的非对称密钥生成和存储.

有关详细信息,请参阅此文档:Android Keystore System

虽然存在一些问题,但您可以使用非对称密钥生成.请参考下面的参考..

非对称密钥生成

Answer 2

private final String ENCRYPTION_ALIAS = "anEncryptionAlias"

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
    KeyPairGenerator generator = KeyPairGenerator.getInstance(KEY_ALGORITHM_RSA, AndroidKeyStore);
    generator.initialize(new KeyGenParameterSpec.Builder(
        ENCRYPTION_ALIAS,
        KeyProperties.PURPOSE_SIGN | KeyProperties.PURPOSE_VERIFY)
        .setDigests(
            KeyProperties.DIGEST_SHA256,
            KeyProperties.DIGEST_SHA512)
        .build()
    );
    generator.generateKeyPair();
} else {
    Calendar start = Calendar.getInstance();
    Calendar end = Calendar.getInstance();
    end.add(Calendar.YEAR, 1);
    KeyPairGeneratorSpec spec = new KeyPairGeneratorSpec
        .Builder(YourApplication.getInstance().getApplicationContext())
        .setAlias(ENCRYPTION_ALIAS)
        .setSubject(new X500Principal("CN=Your Company ," +
            " O=Your Organization" +
            " C=Your Coountry"))
        .setSerialNumber(BigInteger.ONE)
        .setStartDate(start.getTime())
        .setEndDate(end.getTime())
        .build();
    KeyPairGenerator generator = KeyPairGenerator.getInstance(KEY_ALGORITHM_RSA, AndroidKeyStore);

    generator.initialize(spec);
    generator.generateKeyPair();
}