android keystore作用,如何使用Android KeyStore安全地存储任意字符串？

我以可以使用AndroidKeyStore保护任意数据块为前提，并将其称为“键”。但是，我研究得越深，就越清楚地看到KeyStore API与与安全性相关的对象(证书，密钥规格，提供程序等)深深地纠缠在一起。它不是设计来存储任意数据的，我看不到任何简单的方法为此而弯曲的道路。

但是，可以使用AndroidKeyStore帮助我保护敏感数据。我可以使用它来管理加密密钥，该密钥将用于加密应用程序本地的数据。通过结合使用AndroidKeyStore，CipherOutputStream和CipherInputStream，我们可以：

生成，安全地存储和检索设备上的加密密钥

加密任意数据并将其保存在设备上(在应用程序的目录中，该位置将受到文件系统权限的进一步保护)

访问和解密数据以备后用。

这是一些示例代码，演示了如何实现此目的。

try {

KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");

keyStore.load(null);

String alias = "key3";

int nBefore = keyStore.size();

// Create the keys if necessary

if (!keyStore.containsAlias(alias)) {

Calendar notBefore = Calendar.getInstance();

Calendar notAfter = Calendar.getInstance();

notAfter.add(Calendar.YEAR, 1);

KeyPairGeneratorSpec spec = new KeyPairGeneratorSpec.Builder(this)

.setAlias(alias)

.setKeyType("RSA")

.setKeySize(2048)

.setSubject(new X500Principal("CN=test"))

.setSerialNumber(BigInteger.ONE)

.setStartDate(notBefore.getTime())

.setEndDate(notAfter.getTime())

.build();

KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore");

generator.initialize(spec);

KeyPair keyPair = generator.generateKeyPair();

}

int nAfter = keyStore.size();

Log.v(TAG, "Before = " + nBefore + " After = " + nAfter);

// Retrieve the keys

KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry)keyStore.getEntry(alias, null);

RSAPrivateKey privateKey = (RSAPrivateKey) privateKeyEntry.getPrivateKey();

RSAPublicKey publicKey = (RSAPublicKey) privateKeyEntry.getCertificate().getPublicKey();

Log.v(TAG, "private key = " + privateKey.toString());

Log.v(TAG, "public key = " + publicKey.toString());

// Encrypt the text

String plainText = "This text is supposed to be a secret!";

String dataDirectory = getApplicationInfo().dataDir;

String filesDirectory = getFilesDir().getAbsolutePath();

String encryptedDataFilePath = filesDirectory + File.separator + "keep_yer_secrets_here";

Log.v(TAG, "plainText = " + plainText);

Log.v(TAG, "dataDirectory = " + dataDirectory);

Log.v(TAG, "filesDirectory = " + filesDirectory);

Log.v(TAG, "encryptedDataFilePath = " + encryptedDataFilePath);

Cipher inCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", "AndroidOpenSSL");

inCipher.init(Cipher.ENCRYPT_MODE, publicKey);

Cipher outCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", "AndroidOpenSSL");

outCipher.init(Cipher.DECRYPT_MODE, privateKey);

CipherOutputStream cipherOutputStream =

new CipherOutputStream(

new FileOutputStream(encryptedDataFilePath), inCipher);

cipherOutputStream.write(plainText.getBytes("UTF-8"));

cipherOutputStream.close();

CipherInputStream cipherInputStream =

new CipherInputStream(new FileInputStream(encryptedDataFilePath),

outCipher);

byte [] roundTrippedBytes = new byte[1000]; // TODO: dynamically resize as we get more data

int index = 0;

int nextByte;

while ((nextByte = cipherInputStream.read()) != -1) {

roundTrippedBytes[index] = (byte)nextByte;

index++;

}

String roundTrippedString = new String(roundTrippedBytes, 0, index, "UTF-8");

Log.v(TAG, "round tripped string = " + roundTrippedString);

} catch (NoSuchAlgorithmException e) {