Skip to content

Removing unnecessary attributes from keystore wrap operation, Fixes AB#3137956 #2578

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
somalaya merged 8 commits into from
Jan 31, 2025
Merged

Removing unnecessary attributes from keystore wrap operation, Fixes AB#3137956 #2578

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
94b3c67
added retry and removed strongbox
somalaya Jan 14, 2025
9eda376
removed retry
somalaya Jan 14, 2025
0c0e6e5
Update AndroidWrappedKeyLoader.java
somalaya Jan 23, 2025
5e89e42
is pixel 5 check
somalaya Jan 23, 2025
edbbbaa
removed old way of setting certs
somalaya Jan 29, 2025
b288030
removed extra line
somalaya Jan 29, 2025
5b80300
changelog updated
somalaya Jan 30, 2025
be7ebe0
Merge branch 'dev' into somalaya/KeystoreUnwrapFix
somalaya Jan 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ vNext
- [MINOR] Organize browser selection classes and change signature for get AuthorizationStrategy (#2564)
- [MINOR] Add support for OneBox Environment (#2559)
- [MINOR] Add support for claims requests for native authentication (#2572)
- [MINOR] Removing unnecessary attributes from keystore wrap operation (#2578)

Version 19.0.0
----------
Expand Down
13 changes: 2 additions & 11 deletions common/src/main/java/com/microsoft/identity/common/crypto/AndroidWrappedKeyLoader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,7 @@
import java.security.KeyStore;
import java.security.spec.AlgorithmParameterSpec;
import java.util.Calendar;
import java.util.Date;
import java.util.Locale;
import java.util.concurrent.TimeUnit;

import javax.crypto.SecretKey;
import javax.security.auth.x500.X500Principal;
Expand Down Expand Up @@ -311,18 +309,11 @@ private static AlgorithmParameterSpec getSpecForKeyStoreKey(@NonNull final Conte
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.P) {
return getLegacySpecForKeyStoreKey(context, alias);
} else {
final String certInfo = String.format(Locale.ROOT, "CN=%s, OU=%s",
alias,
context.getPackageName());
final int certValidYears = 100;
int purposes = KeyProperties.PURPOSE_WRAP_KEY | KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT;
int purposes = KeyProperties.PURPOSE_WRAP_KEY | KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT;
return new KeyGenParameterSpec.Builder(alias, purposes)
.setCertificateSubject(new X500Principal(certInfo))
.setCertificateSerialNumber(BigInteger.ONE)
.setCertificateNotBefore(new Date())
.setCertificateNotAfter(new Date(System.currentTimeMillis() + TimeUnit.DAYS.toMillis(365 * certValidYears)))
.setKeySize(2048)
.setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
.setBlockModes(KeyProperties.BLOCK_MODE_ECB) // Ensure compatibility with RSA
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
.build();
}
Expand Down