├── .gitignore ├── README.md ├── app ├── .gitignore ├── build.gradle ├── proguard-rules.pro └── src │ ├── androidTest │ └── java │ │ └── com │ │ └── joe │ │ └── androidkeystore │ │ └── ExampleInstrumentedTest.java │ ├── main │ ├── AndroidManifest.xml │ ├── java │ │ └── com │ │ │ └── joe │ │ │ └── androidkeystore │ │ │ ├── KeyStoreHelper.java │ │ │ ├── MainActivity.java │ │ │ └── SharedPreferencesHelper.java │ └── res │ │ ├── drawable │ │ └── border.xml │ │ ├── layout │ │ └── activity_main.xml │ │ ├── mipmap-hdpi │ │ ├── ic_launcher.png │ │ └── ic_launcher_round.png │ │ ├── mipmap-mdpi │ │ ├── ic_launcher.png │ │ └── ic_launcher_round.png │ │ ├── mipmap-xhdpi │ │ ├── ic_launcher.png │ │ └── ic_launcher_round.png │ │ ├── mipmap-xxhdpi │ │ ├── ic_launcher.png │ │ └── ic_launcher_round.png │ │ ├── mipmap-xxxhdpi │ │ ├── ic_launcher.png │ │ └── ic_launcher_round.png │ │ └── values │ │ ├── colors.xml │ │ ├── dimens.xml │ │ ├── strings.xml │ │ └── styles.xml │ └── test │ └── java │ └── com │ └── joe │ └── androidkeystore │ └── ExampleUnitTest.java ├── build.gradle ├── gradle.properties ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── gradlew ├── gradlew.bat ├── screenshot └── Screenshot.png └── settings.gradle /.gitignore: -------------------------------------------------------------------------------- 1 | *.iml 2 | .gradle 3 | /local.properties 4 | /.idea/workspace.xml 5 | /.idea/libraries 6 | .DS_Store 7 | /build 8 | /captures 9 | .externalNativeBuild 10 | .idea -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # AndroidKeyStore 2 | [EncryptedSharedPreferences](https://developer.android.com/reference/androidx/security/crypto/EncryptedSharedPreferences) 終於在 2021 年 6 月推出正式版，建議可以直接使用 EncryptedSharedPreferences。 3 | 4 | 一個小範例展示如何使用 [Android KeyStore System](https://developer.android.com/training/articles/keystore.html) 來加／解密字串，並存入 5 | [SharedPreferences](https://developer.android.com/reference/android/content/SharedPreferences.html). 6 | 7 | ## 結果 8 | 成功建置之後，你應該會看到如下的結果： 9 | 10 | 11 | 12 | 13 | ## 教學 14 | 更詳細部分，請至我的部落格觀看教學文章： 15 | 16 | [使用 KeyStore 儲存敏感性資料](https://medium.com/@joetsai/%E4%BD%BF%E7%94%A8keystore-%E5%84%B2%E5%AD%98%E6%95%8F%E6%84%9F%E6%80%A7%E8%B3%87%E6%96%99-92ad9b236e58) 17 | -------------------------------------------------------------------------------- /app/.gitignore: -------------------------------------------------------------------------------- 1 | /build 2 | -------------------------------------------------------------------------------- /app/build.gradle: -------------------------------------------------------------------------------- 1 | apply plugin: 'com.android.application' 2 | 3 | android { 4 | compileSdkVersion 25 5 | defaultConfig { 6 | applicationId "com.joe.androidkeystore" 7 | minSdkVersion 18 8 | targetSdkVersion 25 9 | versionCode 1 10 | versionName "1.0" 11 | testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner" 12 | vectorDrawables.useSupportLibrary = true 13 | } 14 | buildTypes { 15 | release { 16 | minifyEnabled false 17 | proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro' 18 | } 19 | } 20 | } 21 | 22 | dependencies { 23 | implementation fileTree(dir: 'libs', include: ['*.jar']) 24 | androidTestImplementation('com.android.support.test.espresso:espresso-core:2.2.2', { 25 | exclude group: 'com.android.support', module: 'support-annotations' 26 | }) 27 | implementation 'com.android.support:appcompat-v7:25.3.1' 28 | implementation 'com.android.support:design:25.3.1' 29 | testImplementation 'junit:junit:4.12' 30 | } 31 | -------------------------------------------------------------------------------- /app/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # By default, the flags in this file are appended to flags specified 3 | # in /Users/Joe/Library/Android/sdk/tools/proguard/proguard-android.txt 4 | # You can edit the include path and order by changing the proguardFiles 5 | # directive in build.gradle. 6 | # 7 | # For more details, see 8 | # http://developer.android.com/guide/developing/tools/proguard.html 9 | 10 | # Add any project specific keep options here: 11 | 12 | # If your project uses WebView with JS, uncomment the following 13 | # and specify the fully qualified class name to the JavaScript interface 14 | # class: 15 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 16 | # public *; 17 | #} 18 | 19 | # Uncomment this to preserve the line number information for 20 | # debugging stack traces. 21 | #-keepattributes SourceFile,LineNumberTable 22 | 23 | # If you keep the line number information, uncomment this to 24 | # hide the original source file name. 25 | #-renamesourcefileattribute SourceFile 26 | -------------------------------------------------------------------------------- /app/src/androidTest/java/com/joe/androidkeystore/ExampleInstrumentedTest.java: -------------------------------------------------------------------------------- 1 | package com.joe.androidkeystore; 2 | 3 | import android.content.Context; 4 | import android.support.test.InstrumentationRegistry; 5 | import android.support.test.runner.AndroidJUnit4; 6 | 7 | import org.junit.Test; 8 | import org.junit.runner.RunWith; 9 | 10 | import static org.junit.Assert.*; 11 | 12 | /** 13 | * Instrumentation test, which will execute on an Android device. 14 | * 15 | * @see Testing documentation 16 | */ 17 | @RunWith(AndroidJUnit4.class) 18 | public class ExampleInstrumentedTest { 19 | @Test 20 | public void useAppContext() throws Exception { 21 | // Context of the app under test. 22 | Context appContext = InstrumentationRegistry.getTargetContext(); 23 | 24 | assertEquals("com.joe.keystoredemo", appContext.getPackageName()); 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /app/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 5 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /app/src/main/java/com/joe/androidkeystore/KeyStoreHelper.java: -------------------------------------------------------------------------------- 1 | package com.joe.androidkeystore; 2 | 3 | import android.content.Context; 4 | import android.os.Build; 5 | import android.security.KeyPairGeneratorSpec; 6 | import android.security.keystore.KeyGenParameterSpec; 7 | import android.security.keystore.KeyProperties; 8 | import android.support.annotation.RequiresApi; 9 | import android.util.Base64; 10 | import android.util.Log; 11 | 12 | import java.math.BigInteger; 13 | import java.security.InvalidAlgorithmParameterException; 14 | import java.security.KeyPairGenerator; 15 | import java.security.KeyStore; 16 | import java.security.NoSuchAlgorithmException; 17 | import java.security.NoSuchProviderException; 18 | import java.security.PrivateKey; 19 | import java.security.PublicKey; 20 | import java.security.SecureRandom; 21 | import java.util.Calendar; 22 | 23 | import javax.crypto.Cipher; 24 | import javax.crypto.spec.IvParameterSpec; 25 | import javax.crypto.spec.SecretKeySpec; 26 | import javax.security.auth.x500.X500Principal; 27 | 28 | /** 29 | * Created by Joe on 2017/5/24. 30 | */ 31 | 32 | public class KeyStoreHelper { 33 | 34 | private static final String TAG = "KEYSTORE"; 35 | 36 | private static final String KEYSTORE_PROVIDER = "AndroidKeyStore"; 37 | private static final String AES_MODE = "AES/GCM/NoPadding"; 38 | private static final String RSA_MODE = "RSA/ECB/PKCS1Padding"; 39 | 40 | private static final String KEYSTORE_ALIAS = "KEYSTORE_DEMO"; 41 | 42 | 43 | private KeyStore keyStore; 44 | private SharedPreferencesHelper prefsHelper; 45 | 46 | public KeyStoreHelper(Context context, SharedPreferencesHelper sharedPreferencesHelper) { 47 | try { 48 | prefsHelper = sharedPreferencesHelper; 49 | keyStore = KeyStore.getInstance(KEYSTORE_PROVIDER); 50 | keyStore.load(null); 51 | 52 | if (!keyStore.containsAlias(KEYSTORE_ALIAS)) { 53 | prefsHelper.setIV(""); 54 | genKeyStoreKey(context); 55 | genAESKey(); 56 | } 57 | 58 | } catch (Exception e) { 59 | e.printStackTrace(); 60 | } 61 | 62 | } 63 | 64 | 65 | private void genKeyStoreKey(Context context) throws Exception { 66 | if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) { 67 | generateRSAKey_AboveApi23(); 68 | } else { 69 | generateRSAKey_BelowApi23(context); 70 | } 71 | } 72 | 73 | 74 | @RequiresApi(api = Build.VERSION_CODES.M) 75 | private void generateRSAKey_AboveApi23() throws Exception { 76 | KeyPairGenerator keyPairGenerator = KeyPairGenerator 77 | .getInstance(KeyProperties.KEY_ALGORITHM_RSA, KEYSTORE_PROVIDER); 78 | 79 | 80 | KeyGenParameterSpec keyGenParameterSpec = new KeyGenParameterSpec 81 | .Builder(KEYSTORE_ALIAS, KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT) 82 | .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512) 83 | .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1) 84 | .build(); 85 | 86 | keyPairGenerator.initialize(keyGenParameterSpec); 87 | keyPairGenerator.generateKeyPair(); 88 | 89 | } 90 | 91 | private void generateRSAKey_BelowApi23(Context context) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidAlgorithmParameterException { 92 | Calendar start = Calendar.getInstance(); 93 | Calendar end = Calendar.getInstance(); 94 | end.add(Calendar.YEAR, 30); 95 | 96 | KeyPairGeneratorSpec spec = new KeyPairGeneratorSpec.Builder(context) 97 | .setAlias(KEYSTORE_ALIAS) 98 | .setSubject(new X500Principal("CN=" + KEYSTORE_ALIAS)) 99 | .setSerialNumber(BigInteger.TEN) 100 | .setStartDate(start.getTime()) 101 | .setEndDate(end.getTime()) 102 | .build(); 103 | 104 | KeyPairGenerator keyPairGenerator = KeyPairGenerator 105 | .getInstance(KeyProperties.KEY_ALGORITHM_RSA, KEYSTORE_PROVIDER); 106 | 107 | keyPairGenerator.initialize(spec); 108 | keyPairGenerator.generateKeyPair(); 109 | } 110 | 111 | public String encrypt(String plainText) { 112 | try { 113 | return encryptAES(plainText); 114 | 115 | } catch (Exception e) { 116 | Log.d(TAG, Log.getStackTraceString(e)); 117 | return ""; 118 | } 119 | } 120 | public String decrypt(String encryptedText) { 121 | try { 122 | return decryptAES(encryptedText); 123 | 124 | } catch (Exception e) { 125 | Log.d(TAG, Log.getStackTraceString(e)); 126 | return ""; 127 | } 128 | 129 | } 130 | 131 | 132 | private String encryptRSA(byte[] plainText) throws Exception { 133 | PublicKey publicKey = keyStore.getCertificate(KEYSTORE_ALIAS).getPublicKey(); 134 | 135 | Cipher cipher = Cipher.getInstance(RSA_MODE); 136 | cipher.init(Cipher.ENCRYPT_MODE, publicKey); 137 | 138 | byte[] encryptedByte = cipher.doFinal(plainText); 139 | return Base64.encodeToString(encryptedByte, Base64.DEFAULT); 140 | } 141 | 142 | 143 | private byte[] decryptRSA(String encryptedText) throws Exception { 144 | PrivateKey privateKey = (PrivateKey) keyStore.getKey(KEYSTORE_ALIAS, null); 145 | 146 | Cipher cipher = Cipher.getInstance(RSA_MODE); 147 | cipher.init(Cipher.DECRYPT_MODE, privateKey); 148 | 149 | byte[] encryptedBytes = Base64.decode(encryptedText, Base64.DEFAULT); 150 | byte[] decryptedBytes = cipher.doFinal(encryptedBytes); 151 | 152 | return decryptedBytes; 153 | } 154 | 155 | private void genAESKey() throws Exception { 156 | // Generate AES-Key 157 | byte[] aesKey = new byte[16]; 158 | SecureRandom secureRandom = new SecureRandom(); 159 | secureRandom.nextBytes(aesKey); 160 | 161 | 162 | // Generate 12 bytes iv then save to SharedPrefs 163 | byte[] generated = secureRandom.generateSeed(12); 164 | String iv = Base64.encodeToString(generated, Base64.DEFAULT); 165 | prefsHelper.setIV(iv); 166 | 167 | 168 | // Encrypt AES-Key with RSA Public Key then save to SharedPrefs 169 | String encryptAESKey = encryptRSA(aesKey); 170 | prefsHelper.setAESKey(encryptAESKey); 171 | } 172 | 173 | 174 | /** 175 | * AES Encryption 176 | * @param plainText: A string which needs to be encrypted. 177 | * @return A base64's string after encrypting. 178 | */ 179 | private String encryptAES(String plainText) throws Exception { 180 | Cipher cipher = Cipher.getInstance(AES_MODE); 181 | cipher.init(Cipher.ENCRYPT_MODE, getAESKey(), new IvParameterSpec(getIV())); 182 | 183 | // 加密過後的byte 184 | byte[] encryptedBytes = cipher.doFinal(plainText.getBytes()); 185 | 186 | // 將byte轉為base64的string編碼 187 | return Base64.encodeToString(encryptedBytes, Base64.DEFAULT); 188 | } 189 | 190 | 191 | private String decryptAES(String encryptedText) throws Exception { 192 | // 將加密過後的Base64編碼格式 解碼成 byte 193 | byte[] decodedBytes = Base64.decode(encryptedText.getBytes(), Base64.DEFAULT); 194 | 195 | // 將解碼過後的byte 使用AES解密 196 | Cipher cipher = Cipher.getInstance(AES_MODE); 197 | cipher.init(Cipher.DECRYPT_MODE, getAESKey(), new IvParameterSpec(getIV())); 198 | 199 | return new String(cipher.doFinal(decodedBytes)); 200 | } 201 | 202 | 203 | private byte[] getIV() { 204 | String prefIV = prefsHelper.getIV(); 205 | return Base64.decode(prefIV, Base64.DEFAULT); 206 | } 207 | 208 | 209 | 210 | private SecretKeySpec getAESKey() throws Exception { 211 | String encryptedKey = prefsHelper.getAESKey(); 212 | byte[] aesKey = decryptRSA(encryptedKey); 213 | 214 | return new SecretKeySpec(aesKey, AES_MODE); 215 | } 216 | 217 | 218 | 219 | } 220 | -------------------------------------------------------------------------------- /app/src/main/java/com/joe/androidkeystore/MainActivity.java: -------------------------------------------------------------------------------- 1 | package com.joe.androidkeystore; 2 | 3 | import android.os.Bundle; 4 | import android.support.v7.app.AppCompatActivity; 5 | import android.view.View; 6 | import android.widget.Button; 7 | import android.widget.EditText; 8 | import android.widget.TextView; 9 | import android.widget.Toast; 10 | 11 | public class MainActivity extends AppCompatActivity { 12 | 13 | 14 | EditText editTextInput; 15 | 16 | TextView textEncrypt; 17 | TextView textDecrypt; 18 | 19 | Button buttonEncrypt; 20 | Button buttonDecrypt; 21 | Button buttonSave; 22 | 23 | KeyStoreHelper keyStoreHelper; 24 | SharedPreferencesHelper preferencesHelper; 25 | 26 | @Override 27 | protected void onCreate(Bundle savedInstanceState) { 28 | super.onCreate(savedInstanceState); 29 | setContentView(R.layout.activity_main); 30 | 31 | preferencesHelper = new SharedPreferencesHelper(getApplicationContext()); 32 | keyStoreHelper = new KeyStoreHelper(getApplicationContext(), preferencesHelper); 33 | 34 | 35 | initView(); 36 | initEditTextInput(); 37 | setupButton(); 38 | 39 | } 40 | 41 | private void initEditTextInput() { 42 | String encryptedText = preferencesHelper.getInput(); 43 | String plainInput = keyStoreHelper.decrypt(encryptedText); 44 | editTextInput.setText(plainInput); 45 | } 46 | 47 | private void setupButton() { 48 | buttonEncrypt.setOnClickListener(new View.OnClickListener() { 49 | @Override 50 | public void onClick(View v) { 51 | String encryptedText = keyStoreHelper.encrypt(editTextInput.getText().toString()); 52 | textEncrypt.setText(encryptedText); 53 | } 54 | }); 55 | 56 | buttonDecrypt.setOnClickListener(new View.OnClickListener() { 57 | @Override 58 | public void onClick(View v) { 59 | String decryptedText = keyStoreHelper.decrypt(textEncrypt.getText().toString()); 60 | textDecrypt.setText(decryptedText); 61 | } 62 | }); 63 | 64 | buttonSave.setOnClickListener(new View.OnClickListener() { 65 | @Override 66 | public void onClick(View v) { 67 | preferencesHelper.setInput(textEncrypt.getText().toString()); 68 | Toast.makeText(getApplicationContext(), "Successfully saved!", Toast.LENGTH_SHORT).show(); 69 | } 70 | }); 71 | } 72 | 73 | 74 | private void initView() { 75 | editTextInput = (EditText) findViewById(R.id.editText_input); 76 | textEncrypt = (TextView) findViewById(R.id.text_encrypt); 77 | textDecrypt = (TextView) findViewById(R.id.text_decrypt); 78 | buttonEncrypt = (Button) findViewById(R.id.button_encrypt); 79 | buttonDecrypt = (Button) findViewById(R.id.button_decrypt); 80 | buttonSave = (Button) findViewById(R.id.button_save); 81 | } 82 | } 83 | -------------------------------------------------------------------------------- /app/src/main/java/com/joe/androidkeystore/SharedPreferencesHelper.java: -------------------------------------------------------------------------------- 1 | package com.joe.androidkeystore; 2 | 3 | import android.content.Context; 4 | import android.content.SharedPreferences; 5 | 6 | 7 | public class SharedPreferencesHelper { 8 | 9 | private static final String SHARED_PREF_NAME = "KEYSTORE_SETTING"; 10 | 11 | private static final String PREF_KEY_AES = "PREF_KEY_AES"; 12 | private static final String PREF_KEY_IV = "PREF_KEY_IV"; 13 | private static final String PREF_KEY_INPUT = "PREF_KEY_INPUT"; 14 | 15 | private SharedPreferences sharedPreferences; 16 | 17 | 18 | 19 | public SharedPreferencesHelper(Context context){ 20 | sharedPreferences = context.getSharedPreferences(SHARED_PREF_NAME, Context.MODE_PRIVATE); 21 | } 22 | 23 | 24 | private String getString(String key) { 25 | return sharedPreferences.getString(key, ""); 26 | } 27 | 28 | private void putString(String key, String value) { 29 | sharedPreferences.edit() 30 | .putString(key, value) 31 | .apply(); 32 | } 33 | 34 | private boolean getBoolean(String key) { 35 | return sharedPreferences.getBoolean(key, false); 36 | } 37 | 38 | private void putBoolean(String key, boolean value) { 39 | sharedPreferences.edit() 40 | .putBoolean(key, value) 41 | .apply(); 42 | } 43 | 44 | 45 | 46 | 47 | public void setIV(String value) { 48 | putString(PREF_KEY_IV, value); 49 | } 50 | 51 | public String getIV() { 52 | return getString(PREF_KEY_IV); 53 | } 54 | 55 | public void setAESKey(String value) { 56 | putString(PREF_KEY_AES, value); 57 | } 58 | 59 | public String getAESKey() { 60 | return getString(PREF_KEY_AES); 61 | } 62 | 63 | public void setInput(String value) { 64 | putString(PREF_KEY_INPUT, value); 65 | } 66 | 67 | public String getInput() { 68 | return getString(PREF_KEY_INPUT); 69 | } 70 | 71 | 72 | } -------------------------------------------------------------------------------- /app/src/main/res/drawable/border.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 6 | 9 | -------------------------------------------------------------------------------- /app/src/main/res/layout/activity_main.xml: -------------------------------------------------------------------------------- 1 | 2 | 10 | 11 | 12 | 17 | 18 | 27 | 28 | 31 | 32 |