I need to generate an elliptic key pair in Android and store it to KeyStore to protect a private key from extraction.
I was able to generate a key pair using Spongycastle library, but I cannot import the key pair in the KeyStore. Firstly, because I do not have a certificate and secondly, even if I tried to create one, it did not import the key either.
I though of generating a key pair using KeyGenParameterSpec, but it's not accessible in APIs below version 23.
To sum up my question, is there a non-hacky way how to do it with general Android resources that are meant for that? Or it is simply impossible to work with elliptic curve keys on version Lollipop and lower?
President James K. Polk :
In the documentation of the Android keystore system is a section on supported key generation algorithms. It states:\n\n\n Prior to API Level 23, EC keys can be generated using KeyPairGenerator\n of algorithm \"RSA\" initialized KeyPairGeneratorSpec whose key type is\n set to \"EC\" using setKeyType(String). EC curve name cannot be\n specified using this method -- a NIST P-curve is automatically chosen\n based on the requested key size.\n\n\nIf you can live with these limitations then you can use the Android Keystore for API levels down to API 19. It might seem that you can do down to API 18, but the necessary methods to set the key size and key type do not exist until API level 19. The name of the class used to build the parameter spec for API levels 19 through 22 inclusive is KeyPairGeneratorSpec.Builder. This is very similar to the name of the class used for API level 23 and above, KeyGenParameterSpec.Builder, so be careful not to confuse the two.\n\nHere is a little snippet of code illustrating the above. It should run on API 19.\n\nprivate void createEcKey() throws Exception {\n Calendar start = Calendar.getInstance();\n Calendar end = Calendar.getInstance();\n end.add(Calendar.YEAR, 1);\n KeyPairGeneratorSpec spec =\n new KeyPairGeneratorSpec.Builder(this)\n .setAlias(\"myKey\")\n .setKeySize(256)\n .setKeyType(\"EC\")\n .setSubject(new X500Principal(\"CN=Dodgy Stuff\"))\n .setSerialNumber(BigInteger.valueOf(123456789L))\n .setStartDate(start.getTime())\n .setEndDate(end.getTime())\n .build();\n KeyPairGenerator kpg = KeyPairGenerator.getInstance(\n \"RSA\", \"AndroidKeyStore\");\n kpg.initialize(spec);\n KeyPair keyPair = kpg.generateKeyPair();\n ECPublicKey ecPublicKey = (ECPublicKey) keyPair.getPublic();\n ECPrivateKey ecPrivateKey = (ECPrivateKey) keyPair.getPrivate();\n\n //\n // The following will throw an Exception if uncommented, because\n // the private key is not allowed to leave the protection of\n // the Androud Keystore boundary.\n //\n // byte [] privEncoded = ecPrivateKey.getEncoded();\n}\n",
2018-05-05T16:11:37