ksecuremessage-storage-keyprovider-android/dev.kreienbuehl.ksecuremessage.storage.keyprovider.android/AndroidStorageKeyProvider

AndroidStorageKeyProvider

class AndroidStorageKeyProvider(context: Context, namespace: String = DEFAULT_NAMESPACE) : StorageKeyProvider

A StorageKeyProvider that protects the storage key with the Android Keystore (docs/storage-key-providers.md).

The 32-byte storage key is wrapped with AES-256-GCM under a non-exportable Keystore key (alias dev.kreienbuehl.ksecuremessage.storage.v1.<namespace>) and only the wrapped form is written, to noBackupFilesDir/ksecuremessage/storage-key-<namespace>.bin. Whether the Keystore key is hardware-backed depends on the device. The Keystore key needs no user authentication, so background work can open storage.

namespace separates the keys of different databases, accounts or profiles of one application (letters, digits, ., _, -; at most 64).

The file holds one entry per storage key (several during a storage key rotation, docs/storage-key-rotation.md), all wrapped by the same Keystore key. createKey and removeKey rewrite the file atomically and keep every other entry byte for byte.

The first key is created only if there is no wrapped key file. If the file exists but the Keystore key is gone or the file is damaged, every call fails with StorageEncryptionException.KeyUnavailable; nothing is regenerated or overwritten. A damaged entry fails only for its own key ID.

Constructors

AndroidStorageKeyProvider

constructor(context: Context, namespace: String = DEFAULT_NAMESPACE)

Types

Companion

object Companion

Functions

createKey

open suspend override fun createKey(id: StorageKeyId): StorageEncryptionKey

hasKeys

open suspend override fun hasKeys(): Boolean

key

open suspend override fun key(id: StorageKeyId): StorageEncryptionKey?

loadOrCreateKey

open suspend override fun loadOrCreateKey(): StorageEncryptionKey

removeKey

open suspend override fun removeKey(id: StorageKeyId): Boolean