1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 package com.android.server.locksettings.recoverablekeystore; 18 19 import android.security.keystore.AndroidKeyStoreSecretKey; 20 21 /** 22 * Private key stored in AndroidKeyStore. Used to wrap recoverable keys before writing them to disk. 23 * 24 * <p>Identified by a generation ID, which increments whenever a new platform key is generated. A 25 * new key must be generated whenever the user disables their lock screen, as the decryption key is 26 * tied to lock-screen authentication. 27 * 28 * <p>One current platform key exists per profile on the device. (As each must be tied to a 29 * different user's lock screen.) 30 * 31 * @hide 32 */ 33 public class PlatformEncryptionKey { 34 35 private final int mGenerationId; 36 private final AndroidKeyStoreSecretKey mKey; 37 38 /** 39 * A new instance. 40 * 41 * @param generationId The generation ID of the key. 42 * @param key The secret key handle. Can be used to encrypt WITHOUT requiring screen unlock. 43 */ 44 public PlatformEncryptionKey(int generationId, AndroidKeyStoreSecretKey key) { 45 mGenerationId = generationId; 46 mKey = key; 47 } 48 49 /** 50 * Returns the generation ID of the key. 51 */ 52 public int getGenerationId() { 53 return mGenerationId; 54 } 55 56 /** 57 * Returns the actual key, which can only be used to encrypt. 58 */ 59 public AndroidKeyStoreSecretKey getKey() { 60 return mKey; 61 } 62 } 63
