Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary: [Nested Classes](https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#nestedclasses) \| [Methods](https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#pubmethods) \| [Inherited Methods](https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#inhmethods)

# KeyGenParameterSpec

*** ** * ** ***

` public final class KeyGenParameterSpec `   
` extends https://developer.android.com/reference/java/lang/Object ` ` implements https://developer.android.com/reference/java/security/spec/AlgorithmParameterSpec `

|---|---|
| [java.lang.Object](https://developer.android.com/reference/java/lang/Object) ||
| ↳ | android.security.keystore.KeyGenParameterSpec |

<br />

*** ** * ** ***

`https://developer.android.com/reference/java/security/spec/AlgorithmParameterSpec` for initializing a `https://developer.android.com/reference/java/security/KeyPairGenerator` or a `https://developer.android.com/reference/javax/crypto/KeyGenerator` of the [Android Keystore system](https://developer.android.com/training/articles/keystore). The spec determines authorized uses of the key, such as whether user authentication is required for using the key, what operations are authorized (e.g., signing, but not decryption), with what parameters (e.g., only with a particular padding scheme or digest), and the key's validity start and end dates. Key use authorizations expressed in the spec apply only to secret keys and private keys -- public keys can be used for any supported operations.

To generate an asymmetric key pair or a symmetric key, create an instance of this class using the `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder`, initialize a `KeyPairGenerator` or a `KeyGenerator` of the desired key type (e.g., `EC` or `AES` -- see `https://developer.android.com/reference/android/security/keystore/KeyProperties`.`KEY_ALGORITHM` constants) from the `AndroidKeyStore` provider with the `KeyGenParameterSpec` instance, and then generate a key or key pair using `https://developer.android.com/reference/javax/crypto/KeyGenerator#generateKey()` or `https://developer.android.com/reference/java/security/KeyPairGenerator#generateKeyPair()`.

The generated key pair or key will be returned by the generator and also stored in the Android Keystore under the alias specified in this spec. To obtain the secret or private key from the Android Keystore use `https://developer.android.com/reference/java/security/KeyStore#getKey(java.lang.String,%20char[])` or `https://developer.android.com/reference/java/security/KeyStore#getEntry(java.lang.String,%20java.security.KeyStore.ProtectionParameter)`. To obtain the public key from the Android Keystore use `https://developer.android.com/reference/java/security/KeyStore#getCertificate(java.lang.String)` and then `https://developer.android.com/reference/java/security/cert/Certificate#getPublicKey()`.

To help obtain algorithm-specific public parameters of key pairs stored in the Android Keystore, generated private keys implement `https://developer.android.com/reference/java/security/interfaces/ECKey` or `https://developer.android.com/reference/java/security/interfaces/RSAKey` interfaces whereas public keys implement `https://developer.android.com/reference/java/security/interfaces/ECPublicKey` or `https://developer.android.com/reference/java/security/interfaces/RSAPublicKey` interfaces.

For asymmetric key pairs, a X.509 certificate will be also generated and stored in the Android Keystore. This is because the `https://developer.android.com/reference/java/security/KeyStore` abstraction does not support storing key pairs without a certificate. The subject, serial number, and validity dates of the certificate can be customized in this spec. The certificate may be replaced at a later time by a certificate signed by a Certificate Authority (CA).

NOTE: If attestation is not requested using `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setAttestationChallenge(byte[])`, generated certificate may be self-signed. If a private key is not authorized to sign the certificate, then the certificate will be created with an invalid signature which will not verify. Such a certificate is still useful because it provides access to the public key. To generate a valid signature for the certificate the key needs to be authorized for all of the following:

- `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_SIGN`,
- operation without requiring the user to be authenticated (see `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserAuthenticationRequired(boolean)`),
- signing/origination at this moment in time (see `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setKeyValidityStart(java.util.Date)` and `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setKeyValidityForOriginationEnd(java.util.Date)`),
- suitable digest,
- (RSA keys only) padding scheme `https://developer.android.com/reference/android/security/keystore/KeyProperties#SIGNATURE_PADDING_RSA_PKCS1`.

NOTE: The key material of the generated symmetric and private keys is not accessible. The key material of the public keys is accessible.

Instances of this class are immutable.

<br />

### Known issues

A known bug in Android 6.0 (API Level 23) causes user authentication-related authorizations to be enforced even for public keys. To work around this issue extract the public key material to use outside of Android Keystore. For example:

    PublicKey unrestrictedPublicKey =
            KeyFactory.getInstance(publicKey.getAlgorithm()).generatePublic(
                    new X509EncodedKeySpec(publicKey.getEncoded()));

<br />

### Example: NIST P-256 EC key pair for signing/verification using ECDSA

This example illustrates how to generate a NIST P-256 (aka secp256r1 aka prime256v1) EC key pair in the Android KeyStore system under alias `key1` where the private key is authorized to be used only for signing using SHA-256, SHA-384, or SHA-512 digest and only if the user has been authenticated within the last five minutes. The use of the public key is unrestricted (See Known Issues).

    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore");
    keyPairGenerator.initialize(
            new KeyGenParameterSpec.Builder(
                    "key1",
                    KeyProperties.PURPOSE_SIGN)
                    .setAlgorithmParameterSpec(new ECGenParameterSpec("secp256r1"))
                    .setDigests(KeyProperties.DIGEST_SHA256,
                            KeyProperties.DIGEST_SHA384,
                            KeyProperties.DIGEST_SHA512)
                    // Only permit the private key to be used if the user authenticated
                    // within the last five minutes.
                    .setUserAuthenticationRequired(true)
                    .setUserAuthenticationValidityDurationSeconds(5 * 60)
                    .build());
    KeyPair keyPair = keyPairGenerator.generateKeyPair();
    Signature signature = Signature.getInstance("SHA256withECDSA");
    signature.initSign(keyPair.getPrivate());
    ...

    // The key pair can also be obtained from the Android Keystore any time as follows:
    KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
    keyStore.load(null);
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("key1", null);
    PublicKey publicKey = keyStore.getCertificate("key1").getPublicKey();

<br />

### Example: RSA key pair for signing/verification using RSA-PSS

This example illustrates how to generate an RSA key pair in the Android KeyStore system under alias `key1` authorized to be used only for signing using the RSA-PSS signature padding scheme with SHA-256 or SHA-512 digests. The use of the public key is unrestricted.

    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_RSA, "AndroidKeyStore");
    keyPairGenerator.initialize(
            new KeyGenParameterSpec.Builder(
                    "key1",
                    KeyProperties.PURPOSE_SIGN)
                    .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                    .setSignaturePaddings(KeyProperties.SIGNATURE_PADDING_RSA_PSS)
                    .build());
    KeyPair keyPair = keyPairGenerator.generateKeyPair();
    Signature signature = Signature.getInstance("SHA256withRSA/PSS");
    signature.initSign(keyPair.getPrivate());
    ...

    // The key pair can also be obtained from the Android Keystore any time as follows:
    KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
    keyStore.load(null);
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("key1", null);
    PublicKey publicKey = keyStore.getCertificate("key1").getPublicKey();

<br />

### Example: RSA key pair for encryption/decryption using RSA OAEP

This example illustrates how to generate an RSA key pair in the Android KeyStore system under alias `key1` where the private key is authorized to be used only for decryption using RSA OAEP encryption padding scheme with SHA-256 or SHA-512 digests. The use of the public key is unrestricted.

    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_RSA, "AndroidKeyStore");
    keyPairGenerator.initialize(
            new KeyGenParameterSpec.Builder(
                    "key1",
                    KeyProperties.PURPOSE_DECRYPT)
                    .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)
                    .build());
    KeyPair keyPair = keyPairGenerator.generateKeyPair();
    Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
    cipher.init(Cipher.DECRYPT_MODE, keyPair.getPrivate());
    ...

    // The key pair can also be obtained from the Android Keystore any time as follows:
    KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
    keyStore.load(null);
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("key1", null);
    PublicKey publicKey = keyStore.getCertificate("key1").getPublicKey();

<br />

### Example: AES key for encryption/decryption in GCM mode

The following example illustrates how to generate an AES key in the Android KeyStore system under alias `key2` authorized to be used only for encryption/decryption in GCM mode with no padding.

    KeyGenerator keyGenerator = KeyGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
    keyGenerator.init(
            new KeyGenParameterSpec.Builder("key2",
                    KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
                    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                    .build());
    SecretKey key = keyGenerator.generateKey();

    Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
    cipher.init(Cipher.ENCRYPT_MODE, key);
    ...

    // The key can also be obtained from the Android Keystore any time as follows:
    KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
    keyStore.load(null);
    key = (SecretKey) keyStore.getKey("key2", null);

<br />

### Example: HMAC key for generating a MAC using SHA-256

This example illustrates how to generate an HMAC key in the Android KeyStore system under alias `key2` authorized to be used only for generating an HMAC using SHA-256.

    KeyGenerator keyGenerator = KeyGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_HMAC_SHA256, "AndroidKeyStore");
    keyGenerator.init(
            new KeyGenParameterSpec.Builder("key2", KeyProperties.PURPOSE_SIGN).build());
    SecretKey key = keyGenerator.generateKey();
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(key);
    ...

    // The key can also be obtained from the Android Keystore any time as follows:
    KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
    keyStore.load(null);
    key = (SecretKey) keyStore.getKey("key2", null);

<br />

### Example: EC key for ECDH key agreement

This example illustrates how to generate an elliptic curve key pair, used to establish a shared secret with another party using ECDH key agreement.

    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore");
    keyPairGenerator.initialize(
            new KeyGenParameterSpec.Builder(
                "eckeypair",
                KeyProperties.PURPOSE_AGREE_KEY)
                .setAlgorithmParameterSpec(new ECGenParameterSpec("secp256r1"))
                .build());
    KeyPair myKeyPair = keyPairGenerator.generateKeyPair();

    // Exchange public keys with server. A new ephemeral key MUST be used for every message.
    PublicKey serverEphemeralPublicKey; // Ephemeral key received from server.

    // Create a shared secret based on our private key and the other party's public key.
    KeyAgreement keyAgreement = KeyAgreement.getInstance("ECDH", "AndroidKeyStore");
    keyAgreement.init(myKeyPair.getPrivate());
    keyAgreement.doPhase(serverEphemeralPublicKey, true);
    byte[] sharedSecret = keyAgreement.generateSecret();

    // sharedSecret cannot safely be used as a key yet. We must run it through a key derivation
    // function with some other data: "salt" and "info". Salt is an optional random value,
    // omitted in this example. It's good practice to include both public keys and any other
    // key negotiation data in info. Here we use the public keys and a label that indicates
    // messages encrypted with this key are coming from the server.
    byte[] salt = {};
    ByteArrayOutputStream info = new ByteArrayOutputStream();
    info.write("ECDH secp256r1 AES-256-GCM-SIV\0".getBytes(StandardCharsets.UTF_8));
    info.write(myKeyPair.getPublic().getEncoded());
    info.write(serverEphemeralPublicKey.getEncoded());

    // This example uses the Tink library and the HKDF key derivation function.
    AesGcmSiv key = new AesGcmSiv(Hkdf.computeHkdf(
            "HMACSHA256", sharedSecret, salt, info.toByteArray(), 32));
    byte[] associatedData = {};
    return key.decrypt(ciphertext, associatedData);

<br />

### Example: ML-DSA key pair for signing

This example illustrates how to generate an ML-DSA key pair in the Android KeyStore system under alias `key1` authorized to be used only for signing. The use of the public key is unrestricted.

The generated key pair will use the ML-DSA-65 parameter set if the `KeyPairGenerator` is instantiated with the family name `"ML-DSA"` or the parameter set name `"ML-DSA-65"`. On the other hand, the key pair will use the ML-DSA-87 parameter set only if the `KeyPairGenerator` is instantiated with the parameter set name `"ML-DSA-87"`.

In both cases, it is not required to set the `AlgorithmParameterSpec` or digest in the `KeyGenParameterSpec`. If the `AlgorithmParameterSpec` is set to a non-null value, then the value must match the algorithm name used to instantiate the `KeyPairGenerator`. Specifically, the algorithm name must be `"ML-DSA"` or `"ML-DSA-65"` if `https://developer.android.com/reference/java/security/spec/NamedParameterSpec#ML_DSA_65` is specified, or `"ML-DSA-87"` if `https://developer.android.com/reference/java/security/spec/NamedParameterSpec#ML_DSA_87` is specified.

**Note:** ML-DSA support is only available on devices with a Trusted Execution Environment running KeyMint version \>= 5. Support can be determined by checking that `https://developer.android.com/reference/android/content/pm/PackageManager#FEATURE_HARDWARE_KEYSTORE` has a value `>= 500`.

<br />

#### Case 1: ML-DSA-65

    // KeyProperties.KEY_ALGORITHM_ML_DSA_65 can also be used here.
    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_ML_DSA, "AndroidKeyStore");
    keyPairGenerator.initialize(
            new KeyGenParameterSpec.Builder("key1", KeyProperties.PURPOSE_SIGN).build());
    // NamedParameterSpec.ML_DSA_65 and KeyProperties.DIGEST_NONE can optionally be specified:
    // keyPairGenerator.initialize(
    //         new KeyGenParameterSpec.Builder("key1", KeyProperties.PURPOSE_SIGN)
    //                 .setAlgorithmParameterSpec(NamedParameterSpec.ML_DSA_65)
    //                 .setDigests(KeyProperties.DIGEST_NONE)
    //                 .build());
    KeyPair keyPair = keyPairGenerator.generateKeyPair();
    Signature signature = Signature.getInstance("ML-DSA");  // Or "ML-DSA-65"
    signature.initSign(keyPair.getPrivate());
    ...

    // The key pair can also be obtained from the Android Keystore any time as follows:
    KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
    keyStore.load(null);
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("key1", null);
    PublicKey publicKey = keyStore.getCertificate("key1").getPublicKey();

<br />

#### Case 2: ML-DSA-87

    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_ML_DSA_87, "AndroidKeyStore");
    keyPairGenerator.initialize(
            new KeyGenParameterSpec.Builder("key1", KeyProperties.PURPOSE_SIGN).build());
    // NamedParameterSpec.ML_DSA_87 and KeyProperties.DIGEST_NONE can optionally be specified:
    // keyPairGenerator.initialize(
    //         new KeyGenParameterSpec.Builder("key1", KeyProperties.PURPOSE_SIGN)
    //                 .setAlgorithmParameterSpec(NamedParameterSpec.ML_DSA_87)
    //                 .setDigests(KeyProperties.DIGEST_NONE)
    //                 .build());
    KeyPair keyPair = keyPairGenerator.generateKeyPair();
    Signature signature = Signature.getInstance("ML-DSA");  // Or "ML-DSA-87"
    signature.initSign(keyPair.getPrivate());
    ...

    // The key pair can also be obtained from the Android Keystore any time as follows:
    KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
    keyStore.load(null);
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("key1", null);
    PublicKey publicKey = keyStore.getCertificate("key1").getPublicKey();

<br />

## Summary

| ### Nested classes ||
|---|---|
| ` class` | `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder` Builder of `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec` instances. |

| ### Public methods ||
|---|---|
| ` https://developer.android.com/reference/java/security/spec/AlgorithmParameterSpec` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getAlgorithmParameterSpec()() ` Returns the key algorithm-specific `https://developer.android.com/reference/java/security/spec/AlgorithmParameterSpec` that will be used for creation of the key or `null` if algorithm-specific defaults should be used. |
| ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getAttestKeyAlias()() ` Returns the alias of the attestation key that will be used to sign the attestation certificate of the generated key. |
| ` byte[]` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getAttestationChallenge()() ` Returns the attestation challenge value that will be placed in attestation certificate for this key pair. |
| ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getBlockModes()() ` Gets the set of block modes (e.g., `GCM`, `CBC`) with which the key can be used when encrypting/decrypting. |
| ` https://developer.android.com/reference/java/util/Date` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getCertificateNotAfter()() ` Returns the end date to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`. |
| ` https://developer.android.com/reference/java/util/Date` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getCertificateNotBefore()() ` Returns the start date to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`. |
| ` https://developer.android.com/reference/java/math/BigInteger` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getCertificateSerialNumber()() ` Returns the serial number to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`. |
| ` https://developer.android.com/reference/javax/security/auth/x500/X500Principal` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getCertificateSubject()() ` Returns the subject distinguished name to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`. |
| ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getDigests()() ` Returns the set of digest algorithms (e.g., `SHA-256`, `SHA-384` with which the key can be used. |
| ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getEncryptionPaddings()() ` Returns the set of padding schemes (e.g., `PKCS7Padding`, `OEAPPadding`, `PKCS1Padding`, `NoPadding`) with which the key can be used when encrypting/decrypting. |
| ` int` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getKeySize()() ` Returns the requested key size. |
| ` https://developer.android.com/reference/java/util/Date` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getKeyValidityForConsumptionEnd()() ` Returns the time instant after which the key is no longer valid for decryption and verification or `null` if not restricted. |
| ` https://developer.android.com/reference/java/util/Date` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getKeyValidityForOriginationEnd()() ` Returns the time instant after which the key is no longer valid for encryption and signing or `null` if not restricted. |
| ` https://developer.android.com/reference/java/util/Date` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getKeyValidityStart()() ` Returns the time instant before which the key is not yet valid or `null` if not restricted. |
| ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getKeystoreAlias()() ` Returns the alias that will be used in the `java.security.KeyStore` in conjunction with the `AndroidKeyStore`. |
| ` int` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getMaxUsageCount()() ` Returns the maximum number of times the limited use key is allowed to be used or `https://developer.android.com/reference/android/security/keystore/KeyProperties#UNRESTRICTED_USAGE_COUNT` if there\\u2019s no restriction on the number of times the key can be used. |
| ` https://developer.android.com/reference/java/util/Set<https://developer.android.com/reference/java/lang/String>` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getMgf1Digests()() ` Returns the set of digests that can be used by the MGF1 mask generation function (e.g., `SHA-256`, `SHA-384`) with the key. |
| ` int` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getPurposes()() ` Returns the set of purposes (e.g., encrypt, decrypt, sign) for which the key can be used. |
| ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getSignaturePaddings()() ` Gets the set of padding schemes (e.g., `PSS`, `PKCS#1`) with which the key can be used when signing/verifying. |
| ` int` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getUserAuthenticationType()() ` Gets the modes of authentication that can authorize use of this key. |
| ` int` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getUserAuthenticationValidityDurationSeconds()() ` Gets the duration of time (seconds) for which this key is authorized to be used after the user is successfully authenticated. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isDevicePropertiesAttestationIncluded()() ` Returns `true` if attestation for the base device properties (`https://developer.android.com/reference/android/os/Build#BRAND`, `https://developer.android.com/reference/android/os/Build#DEVICE`, `https://developer.android.com/reference/android/os/Build#MANUFACTURER`, `https://developer.android.com/reference/android/os/Build#MODEL`, `https://developer.android.com/reference/android/os/Build#PRODUCT`) was requested to be added in the attestation certificate for the generated key. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isDigestsSpecified()() ` Returns `true` if the set of digest algorithms with which the key can be used has been specified. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isInvalidatedByBiometricEnrollment()() ` Returns `true` if the key is irreversibly invalidated when a new biometric is enrolled or all enrolled biometrics are removed. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isMgf1DigestsSpecified()() ` Returns `true` if the set of digests for the MGF1 mask generation function, with which the key can be used, has been specified. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isRandomizedEncryptionRequired()() ` Returns `true` if encryption using this key must be sufficiently randomized to produce different ciphertexts for the same plaintext every time. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isStrongBoxBacked()() ` Returns `true` if the key is protected by a Strongbox security chip. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUnlockedDeviceRequired()() ` Returns `true` if the key is authorized to be used only while the device is unlocked. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationRequired()() ` Returns `true` if the key is authorized to be used only if the user has been authenticated. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationValidWhileOnBody()() ` Returns `true` if the key will remain authorized only until the device is removed from the user's body, up to the validity duration. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserConfirmationRequired()() ` Returns `true` if the key is authorized to be used only for messages confirmed by the user. |
| ` boolean` | ` https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserPresenceRequired()() ` Returns `true` if the key is authorized to be used only if a test of user presence has been performed between the `Signature.initSign()` and `Signature.sign()` calls. |

### Inherited methods

From class ` https://developer.android.com/reference/java/lang/Object ` ` https://developer.android.com/reference/java/lang/Object` ` https://developer.android.com/reference/java/lang/Object#clone()() `

Creates and returns a copy of this object.
` boolean` ` https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj) `

Indicates whether some other object is "equal to" this one.
` void` ` https://developer.android.com/reference/java/lang/Object#finalize()() `

Called by the garbage collector on an object when garbage collection determines that there are no more references to the object.
` final https://developer.android.com/reference/java/lang/Class<?>` ` https://developer.android.com/reference/java/lang/Object#getClass()() `

Returns the runtime class of this `Object`.
` int` ` https://developer.android.com/reference/java/lang/Object#hashCode()() `

Returns a hash code value for the object.
` final void` ` https://developer.android.com/reference/java/lang/Object#notify()() `

Wakes up a single thread that is waiting on this object's monitor.
` final void` ` https://developer.android.com/reference/java/lang/Object#notifyAll()() `

Wakes up all threads that are waiting on this object's monitor.
` https://developer.android.com/reference/java/lang/String` ` https://developer.android.com/reference/java/lang/Object#toString()() `

Returns a string representation of the object.
` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos) `

Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed.
` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis) `

Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed.
` final void` ` https://developer.android.com/reference/java/lang/Object#wait()() `

Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*.

## Public methods

### getAlgorithmParameterSpec

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public AlgorithmParameterSpec getAlgorithmParameterSpec ()
```

Returns the key algorithm-specific `https://developer.android.com/reference/java/security/spec/AlgorithmParameterSpec` that will be used for creation of the key or `null` if algorithm-specific defaults should be used.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/security/spec/AlgorithmParameterSpec` | <br /> |

### getAttestKeyAlias

Added in [API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public String getAttestKeyAlias ()
```

Returns the alias of the attestation key that will be used to sign the attestation certificate of the generated key. Note that an attestation certificate will only be generated if an attestation challenge is set.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | This value may be `null`. <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setAttestKeyAlias(java.lang.String)`

### getAttestationChallenge

Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public byte[] getAttestationChallenge ()
```

Returns the attestation challenge value that will be placed in attestation certificate for this key pair.

If this method returns non-`null`, the public key certificate for this key pair will contain an extension that describes the details of the key's configuration and authorizations, including the content of the attestation challenge value. If the key is in secure hardware, and if the secure hardware supports attestation, the certificate will be signed by a chain of certificates rooted at a trustworthy CA key. Otherwise the chain will be rooted at an untrusted certificate.

If this method returns `null`, and the spec is used to generate an asymmetric (RSA or EC) key pair, the public key will have a self-signed certificate if it has purpose `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_SIGN`. If does not have purpose `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_SIGN`, it will have a fake certificate.

Symmetric keys, such as AES and HMAC keys, do not have public key certificates. If a KeyGenParameterSpec with getAttestationChallenge returning non-null is used to generate a symmetric (AES or HMAC) key, `https://developer.android.com/reference/javax/crypto/KeyGenerator#generateKey()` will throw `https://developer.android.com/reference/java/security/InvalidAlgorithmParameterException`.

<br />

| Returns ||
|---|---|
| `byte[]` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setAttestationChallenge(byte[])`

### getBlockModes

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public String[] getBlockModes ()
```

Gets the set of block modes (e.g., `GCM`, `CBC`) with which the key can be used when encrypting/decrypting. Attempts to use the key with any other block modes will be rejected.

See `https://developer.android.com/reference/android/security/keystore/KeyProperties`.`BLOCK_MODE` constants.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | This value cannot be `null`. Value is one of the following: - `https://developer.android.com/reference/android/security/keystore/KeyProperties#BLOCK_MODE_ECB` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#BLOCK_MODE_CBC` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#BLOCK_MODE_CTR` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#BLOCK_MODE_GCM` |

### getCertificateNotAfter

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Date getCertificateNotAfter ()
```

Returns the end date to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/Date` | This value cannot be `null`. <br /> |

### getCertificateNotBefore

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Date getCertificateNotBefore ()
```

Returns the start date to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/Date` | This value cannot be `null`. <br /> |

### getCertificateSerialNumber

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public BigInteger getCertificateSerialNumber ()
```

Returns the serial number to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/math/BigInteger` | This value cannot be `null`. <br /> |

### getCertificateSubject

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public X500Principal getCertificateSubject ()
```

Returns the subject distinguished name to be used on the X.509 certificate that will be put in the `https://developer.android.com/reference/java/security/KeyStore`.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/javax/security/auth/x500/X500Principal` | This value cannot be `null`. <br /> |

### getDigests

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public String[] getDigests ()
```

Returns the set of digest algorithms (e.g., `SHA-256`, `SHA-384` with which the key can be used.

See `https://developer.android.com/reference/android/security/keystore/KeyProperties`.`DIGEST` constants.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | This value cannot be `null`. Value is one of the following: - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_NONE` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_MD5` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA1` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA224` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA256` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA384` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA512` |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/lang/IllegalStateException` | if this set has not been specified. |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isDigestsSpecified()`

### getEncryptionPaddings

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public String[] getEncryptionPaddings ()
```

Returns the set of padding schemes (e.g., `PKCS7Padding`, `OEAPPadding`, `PKCS1Padding`, `NoPadding`) with which the key can be used when encrypting/decrypting. Attempts to use the key with any other padding scheme will be rejected.

See `https://developer.android.com/reference/android/security/keystore/KeyProperties`.`ENCRYPTION_PADDING` constants.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | This value cannot be `null`. Value is one of the following: - `https://developer.android.com/reference/android/security/keystore/KeyProperties#ENCRYPTION_PADDING_NONE` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#ENCRYPTION_PADDING_PKCS7` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#ENCRYPTION_PADDING_RSA_PKCS1` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#ENCRYPTION_PADDING_RSA_OAEP` |

### getKeySize

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public int getKeySize ()
```

Returns the requested key size. If `-1`, the size should be looked up from `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getAlgorithmParameterSpec()`, if provided, otherwise an algorithm-specific default size should be used.

<br />

| Returns ||
|---|---|
| `int` | <br /> |

### getKeyValidityForConsumptionEnd

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Date getKeyValidityForConsumptionEnd ()
```

Returns the time instant after which the key is no longer valid for decryption and verification or `null` if not restricted.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/Date` | <br /> |

### getKeyValidityForOriginationEnd

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Date getKeyValidityForOriginationEnd ()
```

Returns the time instant after which the key is no longer valid for encryption and signing or `null` if not restricted.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/Date` | <br /> |

### getKeyValidityStart

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Date getKeyValidityStart ()
```

Returns the time instant before which the key is not yet valid or `null` if not restricted.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/Date` | <br /> |

### getKeystoreAlias

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public String getKeystoreAlias ()
```

Returns the alias that will be used in the `java.security.KeyStore` in conjunction with the `AndroidKeyStore`.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | This value cannot be `null`. <br /> |

### getMaxUsageCount

Added in [API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public int getMaxUsageCount ()
```

Returns the maximum number of times the limited use key is allowed to be used or `https://developer.android.com/reference/android/security/keystore/KeyProperties#UNRESTRICTED_USAGE_COUNT` if there\\u2019s no restriction on the number of times the key can be used.

<br />

| Returns ||
|---|---|
| `int` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setMaxUsageCount(int)`

### getMgf1Digests

Added in [API level 35](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Set<String> getMgf1Digests ()
```

Returns the set of digests that can be used by the MGF1 mask generation function (e.g., `SHA-256`, `SHA-384`) with the key. Useful with the `RSA-OAEP` scheme. If not explicitly specified during key generation, the default `SHA-1` digest is used and may be specified when using the key.

See `https://developer.android.com/reference/android/security/keystore/KeyProperties`.`DIGEST` constants.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/Set<https://developer.android.com/reference/java/lang/String>` | This value cannot be `null`. Value is one of the following: - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_NONE` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_MD5` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA1` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA224` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA256` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA384` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#DIGEST_SHA512` |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/lang/IllegalStateException` | if this set has not been specified. |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isMgf1DigestsSpecified()`

### getPurposes

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public int getPurposes ()
```

Returns the set of purposes (e.g., encrypt, decrypt, sign) for which the key can be used. Attempts to use the key for any other purpose will be rejected.

See `https://developer.android.com/reference/android/security/keystore/KeyProperties`.`PURPOSE` flags.

<br />

| Returns ||
|---|---|
| `int` | Value is either `0` or a combination of the following: - `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_ENCRYPT` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_DECRYPT` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_SIGN` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_VERIFY` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_WRAP_KEY` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_AGREE_KEY` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#PURPOSE_ATTEST_KEY` |

### getSignaturePaddings

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public String[] getSignaturePaddings ()
```

Gets the set of padding schemes (e.g., `PSS`, `PKCS#1`) with which the key can be used when signing/verifying. Attempts to use the key with any other padding scheme will be rejected.

See `https://developer.android.com/reference/android/security/keystore/KeyProperties`.`SIGNATURE_PADDING` constants.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | This value cannot be `null`. Value is one of the following: - `https://developer.android.com/reference/android/security/keystore/KeyProperties#SIGNATURE_PADDING_RSA_PKCS1` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#SIGNATURE_PADDING_RSA_PSS` |

### getUserAuthenticationType

Added in [API level 30](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public int getUserAuthenticationType ()
```

Gets the modes of authentication that can authorize use of this key. This has effect only if user authentication is required (see `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationRequired()`).

This authorization applies only to secret key and private key operations. Public key operations are not restricted.

<br />

| Returns ||
|---|---|
| `int` | integer representing the bitwse OR of all acceptable authentication types for the key. Value is either `0` or a combination of the following: - `https://developer.android.com/reference/android/security/keystore/KeyProperties#AUTH_BIOMETRIC_STRONG` - `https://developer.android.com/reference/android/security/keystore/KeyProperties#AUTH_DEVICE_CREDENTIAL` |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationRequired()`
- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserAuthenticationParameters(int,%20int)`

### getUserAuthenticationValidityDurationSeconds

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public int getUserAuthenticationValidityDurationSeconds ()
```

Gets the duration of time (seconds) for which this key is authorized to be used after the user is successfully authenticated. This has effect only if user authentication is required (see `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationRequired()`).

This authorization applies only to secret key and private key operations. Public key operations are not restricted.

<br />

| Returns ||
|---|---|
| `int` | duration in seconds or `-1` if authentication is required for every use of the key. <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationRequired()`
- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserAuthenticationValidityDurationSeconds(int)`

### isDevicePropertiesAttestationIncluded

Added in [API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isDevicePropertiesAttestationIncluded ()
```

Returns `true` if attestation for the base device properties (`https://developer.android.com/reference/android/os/Build#BRAND`, `https://developer.android.com/reference/android/os/Build#DEVICE`, `https://developer.android.com/reference/android/os/Build#MANUFACTURER`, `https://developer.android.com/reference/android/os/Build#MODEL`, `https://developer.android.com/reference/android/os/Build#PRODUCT`) was requested to be added in the attestation certificate for the generated key. `https://developer.android.com/reference/javax/crypto/KeyGenerator#generateKey()` will throw `https://developer.android.com/reference/java/security/ProviderException` if device properties attestation fails or is not supported.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setDevicePropertiesAttestationIncluded(boolean)`

### isDigestsSpecified

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isDigestsSpecified ()
```

Returns `true` if the set of digest algorithms with which the key can be used has been specified.

<br />

| Returns ||
|---|---|
| `boolean` | This value cannot be `null`. <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getDigests()`

### isInvalidatedByBiometricEnrollment

Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isInvalidatedByBiometricEnrollment ()
```

Returns `true` if the key is irreversibly invalidated when a new biometric is enrolled or all enrolled biometrics are removed. This has effect only for keys that require biometric user authentication for every use.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationRequired()`
- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getUserAuthenticationValidityDurationSeconds()`
- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setInvalidatedByBiometricEnrollment(boolean)`

### isMgf1DigestsSpecified

Added in [API level 35](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isMgf1DigestsSpecified ()
```

Returns `true` if the set of digests for the MGF1 mask generation function, with which the key can be used, has been specified. Useful with the `RSA-OAEP` scheme.

<br />

| Returns ||
|---|---|
| `boolean` | This value cannot be `null`. <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getMgf1Digests()`

### isRandomizedEncryptionRequired

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isRandomizedEncryptionRequired ()
```

Returns `true` if encryption using this key must be sufficiently randomized to produce different ciphertexts for the same plaintext every time. The formal cryptographic property being required is *indistinguishability under chosen-plaintext attack (`IND-CPA`)*. This property is important because it mitigates several classes of weaknesses due to which ciphertext may leak information about plaintext. For example, if a given plaintext always produces the same ciphertext, an attacker may see the repeated ciphertexts and be able to deduce something about the plaintext.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

### isStrongBoxBacked

Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isStrongBoxBacked ()
```

Returns `true` if the key is protected by a Strongbox security chip.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

### isUnlockedDeviceRequired

Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isUnlockedDeviceRequired ()
```

Returns `true` if the key is authorized to be used only while the device is unlocked.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUnlockedDeviceRequired(boolean)`

### isUserAuthenticationRequired

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isUserAuthenticationRequired ()
```

Returns `true` if the key is authorized to be used only if the user has been authenticated.

This authorization applies only to secret key and private key operations. Public key operations are not restricted.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getUserAuthenticationValidityDurationSeconds()`
- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserAuthenticationRequired(boolean)`

### isUserAuthenticationValidWhileOnBody

Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isUserAuthenticationValidWhileOnBody ()
```

Returns `true` if the key will remain authorized only until the device is removed from the user's body, up to the validity duration. This option has no effect on keys that don't have an authentication validity duration, and has no effect if the device lacks an on-body sensor.

Authorization applies only to secret key and private key operations. Public key operations are not restricted.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#isUserAuthenticationRequired()`
- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec#getUserAuthenticationValidityDurationSeconds()`
- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserAuthenticationValidWhileOnBody(boolean)`

### isUserConfirmationRequired

Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isUserConfirmationRequired ()
```

Returns `true` if the key is authorized to be used only for messages confirmed by the user. Confirmation is separate from user authentication (see `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserAuthenticationRequired(boolean)`). Keys can be created that require confirmation but not user authentication, or user authentication but not confirmation, or both. Confirmation verifies that some user with physical possession of the device has approved a displayed message. User authentication verifies that the correct user is present and has authenticated.

This authorization applies only to secret key and private key operations. Public key operations are not restricted.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setUserConfirmationRequired(boolean)`

### isUserPresenceRequired

Added in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isUserPresenceRequired ()
```

Returns `true` if the key is authorized to be used only if a test of user presence has been performed between the `Signature.initSign()` and `Signature.sign()` calls. It requires that the KeyStore implementation have a direct way to validate the user presence for example a KeyStore hardware backed strongbox can use a button press that is observable in hardware. A test for user presence is tangential to authentication. The test can be part of an authentication step as long as this step can be validated by the hardware protecting the key and cannot be spoofed. For example, a physical button press can be used as a test of user presence if the other pins connected to the button are not able to simulate a button press. There must be no way for the primary processor to fake a button press, or that button must not be used as a test of user presence.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |