WritableIdentityCredential
public
abstract
class
WritableIdentityCredential
extends Object
java.lang.Object | |
↳ | androidx.security.identity.WritableIdentityCredential |
Class used to personalize a new identity credential.
Credentials cannot be updated or modified after creation; any changes require deletion and
re-creation.
Use IdentityCredentialStore.createCredential(String, String)
to create a new credential.
Summary
Public methods | |
---|---|
abstract
Collection<X509Certificate>
|
getCredentialKeyCertificateChain(byte[] challenge)
Generates and returns an X.509 certificate chain for the CredentialKey which identifies this credential to the issuing authority. |
abstract
byte[]
|
personalize(PersonalizationData personalizationData)
Stores all of the data in the credential, with the specified access control profiles. |
Inherited methods | |
---|---|
Public methods
getCredentialKeyCertificateChain
public abstract Collection<X509Certificate> getCredentialKeyCertificateChain (byte[] challenge)
Generates and returns an X.509 certificate chain for the CredentialKey which identifies this credential to the issuing authority. The certificate contains an Android Keystore attestation extension which describes the key and the security hardware in which it lives.
The issuer MUST carefully examine this certificate chain including (but not limited to) checking that the root certificate is well-known, whether the tag Tag::IDENTITY_CREDENTIAL_KEY is present, the passed in challenge is present, the tag Tag::ATTESTATION_APPLICATION_ID is set to the expected Android application, the device has verified boot enabled, each certificate in the chain is signed by its successor, none of the certificates have been revoked, and so on.
If WritableIdentityCredential
is not hardware-backed the credential is
implemented using Android Keystore and the attestation extension will
not contain the tag Tag::IDENTITY_CREDENTIAL_KEY. Otherwise if this tag is present
it signals that WritableIdentityCredential
is hardware-backed and CredentialKey
and corresponding authentication keys can only sign/MAC very specific
messages. This is in contrast to Android Keystore key which can be used to
sign/MAC anything.
It is not strictly necessary to use this method to provision a credential if the issuing
authority doesn't care about the nature of the security hardware. If called, however, this
method must be called before personalize(PersonalizationData)
.
Parameters | |
---|---|
challenge |
byte : is a non-empty byte array whose contents should be unique, fresh and
provided by the issuing authority. The value provided is embedded in the
attestation extension and enables the issuing authority to verify that the
attestation certificate is fresh. |
Returns | |
---|---|
Collection<X509Certificate> |
the X.509 certificate for this credential's CredentialKey. |
personalize
public abstract byte[] personalize (PersonalizationData personalizationData)
Stores all of the data in the credential, with the specified access control profiles.
This method returns a COSE_Sign1 data structure signed by the CredentialKey with payload
set to ProofOfProvisioning
as defined below.
ProofOfProvisioning = [ "ProofOfProvisioning", ; tstr tstr, ; DocType [ * AccessControlProfile ], ProvisionedData, bool ; true if this is a test credential, should ; always be false. ] AccessControlProfile = { "id": uint, ? "readerCertificate" : bstr, ? ( "userAuthenticationRequired" : bool, "timeoutMillis" : uint, ) } ProvisionedData = { * Namespace => [ + Entry ] }, Namespace = tstr Entry = { "name" : tstr, "value" : any, "accessControlProfiles" : [ * uint ], }
This data structure provides a guarantee to the issuer about the data which may be
returned in the CBOR returned by
ResultData.getAuthenticatedData()
during a credential
presentation.
Parameters | |
---|---|
personalizationData |
PersonalizationData : The data to provision, including access control profiles
and data elements and their values, grouped into namespaces. |
Returns | |
---|---|
byte[] |
A COSE_Sign1 data structure, see above. |