Stay organized with collections
Save and categorize content based on your preferences.
WrappedKeyEntry
open class WrappedKeyEntry : KeyStore.Entry
An Entry that holds a wrapped key. Wrapped keys contain encrypted key data and description information that can be used to securely import key material into a hardware-backed Keystore.
The wrapped key is in DER-encoded ASN.1 format, specified by the following schema:
KeyDescription ::= SEQUENCE(
keyFormat INTEGER, # Values from KeyFormat enum.
keyParams AuthorizationList,
)
SecureKeyWrapper ::= SEQUENCE(
version INTEGER, # Contains value 0
encryptedTransportKey OCTET_STRING,
initializationVector OCTET_STRING,
keyDescription KeyDescription,
encryptedKey OCTET_STRING,
tag OCTET_STRING
)
- keyFormat is an integer from the KeyFormat enum, defining the format of the plaintext key material.
- keyParams is the characteristics of the key to be imported (as with generateKey or importKey). If the secure import is successful, these characteristics must be associated with the key exactly as if the key material had been insecurely imported with importKey. See Key Attestation for the AuthorizationList format.
- encryptedTransportKey is a 256-bit AES key, XORed with a masking key and then encrypted in RSA-OAEP mode (SHA-256 digest, SHA-1 MGF1 digest) with the wrapping key specified by wrappingKeyBlob.
- keyDescription is a KeyDescription, above.
- encryptedKey is the key material of the key to be imported, in format keyFormat, and encrypted with encryptedEphemeralKey in AES-GCM mode, with the DER-encoded representation of keyDescription provided as additional authenticated data.
- tag is the tag produced by the AES-GCM encryption of encryptedKey.
Imported wrapped keys will have KeymasterDefs.KM_ORIGIN_SECURELY_IMPORTED
Summary
| Public constructors |
|
Constructs a WrappedKeyEntry with a binary wrapped key.
|
Public constructors
WrappedKeyEntry
WrappedKeyEntry(
wrappedKeyBytes: ByteArray!,
wrappingKeyAlias: String!,
transformation: String!,
algorithmParameterSpec: AlgorithmParameterSpec!)
Constructs a WrappedKeyEntry with a binary wrapped key.
| Parameters |
wrappedKeyBytes |
ByteArray!: ASN.1 DER encoded wrapped key |
wrappingKeyAlias |
String!: identifies the private key that can unwrap the wrapped key |
transformation |
String!: used to unwrap the key. ex: "RSA/ECB/OAEPPadding" |
algorithmParameterSpec |
AlgorithmParameterSpec!: spec for the private key used to unwrap the wrapped key |
Public methods
open fun getTransformation(): String!
getWrappedKeyBytes
open fun getWrappedKeyBytes(): ByteArray!
getWrappingKeyAlias
open fun getWrappingKeyAlias(): String!
Content and code samples on this page are subject to the licenses described in the Content License. Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.
Last updated 2025-02-10 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-02-10 UTC."],[],[],null,["# WrappedKeyEntry\n\nAdded in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element.html#ApiLevels)\n\nWrappedKeyEntry\n===============\n\n*** ** * ** ***\n\nKotlin \\|[Java](/reference/android/security/keystore/WrappedKeyEntry \"View this page in Java\") \n\n```\nopen class WrappedKeyEntry : KeyStore.Entry\n```\n\n|---|------------------------------------------------|\n| [kotlin.Any](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-any/index.html) ||\n| ↳ | [android.security.keystore.WrappedKeyEntry](#) |\n\nAn [Entry](../../../java/security/KeyStore.Entry.html#) that holds a wrapped key. Wrapped keys contain encrypted key data and description information that can be used to securely import key material into a hardware-backed Keystore.\n\nThe wrapped key is in DER-encoded ASN.1 format, specified by the following schema: \n\n```kotlin\nKeyDescription ::= SEQUENCE(\n keyFormat INTEGER, # Values from KeyFormat enum.\n keyParams AuthorizationList,\n )\n \n SecureKeyWrapper ::= SEQUENCE(\n version INTEGER, # Contains value 0\n encryptedTransportKey OCTET_STRING,\n initializationVector OCTET_STRING,\n keyDescription KeyDescription,\n encryptedKey OCTET_STRING,\n tag OCTET_STRING\n )\n \n```\n\n- keyFormat is an integer from the KeyFormat enum, defining the format of the plaintext key material.\n- keyParams is the characteristics of the key to be imported (as with generateKey or importKey). If the secure import is successful, these characteristics must be associated with the key exactly as if the key material had been insecurely imported with importKey. See [Key Attestation](https://developer.android.com/training/articles/security-key-attestation.html#certificate_schema) for the AuthorizationList format.\n- encryptedTransportKey is a 256-bit AES key, XORed with a masking key and then encrypted in RSA-OAEP mode (SHA-256 digest, SHA-1 MGF1 digest) with the wrapping key specified by wrappingKeyBlob.\n- keyDescription is a KeyDescription, above.\n- encryptedKey is the key material of the key to be imported, in format keyFormat, and encrypted with encryptedEphemeralKey in AES-GCM mode, with the DER-encoded representation of keyDescription provided as additional authenticated data.\n- tag is the tag produced by the AES-GCM encryption of encryptedKey.\n\nImported wrapped keys will have KeymasterDefs.KM_ORIGIN_SECURELY_IMPORTED\n\nSummary\n-------\n\n| Public constructors ||\n|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---|\n| [WrappedKeyEntry](#WrappedKeyEntry(kotlin.ByteArray,%20kotlin.String,%20kotlin.String,%20java.security.spec.AlgorithmParameterSpec))`(`wrappedKeyBytes:` `[ByteArray](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-byte-array/index.html)!`, `wrappingKeyAlias:` `[String](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-string/index.html)!`, `transformation:` `[String](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-string/index.html)!`, `algorithmParameterSpec:` `[AlgorithmParameterSpec](../../../java/security/spec/AlgorithmParameterSpec.html#)!`)` Constructs a [WrappedKeyEntry](#) with a binary wrapped key. |\n\n| Public methods ||\n|-----------------------------------------------------------------------------------------------|----------------------------------------------------------------------|\n| open [AlgorithmParameterSpec](../../../java/security/spec/AlgorithmParameterSpec.html#)! | [getAlgorithmParameterSpec](#getAlgorithmParameterSpec())`()` \u003cbr /\u003e |\n| open [String](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-string/index.html)! | [getTransformation](#getTransformation())`()` \u003cbr /\u003e |\n| open [ByteArray](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-byte-array/index.html)! | [getWrappedKeyBytes](#getWrappedKeyBytes())`()` \u003cbr /\u003e |\n| open [String](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-string/index.html)! | [getWrappingKeyAlias](#getWrappingKeyAlias())`()` \u003cbr /\u003e |\n\n| Inherited functions ||\n|---|---|\n| From class [Entry](../../../java/security/KeyStore.Entry.html#) |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------| | [MutableSet](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin.collections/-mutable-set/index.html)\u003c[KeyStore.Entry.Attribute](../../../java/security/KeyStore.Entry.Attribute.html#)!\u003e! | [getAttributes](../../../java/security/KeyStore.Entry.html#getAttributes())`()` Retrieves the attributes associated with an entry. \u003cbr /\u003e | ||\n\nPublic constructors\n-------------------\n\n### WrappedKeyEntry\n\nAdded in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element.html#ApiLevels) \n\n```\nWrappedKeyEntry(\n wrappedKeyBytes: ByteArray!, \n wrappingKeyAlias: String!, \n transformation: String!, \n algorithmParameterSpec: AlgorithmParameterSpec!)\n```\n\nConstructs a [WrappedKeyEntry](#) with a binary wrapped key.\n\n| Parameters ||\n|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|\n| `wrappedKeyBytes` | [ByteArray](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-byte-array/index.html)!: ASN.1 DER encoded wrapped key |\n| `wrappingKeyAlias` | [String](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-string/index.html)!: identifies the private key that can unwrap the wrapped key |\n| `transformation` | [String](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-string/index.html)!: used to unwrap the key. ex: \"RSA/ECB/OAEPPadding\" |\n| `algorithmParameterSpec` | [AlgorithmParameterSpec](../../../java/security/spec/AlgorithmParameterSpec.html#)!: spec for the private key used to unwrap the wrapped key |\n\nPublic methods\n--------------\n\n### getAlgorithmParameterSpec\n\nAdded in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element.html#ApiLevels) \n\n```\nopen fun getAlgorithmParameterSpec(): AlgorithmParameterSpec!\n``` \n\n### getTransformation\n\nAdded in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element.html#ApiLevels) \n\n```\nopen fun getTransformation(): String!\n``` \n\n### getWrappedKeyBytes\n\nAdded in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element.html#ApiLevels) \n\n```\nopen fun getWrappedKeyBytes(): ByteArray!\n``` \n\n### getWrappingKeyAlias\n\nAdded in [API level 28](https://developer.android.com/guide/topics/manifest/uses-sdk-element.html#ApiLevels) \n\n```\nopen fun getWrappingKeyAlias(): String!\n```"]]
