Inji 214: Setup Native module for storing keys in hardware key store android

README.md

@@ -1,5 +1,8 @@
 # react-native-secure-keystore
- A React native library helps to securelys store keys
+ A React native library helps to securely store keys in Hardware Key Store and use them to create signatures.
+
+`note: This library only supported for android.`
+
 ## Installation
 
 ```sh
@@ -8,14 +11,95 @@ npm install react-native-secure-keystore
 
 ## Usage
 
+1. for RSA based Key Pair
+
+```js
+import SecureKeyStore  from "react-native-secure-keystore";
+
+// ...
+
+if(!SecureKeyStore.deviceSupportsHardware) {
+  return
+}
+
+const alias = "1234ab";
+const data = "any data";
+
+const publicKey = await SecureKeyStore.generateKeyPair(alias);
+
+const signature = await SecureKeyStore.sign(alias, data)
+
+```
+
+
+2. for symmetric key
+
 ```js
-import { multiply } from "react-native-secure-keystore";
+import SecureKeyStore  from "react-native-secure-keystore";
 
 // ...
 
-const result = await multiply(3, 7);
+if(!SecureKeyStore.deviceSupportsHardware) {
+  return
+}
+
+const alias = "1234ab";
+const data = "any data";
+
+await SecureKeyStore.generateKey(alias);
+
+const encryptedData = await SecureKeyStore.encryptData(alias, data)
+const decryptedData = await SecureKeyStore.decryptData(alias, encryptedData)
+
 ```
 
+
+## API documentation
+
+### deviceSupportsHardware
+
+`deviceSupportsHardware() => boolean`
+
+Check if the device supports hardware key store
+
+
+### generateKey
+
+`generateKey(alias: string) => void`
+
+generates a symmetric key for encryption and decryption
+
+### generateKeyPair
+
+`generateKey(alias: string) => string`
+
+generates a asymmetric RSA key Pair for signing
+
+### encryptData
+
+`encryptData(alias: string, data: string) => string`
+
+Encrypts the given data using the key that is assigned to the alias. Returns back encrypted data as a string
+
+### decryptData
+
+`decryptData(alias: string, encryptionText: string) => string`
+
+Decrypts the given encryptionText using the key that is assigned to the alias. Returns back the data as a string
+
+### sign
+
+`sign(alias: string, data: string) => string`
+
+Create a signature for the given data using the key that is assigned to the alias. Returns back the signature as a string
+
+### hasAlias
+
+`hasAlias(alias: string) => boolean`
+
+Check if the given alias is present in the key store
+
+
 ## Contributing
 
 See the [contributing guide](CONTRIBUTING.md) to learn how to contribute to the repository and the development workflow.

android/build.gradle

@@ -133,7 +133,11 @@ dependencies {
     //noinspection GradleDynamicVersion
   implementation "com.facebook.react:react-native:+"
   implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
-// From node_modules
+  implementation 'com.madgag.spongycastle:core:1.56.0.0'
+  implementation 'com.madgag.spongycastle:prov:1.56.0.0'
+  implementation 'com.madgag.spongycastle:bcpkix-jdk15on:1.56.0.0'
+  implementation "androidx.biometric:biometric:1.1.0"
+  implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-android:1.3.9'
 }
 
 if (isNewArchitectureEnabled()) {

android/gradle.properties

@@ -1,5 +1,5 @@
 SecureKeystore_kotlinVersion=1.7.0
-SecureKeystore_minSdkVersion=21
+SecureKeystore_minSdkVersion=24
 SecureKeystore_targetSdkVersion=31
 SecureKeystore_compileSdkVersion=31
 SecureKeystore_ndkversion=21.4.7075529

android/src/main/AndroidManifest.xml

@@ -1,4 +1,5 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
           package="com.reactnativesecurekeystore">
 
+    <uses-permission android:name="android.permission.USE_BIOMETRIC" />
 </manifest>

android/src/main/java/com/reactnativesecurekeystore/CipherBox.kt

@@ -0,0 +1,21 @@
+package com.reactnativesecurekeystore
+
+import com.reactnativesecurekeystore.dto.EncryptedOutput
+import java.security.Key
+import java.security.PrivateKey
+import java.security.Signature
+import javax.crypto.Cipher
+import javax.crypto.SecretKey
+
+interface CipherBox {
+  fun initEncryptCipher(key: Key): Cipher
+  fun encryptData(cipher: Cipher, data: String): EncryptedOutput
+
+  fun initDecryptCipher(key: Key, encryptedOutput: EncryptedOutput): Cipher
+  fun decryptData(cipher: Cipher, encryptedOutput: EncryptedOutput): ByteArray
+
+  fun createSignature(key: PrivateKey, data: String): Signature
+  fun sign(signature: Signature): String
+
+  fun generateHmacSha(key: SecretKey, data: String): ByteArray
+}

android/src/main/java/com/reactnativesecurekeystore/CipherBoxImpl.kt

@@ -0,0 +1,84 @@
+package com.reactnativesecurekeystore
+
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import android.util.Log
+import com.reactnativesecurekeystore.dto.EncryptedOutput
+import java.security.Key
+import java.security.PrivateKey
+import java.security.Signature
+import javax.crypto.Cipher
+import javax.crypto.Mac
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+
+const val CIPHER_ALGORITHM =
+  "${KeyProperties.KEY_ALGORITHM_AES}/${KeyProperties.BLOCK_MODE_GCM}/${KeyProperties.ENCRYPTION_PADDING_NONE}"
+const val GCM_TAG_LEN = 128
+const val SIGN_ALGORITHM = "SHA256with${KeyProperties.KEY_ALGORITHM_RSA}"
+const val HMAC_ALGORITHM = "HmacSHA256"
+
+class CipherBoxImpl : CipherBox {
+
+  override fun initEncryptCipher(key: Key): Cipher {
+    val cipher = Cipher.getInstance(CIPHER_ALGORITHM)
+    cipher.init(Cipher.ENCRYPT_MODE, key)
+
+    return cipher
+  }
+
+  override fun encryptData(cipher: Cipher, data: String): EncryptedOutput {
+    Log.d("CipherBox", "iv ${cipher.iv} data: $data" )
+    val encryptedData = cipher.doFinal(data.toByteArray());
+
+    return EncryptedOutput(encryptedData, cipher.iv)
+  }
+
+  override fun initDecryptCipher(key: Key, encryptedOutput: EncryptedOutput): Cipher {
+    val cipher = Cipher.getInstance(CIPHER_ALGORITHM)
+
+    val spec = GCMParameterSpec(GCM_TAG_LEN, encryptedOutput.iv)
+    cipher.init(Cipher.DECRYPT_MODE, key, spec)
+
+    return cipher
+  }
+
+  override fun decryptData(cipher: Cipher, encryptedOutput: EncryptedOutput): ByteArray {
+    try {
+      return cipher.doFinal(encryptedOutput.encryptedData);
+    } catch (e: Exception) {
+      Log.e("Secure","Exception in Decrypti",e)
+      throw e
+    }
+  }
+
+  override fun createSignature(key: PrivateKey, data: String): Signature {
+    val bytes = data.toByteArray(charset("UTF8"))
+    val signature = Signature.getInstance(SIGN_ALGORITHM).run {
+      initSign(key)
+      update(bytes)
+      this
+    }
+
+    return signature
+  }
+
+  override fun sign(signature: Signature): String {
+    val sign = signature.sign()
+    return Base64.encodeToString(sign, Base64.DEFAULT)
+  }
+
+  override fun generateHmacSha(key: SecretKey, data: String): ByteArray {
+    val mac = Mac.getInstance(HMAC_ALGORITHM);
+
+    try {
+      mac.init(key)
+    } catch (e: Exception) {
+      Log.e("debugging", "Exception in generatehmac", e)
+      throw e
+    }
+
+    return mac.doFinal(data.toByteArray())
+  }
+}

android/src/main/java/com/reactnativesecurekeystore/DeviceCapability.kt

@@ -0,0 +1,69 @@
+package com.reactnativesecurekeystore
+
+import android.os.Build
+import android.security.keystore.KeyInfo
+import android.util.Log
+import com.reactnativesecurekeystore.biometrics.Biometrics
+import java.security.GeneralSecurityException
+import java.util.concurrent.atomic.AtomicBoolean
+import javax.crypto.SecretKey
+import javax.crypto.SecretKeyFactory
+
+
+class DeviceCapability(private val secureKeystore: SecureKeystore, private val KeyGenerator: KeyGeneratorImpl, private val biometrics: Biometrics) {
+  private val mutex = Object()
+
+  @Transient
+  var isSupportsSecureHardware: AtomicBoolean? = null
+
+  fun supportsHardwareKeyStore(): Boolean {
+    if (isSupportsSecureHardware != null) return isSupportsSecureHardware!!.get()
+
+    synchronized(mutex) {
+      /** double check if it has value in sync block */
+      if (isSupportsSecureHardware != null) return isSupportsSecureHardware!!.get()
+      // Check the key stored in secure hardware using temporary key alias, and removed after checked
+      val key = KeyGenerator.generateKey(CHECK_HARDWARE_SUPPORT_KEY_ALIAS,false, null)
+      isSupportsSecureHardware =
+        AtomicBoolean(getSecurityLevel(key) == DeviceSecurityLevel.SECURE_HARDWARE)
+      Log.i("SecureStorage", "Device Supports Hardware $isSupportsSecureHardware")
+      secureKeystore.removeKey(CHECK_HARDWARE_SUPPORT_KEY_ALIAS)
+      return isSupportsSecureHardware!!.get()
+    }
+  }
+
+  /** Get the supported level of security for provided Key instance.  */
+  @Throws(GeneralSecurityException::class)
+  fun getSecurityLevel(key: SecretKey): DeviceSecurityLevel {
+    val keyInfo: KeyInfo = getKeyInfo(key)
+
+    val insideSecureHardware: Boolean = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+      /** SecurityLevel 1 indicates SECURITY_LEVEL_TRUSTED_ENVIRONMENT
+       *  SecurityLevel 2 indicates SECURITY_LEVEL_STRONGBOX */
+      (keyInfo.securityLevel == 1) or (keyInfo.securityLevel == 2)
+    } else {
+      keyInfo.isInsideSecureHardware()
+    }
+    Log.i("keystore", "Device has secure Hardware $insideSecureHardware")
+    if (insideSecureHardware) {
+      return DeviceSecurityLevel.SECURE_HARDWARE
+    }
+    return DeviceSecurityLevel.SECURE_SOFTWARE
+  }
+
+  /** Get information about provided key.  */
+  @Throws(GeneralSecurityException::class)
+  fun getKeyInfo(key: SecretKey): KeyInfo {
+    Log.i("keystore", "KeyInfo Details$key -> ${key.algorithm}")
+    val secretKeyFactory = SecretKeyFactory.getInstance(key.algorithm, KEYSTORE_TYPE)
+    return secretKeyFactory.getKeySpec(
+      key as SecretKey?,
+      KeyInfo::class.java
+    ) as KeyInfo
+  }
+
+  /** Get information about Device biometrics enrollment.  */
+  fun hasBiometricsEnabled(): Boolean {
+    return biometrics.isBiometricEnabled()
+  }
+}

android/src/main/java/com/reactnativesecurekeystore/DeviceSecurityLevel.kt

@@ -0,0 +1,10 @@
+package com.reactnativesecurekeystore
+
+/** Minimal required level of the security implementation.  */
+enum class DeviceSecurityLevel {
+  /** Requires for the key to be stored in the Android Keystore, separate from the encrypted data.  */
+  SECURE_SOFTWARE,
+
+  /** Requires for the key to be stored on a secure hardware (Trusted Execution Environment or Secure Environment).  */
+  SECURE_HARDWARE;
+}

android/src/main/java/com/reactnativesecurekeystore/KeyGenerator.kt

@@ -0,0 +1,10 @@
+package com.reactnativesecurekeystore
+
+import java.security.KeyPair
+import javax.crypto.SecretKey
+
+interface KeyGenerator {
+  fun generateKey(alias: String, isAuthRequired: Boolean, authTimeout: Int?): SecretKey
+  fun generateHmacKey(hmacKeyAlias: String): SecretKey
+  fun generateKeyPair(alias: String, isAuthRequired: Boolean, authTimeout: Int?): KeyPair
+}