Re: Keys lost from BKS file without deleteKey command

Hi,

Could anyone give any pointers please? I also posted the same question on
stackoverflow:
https://stackoverflow.com/questions/50735558/keys-lost-from-bks-file-without-deletekey-command

Thanks,
Arun

On 6 June 2018 at 19:44, Arun Prasad <[email protected]> wrote:

> Hi,
>
> Additional info:
> I just found that the certificate associated with public key for every key
> pair is valid only for 1 year. I thought the key pairs for which
> certificate is expired may be deleted when a new key pair is being set in
> the keystore. But, when I executed the test case by changing the validity
> as 30 days, and changing the device time ahead by more than 30 days, the
> issue could not be reproduced.
>
> One more thing which I am not sure if it is relevant for this issue is:
> Currently the serial number for the all the certificates being generated
> is BigInteger.ONE:
> X509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(
>                 subject, BigInteger.ONE, notBefore, notAfter, subject,
>                 keyPair.getPublic());
> I think this is wrong, but, I am not sure if this may lead to the issue
> which I have.
>
> Also, bouncy castle is not bundled in my app. So, whatever is the default
> security provider in the device will be picked up. I overlooked this aspect
> and sent the mail to this mailing list. But, any help in this issue will be
> really really helpful.
>
>
> Thanks,
> Arun
>
>
> On 6 June 2018 at 16:24, Arun Prasad <[email protected]> wrote:
>
>> Hi,
>>
>> I use a keystore (BKS format) in my android app to store public private
>> keypairs. The app was used over a long time and had 10+ public private key
>> pairs. All of a sudden, one of the app's major functionality stopped
>> working. Root cause was found out to be the following:
>>
>> Only one public private keypair is remaining in the BKS file. All other
>> keypairs are lost. I verified in the code that
>> KeyStore.deleteEntry(alias) is not called anywhere in the app. The only
>> place where I could find if something would have gone wrong is  following:
>>
>> We create a keypair and set it using:
>> KeyStore.setKeyEntry(keyId, keyPair.getPrivate(), getKeyStorePassword(),
>> certChain);
>>
>> The javadoc of above method states the following:
>> If the given alias already exists, the keystore information associated
>> with it is overridden by the given key (and possibly certificate chain).
>>
>> Normally, a string obtained from server which is a UUID is used as alias
>> to set a new KeyPair in KeyStore. So, the possibility of new alias being
>> same as one which is already present in keystore is very unlikely. Even if
>> that's the case, it would have just overridden one key pair. But, in this
>> case, around 10+ key pairs are lost.
>>
>> Does anyone know of any known issues which result in this kind of
>> key-pair loss?
>>
>> Thanks,
>> Arun
>>
>>
>