Re: Re: Keys lost from BKS file without deleteKey command

Hi David,

Thanks a lot! I was already planning to have unique serial number. I will
also provide unique subject/issuer.

Thanks,
Arun


On Fri, 8 Jun 2018 at 02:42, David Hook <dgh-rTAZ0PM/[email protected]> wrote:

>
> It's a bit hard to provide any pointers as it doesn't sound like a BC
> issue... you even say you're not bundling it. The only thing I could
> suggest is that if the serial numbers are the same, and the subject/issuer
> are the same, it's pretty likely something would get confused, even if the
> public keys are different.
>
> Regards,
>
> David
>
> On 07/06/18 23:57, Arun Prasad wrote:
>
> Hi,
>
> Could anyone give any pointers please? I also posted the same question on
> stackoverflow:
>
> https://stackoverflow.com/questions/50735558/keys-lost-from-bks-file-without-deletekey-command
>
> Thanks,
> Arun
>
> On 6 June 2018 at 19:44, Arun Prasad <[email protected]> wrote:
>
>> Hi,
>>
>> Additional info:
>> I just found that the certificate associated with public key for every
>> key pair is valid only for 1 year. I thought the key pairs for which
>> certificate is expired may be deleted when a new key pair is being set in
>> the keystore. But, when I executed the test case by changing the validity
>> as 30 days, and changing the device time ahead by more than 30 days, the
>> issue could not be reproduced.
>>
>> One more thing which I am not sure if it is relevant for this issue is:
>> Currently the serial number for the all the certificates being generated
>> is BigInteger.ONE:
>> X509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(
>>                 subject, BigInteger.ONE, notBefore, notAfter, subject,
>>                 keyPair.getPublic());
>> I think this is wrong, but, I am not sure if this may lead to the issue
>> which I have.
>>
>> Also, bouncy castle is not bundled in my app. So, whatever is the default
>> security provider in the device will be picked up. I overlooked this aspect
>> and sent the mail to this mailing list. But, any help in this issue will be
>> really really helpful.
>>
>>
>> Thanks,
>> Arun
>>
>>
>> On 6 June 2018 at 16:24, Arun Prasad <[email protected]> wrote:
>>
>>> Hi,
>>>
>>> I use a keystore (BKS format) in my android app to store public private
>>> keypairs. The app was used over a long time and had 10+ public private key
>>> pairs. All of a sudden, one of the app's major functionality stopped
>>> working. Root cause was found out to be the following:
>>>
>>> Only one public private keypair is remaining in the BKS file. All other
>>> keypairs are lost. I verified in the code that
>>> KeyStore.deleteEntry(alias) is not called anywhere in the app. The only
>>> place where I could find if something would have gone wrong is  following:
>>>
>>> We create a keypair and set it using:
>>> KeyStore.setKeyEntry(keyId, keyPair.getPrivate(), getKeyStorePassword(),
>>> certChain);
>>>
>>> The javadoc of above method states the following:
>>> If the given alias already exists, the keystore information associated
>>> with it is overridden by the given key (and possibly certificate chain).
>>>
>>> Normally, a string obtained from server which is a UUID is used as alias
>>> to set a new KeyPair in KeyStore. So, the possibility of new alias being
>>> same as one which is already present in keystore is very unlikely. Even if
>>> that's the case, it would have just overridden one key pair. But, in this
>>> case, around 10+ key pairs are lost.
>>>
>>> Does anyone know of any known issues which result in this kind of
>>> key-pair loss?
>>>
>>> Thanks,
>>> Arun
>>>
>>>
>>
>
>