Yubico / yubikit-android

Yubico Mobile Android SDK - YubiKit
Apache License 2.0
115 stars 42 forks source link

Import private key to Android key store #151

Closed slowcar closed 3 months ago

slowcar commented 3 months ago

We are using the Android key store to manage public and private keys in our application, see https://developer.android.com/privacy-and-security/keystore

When trying to import the private key stored on the Yubikey i get an error: java.security.KeyStoreException: Unsupported private key export format: null. Only private keys which export their key material in PKCS#8 format are supported

KeyStore androidKeyStore = KeyStore.getInstance("AndroidKeyStore");
androidKeyStore .load(null);
KeyStore yubiKeyStore = KeyStore.getInstance("YKPiv", pivProvider);
PrivateKey privateKey = (PrivateKey) yubiKeyStore .getKey(Slot.SIGNATURE.getStringAlias(), pin);
Certificate[] chain = keyStore.getCertificateChain(Slot.SIGNATURE.getStringAlias());
androidKeyStore.setKeyEntry(alias, privateKey, null, chain); 

The private key used can be imported into the Android key store from a file. Any idea how i can make the key retrieved from the Yubikey compatible?

AdamVe commented 3 months ago

It is not possible to retrieve a private key from a YubiKey PIV slot.

The only supported private key operations are: generate and import.