45 lines
1.7 KiB
Kotlin
45 lines
1.7 KiB
Kotlin
package com.bitcointxoko.gudariwallet.security
|
|
|
|
import android.content.Context
|
|
import timber.log.Timber
|
|
import com.bitcointxoko.gudariwallet.util.WalletConstants
|
|
import com.google.crypto.tink.StreamingAead
|
|
import com.google.crypto.tink.integration.android.AndroidKeysetManager
|
|
import com.google.crypto.tink.streamingaead.StreamingAeadConfig
|
|
import com.google.crypto.tink.KeyTemplates
|
|
|
|
/**
|
|
* Manages the Tink keyset used to encrypt the credentials DataStore file.
|
|
*
|
|
* The keyset itself is stored in SharedPreferences, encrypted under an
|
|
* Android Keystore master key — so the key material never leaves secure hardware.
|
|
*/
|
|
object CredentialsTinkManager {
|
|
private const val TAG = "CredentialsTinkManager"
|
|
|
|
|
|
init {
|
|
// Register all StreamingAead primitives once at class load time
|
|
StreamingAeadConfig.register()
|
|
Timber.d("StreamingAeadConfig registered")
|
|
}
|
|
|
|
fun getOrCreateStreamingAead(context: Context): StreamingAead {
|
|
return try {
|
|
val handle = AndroidKeysetManager.Builder()
|
|
.withSharedPref(context, WalletConstants.TINK_KEYSET_KEY, WalletConstants.TINK_KEYSET_PREF)
|
|
.withKeyTemplate(KeyTemplates.get("AES256_GCM_HKDF_4KB"))
|
|
.withMasterKeyUri(WalletConstants.TINK_MASTER_KEY_URI)
|
|
.build()
|
|
.keysetHandle
|
|
|
|
Timber.i("Keyset loaded — key count: ${handle.size()}, primary key ID: ${handle.primary.id}")
|
|
handle.getPrimitive(StreamingAead::class.java).also {
|
|
Timber.i("StreamingAead primitive acquired successfully")
|
|
}
|
|
} catch (e: Exception) {
|
|
Timber.e("Failed to initialise StreamingAead — Keystore may be unavailable")
|
|
throw e
|
|
}
|
|
}
|
|
} |