Migrate PrivateKey from KeyStore, use in OpenSSL with JNI

Question

I have an Android app using WebRTC. Everything works perfectly. But now the main problem is with encryption.

To create call and transfer data, WebRTC creates and uses one KeyPair for each call. But I want to use custom KayPair from AndroidKeyStore . For this problem, I need to send my own KeyPair to a shared OpenSSL object to work.

The fix will be in the NATIVE OpenSSL code, where WebRTC gets the OpenSSL context for the encryption data using this function ( opensslidnetity.cc ):

 bool OpenSSLIdentity::ConfigureIdentity { ... } 

How to transfer PK from AndroidKeyStore to native WebRTC code? Otherwise, how does PK setup work for WebRTC encryption?

---

AndroidKeyStore

In Java, I can open a KeyStore ( AndroidKeyStore ) and get a public key - which is ready for transfer (has key bytes with a method - getEncoded() ). Also I can get the secret key for encryption data, but I can not send this key in bytes, because getEncoded() returns null. In this case, I thought I could get PublicKey abd PrivateKey and store them in an array of bytes. And after that, call prepared methods in your own code.

---

UPDATE . There is something similar in google.source.chromium. Where they get the key from the Android KeyStore and create the OpenSSL context in their own code. The native class for receiving and using AndroidKeyStore for TLS is Link 1 and Link 2 .

Answer 1

Android Keystore does not disclose key material for private or private keys on design (see https://developer.android.com/training/articles/keystore.html ). The following options are possible:

• Introduce Android Keystore PrivateKey + signature or cipher as OpenSSL EVP_PKEY.

• Do not use Android Keystore. Perhaps you don’t need the additional protections that they offer compared to storing private keys inside your process?