Skip to content

Make strongBoxUseTimeProbe a constructor val for consistency #512

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kwsantiago merged 2 commits into from
Aug 23, 2026
Merged

Make strongBoxUseTimeProbe a constructor val for consistency #512

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bc05b8a
Make strongBoxUseTimeProbe a constructor val for consistency
wksantiago Aug 22, 2026
6832262
Note that the probe fallback belongs at every use site
wksantiago Aug 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions app/src/main/kotlin/io/privkey/keep/storage/AndroidKeystoreStorage.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,15 @@ import javax.crypto.spec.SecretKeySpec
class AndroidKeystoreStorage(
private val context: Context,
private val requireUserAuth: Boolean = true,
strongBoxUseTimeProbe: (() -> Boolean)? = null,
// Test seam: the StrongBox use-time probe for auth-gated keys. Injected via the
// constructor so an instrumented test can force it to fail and assert the
// downgrade-to-TEE path, which cannot otherwise be provoked on hardware whose
// StrongBox works. Immutable after construction so no app-module code can switch
// the downgrade off at runtime. Null selects the production probe
// (canEncryptWithStrongBoxProbe); a member-function default can't be expressed
// inline because it captures an as-yet-uninitialized instance.
@get:VisibleForTesting
internal val strongBoxUseTimeProbe: (() -> Boolean)? = null,
// Test seam: the Keystore alias backing the legacy single-share AES key.
// Production always uses KEYSTORE_ALIAS ("keep_frost_share"); an instrumented
// test overrides it so its no-auth storage never contends with the app's
Expand Down Expand Up @@ -113,15 +121,6 @@ class AndroidKeystoreStorage(
load(null)
}

// Test seam: the StrongBox use-time probe for auth-gated keys. Injected via the
// constructor so an instrumented test can force it to fail and assert the
// downgrade-to-TEE path, which cannot otherwise be provoked on hardware whose
// StrongBox works. Immutable after construction so no app-module code can switch
// the downgrade off at runtime.
@VisibleForTesting
internal val strongBoxUseTimeProbe: () -> Boolean =
strongBoxUseTimeProbe ?: { canEncryptWithStrongBoxProbe() }

private fun createEncryptedPrefs(name: String): SharedPreferences =
KeystoreEncryptedPrefs.create(context, name)

Expand Down Expand Up @@ -560,7 +559,10 @@ class AndroidKeystoreStorage(
val strongBoxOk = try {
keyGenerator.init(buildSpec(useStrongBox = true))
keyGenerator.generateKey()
if (requireUserAuth) strongBoxUseTimeProbe() else canEncryptWithKey(alias)
// The elvis fallback to the production probe belongs at every use of
// strongBoxUseTimeProbe: it is nullable, so a call site that omits the
// fallback would silently skip the use-time check for auth-gated keys.
if (requireUserAuth) (strongBoxUseTimeProbe ?: ::canEncryptWithStrongBoxProbe)() else canEncryptWithKey(alias)
} catch (e: Exception) {
if (e !is ProviderException && e !is InvalidAlgorithmParameterException) throw e
if (BuildConfig.DEBUG) Log.w(TAG, "StrongBox key generation failed, falling back to TEE", e)
Expand Down