android - 使用 Android 密钥库时出现 KeyNotYetValidException

Question

目前我在我的应用程序中使用 Android Keystore 来混淆共享首选项，以便存储来自用户的个人数据。

目前发生的情况是，当尝试将 Keystore 与特定设备（Oneplus 3T，运行 Android 7.1.1）一起使用时，Cipher 使用生成的 Key 崩溃，并出现错误KeyNotYetValidException。在其他设备中它不会崩溃。

我尝试将密钥有效期设置为过去一年，但遇到了同样的问题。

这是密钥创建代码：

val start = GregorianCalendar()
start.add(Calendar.YEAR, -1)

val end = GregorianCalendar()
end.add(Calendar.YEAR, 25)

lateinit var spec: AlgorithmParameterSpec

spec = KeyGenParameterSpec.Builder(ALIAS, KeyProperties.PURPOSE_ENCRYPT.or(KeyProperties.PURPOSE_DECRYPT))
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1)
                .setUserAuthenticationRequired(false)
                .setCertificateSubject(X500Principal("CN=$ALIAS"))
                .setCertificateSerialNumber(BigInteger.valueOf(1337))
                .setKeyValidityStart(start.time)
                .setKeyValidityEnd(end.time)
                .build()

这是我得到的堆栈跟踪：

Caused by: android.security.keystore.KeyNotYetValidException: Key not yet valid
at android.security.KeyStore.getInvalidKeyException(KeyStore.java:684)
at android.security.KeyStore.getInvalidKeyException(KeyStore.java:748)
at android.security.keystore.KeyStoreCryptoOperationUtils.getInvalidKeyExceptionForInit(KeyStoreCryptoOperationUtils.java:54)
at android.security.keystore.KeyStoreCryptoOperationUtils.getExceptionForCipherInit(KeyStoreCryptoOperationUtils.java:89)
at android.security.keystore.AndroidKeyStoreCipherSpiBase.ensureKeystoreOperationInitialized(AndroidKeyStoreCipherSpiBase.java:265)
at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineInit(AndroidKeyStoreCipherSpiBase.java:109)
at javax.crypto.Cipher.tryTransformWithProvider(Cipher.java:2977)
at javax.crypto.Cipher.tryCombinations(Cipher.java:2884)
at javax.crypto.Cipher$SpiAndProviderUpdater.updateAndGetSpiAndProvider(Cipher.java:2789)
at javax.crypto.Cipher.chooseProvider(Cipher.java:956)
at javax.crypto.Cipher.init(Cipher.java:1199)
at javax.crypto.Cipher.init(Cipher.java:1143)
at com.app.myapp.SecureStorage.booo006F006F006Foooo

这里有什么推荐吗？

标签： androidkeystoreandroid-keystore