oid4vcwallet/dev.idfoundry.oid4vcwallet/AndroidKeystoreKeyStore/Options

Options

data class Options(val strongBox: AndroidKeystoreKeyStore.StrongBox = StrongBox.PREFERRED, val holderUserAuthentication: Boolean = true, val aliasPrefix: String = "org.idfoundry.oid4vcgo.key.", val holderKeyAgreement: Boolean = false)(source)

How an AndroidKeystoreKeyStore makes keys: by default in StrongBox where the device has it, holder keys asking for the holder each time.

Constructors

Options

constructor(strongBox: AndroidKeystoreKeyStore.StrongBox = StrongBox.PREFERRED, holderUserAuthentication: Boolean = true, aliasPrefix: String = "org.idfoundry.oid4vcgo.key.", holderKeyAgreement: Boolean = false)

Properties

aliasPrefix

val aliasPrefix: String

Prefixes every key's alias. Keys under another prefix are never touched, by a sweep or anything else. It must be non-empty, and must not cover FileCredentialStore's default key alias, which a sweep would then delete.

holderKeyAgreement

val holderKeyAgreement: Boolean

Make holder keys able to agree keys too (PURPOSE_AGREE_KEY), for deviceMac in person (WalletConfiguration.ProximityDeviceAuth.MAC_PREFERRED). It needs API 31; below it, or where the hardware refuses a key for both, holder keys sign only, and the wallet signs. StrongBox comes first: a holder key StrongBox can't make for both is made there to sign, never moved to the TEE to agree keys. A holder key that also requires the holder (holderUserAuthentication) signs too: the holder is authenticated for a signature, not an agreement.

holderUserAuthentication

val holderUserAuthentication: Boolean

Require the holder's biometrics or screen lock for each signature by a holder key — that is, to present a credential. It needs a secure lock screen; without one, creating a holder key fails. It needs API 30: below it the key store refuses it at construction; set it false there, and authenticate the holder in the app before presenting.

strongBox

val strongBox: AndroidKeystoreKeyStore.StrongBox

Where keys are made.