Keys lost from BKS file without deleteKey command

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

Keys lost from BKS file without deleteKey command

Arun Prasad
Hi,

I use a keystore (BKS format) in my android app to store public private keypairs. The app was used over a long time and had 10+ public private key pairs. All of a sudden, one of the app's major functionality stopped working. Root cause was found out to be the following:

Only one public private keypair is remaining in the BKS file. All other keypairs are lost. I verified in the code that 
KeyStore.deleteEntry(alias) is not called anywhere in the app. The only place where I could find if something would have gone wrong is  following:

We create a keypair and set it using: 
KeyStore.setKeyEntry(keyId, keyPair.getPrivate(), getKeyStorePassword(), certChain);

The javadoc of above method states the following:
If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Normally, a string obtained from server which is a UUID is used as alias to set a new KeyPair in KeyStore. So, the possibility of new alias being same as one which is already present in keystore is very unlikely. Even if that's the case, it would have just overridden one key pair. But, in this case, around 10+ key pairs are lost.

Does anyone know of any known issues which result in this kind of key-pair loss?

Thanks,
Arun

Reply | Threaded
Open this post in threaded view
|

Re: Keys lost from BKS file without deleteKey command

Arun Prasad
Hi,

Additional info:
I just found that the certificate associated with public key for every key pair is valid only for 1 year. I thought the key pairs for which certificate is expired may be deleted when a new key pair is being set in the keystore. But, when I executed the test case by changing the validity as 30 days, and changing the device time ahead by more than 30 days, the issue could not be reproduced. 

One more thing which I am not sure if it is relevant for this issue is: Currently the serial number for the all the certificates being generated is BigInteger.ONE:
X509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(
                subject, BigInteger.ONE, notBefore, notAfter, subject,
                keyPair.getPublic());
I think this is wrong, but, I am not sure if this may lead to the issue which I have.

Also, bouncy castle is not bundled in my app. So, whatever is the default security provider in the device will be picked up. I overlooked this aspect and sent the mail to this mailing list. But, any help in this issue will be really really helpful.


Thanks,
Arun


On 6 June 2018 at 16:24, Arun Prasad <[hidden email]> wrote:
Hi,

I use a keystore (BKS format) in my android app to store public private keypairs. The app was used over a long time and had 10+ public private key pairs. All of a sudden, one of the app's major functionality stopped working. Root cause was found out to be the following:

Only one public private keypair is remaining in the BKS file. All other keypairs are lost. I verified in the code that 
KeyStore.deleteEntry(alias) is not called anywhere in the app. The only place where I could find if something would have gone wrong is  following:

We create a keypair and set it using: 
KeyStore.setKeyEntry(keyId, keyPair.getPrivate(), getKeyStorePassword(), certChain);

The javadoc of above method states the following:
If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Normally, a string obtained from server which is a UUID is used as alias to set a new KeyPair in KeyStore. So, the possibility of new alias being same as one which is already present in keystore is very unlikely. Even if that's the case, it would have just overridden one key pair. But, in this case, around 10+ key pairs are lost.

Does anyone know of any known issues which result in this kind of key-pair loss?

Thanks,
Arun


Reply | Threaded
Open this post in threaded view
|

Re: Keys lost from BKS file without deleteKey command

Arun Prasad
Hi,

Could anyone give any pointers please? I also posted the same question on stackoverflow:
https://stackoverflow.com/questions/50735558/keys-lost-from-bks-file-without-deletekey-command

Thanks,
Arun

On 6 June 2018 at 19:44, Arun Prasad <[hidden email]> wrote:
Hi,

Additional info:
I just found that the certificate associated with public key for every key pair is valid only for 1 year. I thought the key pairs for which certificate is expired may be deleted when a new key pair is being set in the keystore. But, when I executed the test case by changing the validity as 30 days, and changing the device time ahead by more than 30 days, the issue could not be reproduced. 

One more thing which I am not sure if it is relevant for this issue is: Currently the serial number for the all the certificates being generated is BigInteger.ONE:
X509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(
                subject, BigInteger.ONE, notBefore, notAfter, subject,
                keyPair.getPublic());
I think this is wrong, but, I am not sure if this may lead to the issue which I have.

Also, bouncy castle is not bundled in my app. So, whatever is the default security provider in the device will be picked up. I overlooked this aspect and sent the mail to this mailing list. But, any help in this issue will be really really helpful.


Thanks,
Arun


On 6 June 2018 at 16:24, Arun Prasad <[hidden email]> wrote:
Hi,

I use a keystore (BKS format) in my android app to store public private keypairs. The app was used over a long time and had 10+ public private key pairs. All of a sudden, one of the app's major functionality stopped working. Root cause was found out to be the following:

Only one public private keypair is remaining in the BKS file. All other keypairs are lost. I verified in the code that 
KeyStore.deleteEntry(alias) is not called anywhere in the app. The only place where I could find if something would have gone wrong is  following:

We create a keypair and set it using: 
KeyStore.setKeyEntry(keyId, keyPair.getPrivate(), getKeyStorePassword(), certChain);

The javadoc of above method states the following:
If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Normally, a string obtained from server which is a UUID is used as alias to set a new KeyPair in KeyStore. So, the possibility of new alias being same as one which is already present in keystore is very unlikely. Even if that's the case, it would have just overridden one key pair. But, in this case, around 10+ key pairs are lost.

Does anyone know of any known issues which result in this kind of key-pair loss?

Thanks,
Arun



Reply | Threaded
Open this post in threaded view
|

Re: Keys lost from BKS file without deleteKey command

David Hook-3

It's a bit hard to provide any pointers as it doesn't sound like a BC issue... you even say you're not bundling it. The only thing I could suggest is that if the serial numbers are the same, and the subject/issuer are the same, it's pretty likely something would get confused, even if the public keys are different.

Regards,

David

On 07/06/18 23:57, Arun Prasad wrote:
Hi,

Could anyone give any pointers please? I also posted the same question on stackoverflow:
https://stackoverflow.com/questions/50735558/keys-lost-from-bks-file-without-deletekey-command

Thanks,
Arun

On 6 June 2018 at 19:44, Arun Prasad <[hidden email]> wrote:
Hi,

Additional info:
I just found that the certificate associated with public key for every key pair is valid only for 1 year. I thought the key pairs for which certificate is expired may be deleted when a new key pair is being set in the keystore. But, when I executed the test case by changing the validity as 30 days, and changing the device time ahead by more than 30 days, the issue could not be reproduced. 

One more thing which I am not sure if it is relevant for this issue is: Currently the serial number for the all the certificates being generated is BigInteger.ONE:
X509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(
                subject, BigInteger.ONE, notBefore, notAfter, subject,
                keyPair.getPublic());
I think this is wrong, but, I am not sure if this may lead to the issue which I have.

Also, bouncy castle is not bundled in my app. So, whatever is the default security provider in the device will be picked up. I overlooked this aspect and sent the mail to this mailing list. But, any help in this issue will be really really helpful.


Thanks,
Arun


On 6 June 2018 at 16:24, Arun Prasad <[hidden email]> wrote:
Hi,

I use a keystore (BKS format) in my android app to store public private keypairs. The app was used over a long time and had 10+ public private key pairs. All of a sudden, one of the app's major functionality stopped working. Root cause was found out to be the following:

Only one public private keypair is remaining in the BKS file. All other keypairs are lost. I verified in the code that 
KeyStore.deleteEntry(alias) is not called anywhere in the app. The only place where I could find if something would have gone wrong is  following:

We create a keypair and set it using: 
KeyStore.setKeyEntry(keyId, keyPair.getPrivate(), getKeyStorePassword(), certChain);

The javadoc of above method states the following:
If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Normally, a string obtained from server which is a UUID is used as alias to set a new KeyPair in KeyStore. So, the possibility of new alias being same as one which is already present in keystore is very unlikely. Even if that's the case, it would have just overridden one key pair. But, in this case, around 10+ key pairs are lost.

Does anyone know of any known issues which result in this kind of key-pair loss?

Thanks,
Arun




Reply | Threaded
Open this post in threaded view
|

Re: Keys lost from BKS file without deleteKey command

Arun Prasad
Hi David,

Thanks a lot! I was already planning to have unique serial number. I will also provide unique subject/issuer. 

Thanks,
Arun


On Fri, 8 Jun 2018 at 02:42, David Hook <[hidden email]> wrote:

It's a bit hard to provide any pointers as it doesn't sound like a BC issue... you even say you're not bundling it. The only thing I could suggest is that if the serial numbers are the same, and the subject/issuer are the same, it's pretty likely something would get confused, even if the public keys are different.

Regards,

David

On 07/06/18 23:57, Arun Prasad wrote:
Hi,

Could anyone give any pointers please? I also posted the same question on stackoverflow:
https://stackoverflow.com/questions/50735558/keys-lost-from-bks-file-without-deletekey-command

Thanks,
Arun

On 6 June 2018 at 19:44, Arun Prasad <[hidden email]> wrote:
Hi,

Additional info:
I just found that the certificate associated with public key for every key pair is valid only for 1 year. I thought the key pairs for which certificate is expired may be deleted when a new key pair is being set in the keystore. But, when I executed the test case by changing the validity as 30 days, and changing the device time ahead by more than 30 days, the issue could not be reproduced. 

One more thing which I am not sure if it is relevant for this issue is: Currently the serial number for the all the certificates being generated is BigInteger.ONE:
X509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(
                subject, BigInteger.ONE, notBefore, notAfter, subject,
                keyPair.getPublic());
I think this is wrong, but, I am not sure if this may lead to the issue which I have.

Also, bouncy castle is not bundled in my app. So, whatever is the default security provider in the device will be picked up. I overlooked this aspect and sent the mail to this mailing list. But, any help in this issue will be really really helpful.


Thanks,
Arun


On 6 June 2018 at 16:24, Arun Prasad <[hidden email]> wrote:
Hi,

I use a keystore (BKS format) in my android app to store public private keypairs. The app was used over a long time and had 10+ public private key pairs. All of a sudden, one of the app's major functionality stopped working. Root cause was found out to be the following:

Only one public private keypair is remaining in the BKS file. All other keypairs are lost. I verified in the code that 
KeyStore.deleteEntry(alias) is not called anywhere in the app. The only place where I could find if something would have gone wrong is  following:

We create a keypair and set it using: 
KeyStore.setKeyEntry(keyId, keyPair.getPrivate(), getKeyStorePassword(), certChain);

The javadoc of above method states the following:
If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Normally, a string obtained from server which is a UUID is used as alias to set a new KeyPair in KeyStore. So, the possibility of new alias being same as one which is already present in keystore is very unlikely. Even if that's the case, it would have just overridden one key pair. But, in this case, around 10+ key pairs are lost.

Does anyone know of any known issues which result in this kind of key-pair loss?

Thanks,
Arun