1page.title=Android Keystore System 2@jd:body 3 4<div id="qv-wrapper"> 5 <div id="qv"> 6 <h2>In this document</h2> 7 <ol> 8 <li><a href="#SecurityFeatures">Security Features</a></li> 9 <li><a href="#WhichShouldIUse">Choosing Between a Keychain or the Android Keystore Provider</a></li> 10 <li><a href="#UsingAndroidKeyStore">Using Android Keystore Provider</a> 11 <ol> 12 <li><a href="#GeneratingANewPrivateKey">Generating a New Private Key</a></li> 13 <li><a href="#WorkingWithKeyStoreEntries">Working with Keystore Entries</a></li> 14 <li><a href="#ListingEntries">Listing Entries</a></li> 15 <li><a href="#SigningAndVerifyingData">Signing and Verifying Data</a></li> 16 </ol> 17 </li> 18 <li><a href="#SupportedAlgorithms">Supported Algorithms</a></li> 19 </ol> 20 21 <h2>Blog articles</h2> 22 <ol> 23 <li><a 24 href="http://android-developers.blogspot.com/2012/03/unifying-key-store-access-in-ics.html"> 25 <h4>Unifying Key Store Access in ICS</h4> 26 </a></li> 27 </ol> 28 </div> 29</div> 30 31<style type="text/css"> 32 tr.deprecated { 33 background-color: #ccc; 34 color: #999; 35 font-style: italic; 36 } 37</style> 38 39<p>The Android Keystore system lets you store cryptographic keys in a container 40 to make it more difficult to extract from the device. Once keys are in the 41 keystore, they can be used for cryptographic operations with the key material 42 remaining non-exportable. Moreover, it offers facilities to restrict when and 43 how keys can be used, such as requiring user authentication for key use or 44 restricting keys to be used only in certain cryptographic modes. See 45 <a href="#SecurityFeatures">Security Features</a> section for more information.</p> 46 47<p>The Keystore system is used by the {@link 48 android.security.KeyChain} API as well as the Android 49 Keystore provider feature that was introduced in Android 4.3 50 (API level 18). This document goes over when and how to use the 51 Android Keystore provider.</p> 52 53 54<h2 id="SecurityFeatures">Security Features</h2> 55 56Android Keystore system protects key material from unauthorized use. Firstly, Android Keystore 57mitigates unauthorized use of key material outside of the Android device by preventing extraction of 58the key material from application processes and from the Android device as a whole. Secondly, 59Android KeyStore mitigates unauthorized use of key material on the Android device by making apps 60specify authorized uses of their keys and then enforcing these restrictions outside of the apps' 61processes. 62 63<h3 id="ExtractionPrevention">Extraction Prevention</h3> 64 65Key material of Android Keystore keys is protected from extraction using two security measures: 66<ul> 67<li>Key material never enters the application process. When an application performs cryptographic 68 operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to 69 be signed or verified are fed to a system process which carries out the cryptographic operations. 70 If the app's process is compromised, the attacker may be able to use the app's keys but will not 71 be able to extract their key material (for example, to be used outside of the Android device). 72 </li> 73<li>Key material may be bound to the secure hardware (e.g., Trusted Execution Environment (TEE), 74 Secure Element (SE)) of the Android device. When this feature is enabled for a key, its key 75 material is never exposed outside of secure hardware. If the Android OS is compromised or an 76 attacker can read the device's internal storage, the attacker may be able to use any app's Android 77 Keystore keys on the Android device, but not extract them from the device. This feature is enabled 78 only if the device's secure hardware supports the particular combination of key algorithm, block 79 modes, padding schemes, and digests with which the key is authorized to be used. To check whether 80 the feature is enabled for a key, obtain a {@link android.security.keystore.KeyInfo} for the key 81 and inspect the return value of 82 {@link android.security.keystore.KeyInfo#isInsideSecureHardware() KeyInfo.isInsideSecurityHardware()}. 83 </li> 84</ul> 85 86<h3 id="KeyUseAuthorizations">Key Use Authorizations</h3> 87 88To mitigate unauthorized use of keys on the Android device, Android Keystore lets apps specify 89authorized uses of their keys when generating or importing the keys. Once a key is generated or 90imported, its authorizations can not be changed. Authorizations are then enforced by the Android 91Keystore whenever the key is used. This is an advanced security feature which is generally useful 92only if your requirements are that a compromise of your application process after key 93generation/import (but not before or during) cannot lead to unauthorized uses of the key. 94 95<p>Supported key use authorizations fall into the following categories: 96<ul> 97<li><em>cryptography</em>: authorized key algorithm, operations or purposes (encrypt, decrypt, sign, 98 verify), padding schemes, block modes, digests with which the key can be used;</li> 99<li><em>temporal validity interval</em>: interval of time during which the key is authorized for 100 use;</li> 101<li><em>user authentication</em>: the key can only be used if the user has been authenticated 102 recently enough. See <a href="#UserAuthentication">Requiring User Authentication For Key Use</a>. 103 </li> 104</ul> 105 106<p>As an additional security measure, for keys whose key material is inside secure hardware (see 107 {@link android.security.keystore.KeyInfo#isInsideSecureHardware() KeyInfo.isInsideSecurityHardware()}) 108 some key use authorizations may be enforced by secure hardware, depending on the Android device. 109 Cryptographic and user authentication authorizations are likely to be enforced by secure hardware. 110 Temporal validity interval authorizations are unlikely to be enforced by the secure hardware 111 because it normally does not have an independent secure real-time clock. 112 113<p>Whether a key's user authentication authorization is enforced by the secure hardware can be 114 queried using 115 {@link android.security.keystore.KeyInfo#isUserAuthenticationRequirementEnforcedBySecureHardware() KeyInfo.isUserAuthenticationRequirementEnforcedBySecureHardware()}. 116 117<h2 id="WhichShouldIUse">Choosing Between a Keychain or the 118Android Keystore Provider</h2> 119 120<p>Use the {@link android.security.KeyChain} API when you want 121 system-wide credentials. When an app requests the use of any credential 122 through the {@link android.security.KeyChain} API, users get to 123 choose, through a system-provided UI, which of the installed credentials 124 an app can access. This allows several apps to use the 125 same set of credentials with user consent.</p> 126 127<p>Use the Android Keystore provider to let an individual app store its own 128 credentials that only the app itself can access. 129 This provides a way for apps to manage credentials that are usable 130 only by itself while providing the same security benefits that the 131 {@link android.security.KeyChain} API provides for system-wide 132 credentials. This method requires no user interaction to select the credentials.</p> 133 134<h2 id="UsingAndroidKeyStore">Using Android Keystore Provider</h2> 135 136<p> 137To use this feature, you use the standard {@link java.security.KeyStore} 138and {@link java.security.KeyPairGenerator} or 139{@link javax.crypto.KeyGenerator} classes along with the 140{@code AndroidKeyStore} provider introduced in Android 4.3 (API level 18).</p> 141 142<p>{@code AndroidKeyStore} is registered as a {@link 143 java.security.KeyStore} type for use with the {@link 144 java.security.KeyStore#getInstance(String) KeyStore.getInstance(type)} 145 method and as a provider for use with the {@link 146 java.security.KeyPairGenerator#getInstance(String, String) 147 KeyPairGenerator.getInstance(algorithm, provider)} and {@link 148 javax.crypto.KeyGenerator#getInstance(String, String) 149 KeyGenerator.getInstance(algorithm, provider)} methods.</p> 150 151<h3 id="GeneratingANewPrivateKey">Generating a New Private Key</h3> 152 153<p>Generating a new {@link java.security.PrivateKey} requires that 154 you also specify the initial X.509 attributes that the self-signed 155 certificate will have. You can replace the certificate at a later 156 time with a certificate signed by a Certificate Authority.</p> 157 158<p>To generate the key, use a {@link java.security.KeyPairGenerator} 159 with {@link android.security.KeyPairGeneratorSpec}:</p> 160 161{@sample development/samples/ApiDemos/src/com/example/android/apis/security/KeyStoreUsage.java generate} 162 163<h3 id="GeneratingANewSecretKey">Generating a New Secret Key</h3> 164 165<p>To generate the key, use a {@link javax.crypto.KeyGenerator} with 166 {@link android.security.keystore.KeyGenParameterSpec}. 167 168<h3 id="WorkingWithKeyStoreEntries">Working with Keystore Entries</h3> 169 170<p>Using the {@code AndroidKeyStore} provider takes place through 171 all the standard {@link java.security.KeyStore} APIs.</p> 172 173<h4 id="ListingEntries">Listing Entries</h4> 174 175<p>List entries in the keystore by calling the {@link 176 java.security.KeyStore#aliases()} method:</p> 177 178{@sample development/samples/ApiDemos/src/com/example/android/apis/security/KeyStoreUsage.java list} 179 180<h4 id="SigningAndVerifyingData">Signing and Verifying Data</h4> 181 182<p>Sign data by fetching the {@link 183 java.security.KeyStore.Entry} from the keystore and using the 184 {@link java.security.Signature} APIs, such as {@link 185 java.security.Signature#sign()}:</p> 186 187{@sample development/samples/ApiDemos/src/com/example/android/apis/security/KeyStoreUsage.java sign} 188 189<p>Similarly, verify data with the {@link java.security.Signature#verify(byte[])} method:</p> 190 191{@sample development/samples/ApiDemos/src/com/example/android/apis/security/KeyStoreUsage.java verify} 192 193<h3 id="UserAuthentication">Requiring User Authentication For Key Use</h3> 194 195<p>When generating or importing a key into the {@code AndroidKeyStore} you can specify that the key 196is only authorized to be used if the user has been authenticated. The user is authenticated using a 197subset of their secure lock screen credentials (pattern/PIN/password, fingerprint). 198 199<p>This is an advanced security feature which is generally useful only if your requirements are that 200a compromise of your application process after key generation/import (but not before or during) 201cannot bypass the requirement for the user to be authenticated to use the key. 202 203<p>When a key is authorized to be used only if the user has been authenticated, it is configured to 204operate in one of the two modes: 205<ul> 206<li>User authentication authorizes the use of keys for a duration of time. All keys in this mode are 207 authorized for use as soon as the user unlocks the secure lock screen or confirms their secure 208 lock screen credential using the 209 {@link android.app.KeyguardManager#createConfirmDeviceCredentialIntent(CharSequence, CharSequence) KeyguardManager.createConfirmDeviceCredentialIntent} 210 flow. The duration for which the authorization remains valid is specific to each key, as specified 211 using {@code setUserAuthenticationValidityDurationSeconds} during key generation or import. Such 212 keys can only be generated or imported if the secure lock screen is enabled (see 213 {@link android.app.KeyguardManager#isDeviceSecure() KeyguardManager.isDeviceSecure()}). These keys 214 become permanently invalidated once the secure lock screen is disabled (reconfigured to None, 215 Swipe or other mode which does not authenticate the user) or forcibly reset (e.g. by a Device 216 Administrator).</li> 217<li>User authentication authorizes a specific cryptographic operation associated with one key. In 218 this mode, each operation involving such a key must be individually authorized by the user. 219 Currently, the only means of such authorization is fingerprint authentication: 220 {@link android.hardware.fingerprint.FingerprintManager#authenticate(CryptoObject, CancellationSignal, int, AuthenticationCallback, Handler) FingerprintManager.authenticate}. 221 Such keys can only be generated or imported if at least one fingerprint is enrolled (see 222 {@link android.hardware.fingerprint.FingerprintManager#hasEnrolledFingerprints() FingerprintManager.hasEnrolledFingerprints}). 223 These keys become permanently invalidated once a new fingerprint is enrolled or all fingerprints 224 are unenrolled.</li> 225</ul> 226 227<h2 id="SupportedAlgorithms">Supported Algorithms</h2> 228 229<ul> 230 <li><a href="#SupportedCiphers">{@code Cipher}</a></li> 231 <li><a href="#SupportedKeyGenerators">{@code KeyGenerator}</a></li> 232 <li><a href="#SupportedKeyFactories">{@code KeyFactory}</a></li> 233 <li><a href="#SupportedKeyPairGenerators">{@code KeyPairGenerator}</a></li> 234 <li><a href="#SupportedMacs">{@code Mac}</a></li> 235 <li><a href="#SupportedSignatures">{@code Signature}</a></li> 236 <li><a href="#SupportedSecretKeyFactories">{@code SecretKeyFactory}</a></li> 237</ul> 238 239<h3 id="SupportedCiphers">Cipher</h3> 240<table> 241 <thead> 242 <tr> 243 <th>Algorithm</th> 244 <th>Supported (API Levels)</th> 245 <th>Notes</th> 246 </tr> 247 </thead> 248 <tbody> 249 <tr> 250 <td>AES/CBC/NoPadding</td> 251 <td>23+</td> 252 <td></td> 253 </tr> 254 <tr> 255 <td>AES/CBC/PKCS7Padding</td> 256 <td>23+</td> 257 <td></td> 258 </tr> 259 <tr> 260 <td>AES/CTR/NoPadding</td> 261 <td>23+</td> 262 <td></td> 263 </tr> 264 <tr> 265 <td>AES/ECB/NoPadding</td> 266 <td>23+</td> 267 <td></td> 268 </tr> 269 <tr> 270 <td>AES/ECB/PKCS7Padding</td> 271 <td>23+</td> 272 <td></td> 273 </tr> 274 <tr> 275 <td>AES/GCM/NoPadding</td> 276 <td>23+</td> 277 <td>Only 12-byte long IVs supported.</td> 278 </tr> 279 <tr> 280 <td>RSA/ECB/NoPadding</td> 281 <td>18+</td> 282 <td></td> 283 </tr> 284 <tr> 285 <td>RSA/ECB/PKCS1Padding</td> 286 <td>18+</td> 287 <td></td> 288 </tr> 289 <tr> 290 <td>RSA/ECB/OAEPWithSHA-1AndMGF1Padding</td> 291 <td>23+</td> 292 <td></td> 293 </tr> 294 <tr> 295 <td>RSA/ECB/OAEPWithSHA-224AndMGF1Padding</td> 296 <td>23+</td> 297 <td></td> 298 </tr> 299 <tr> 300 <td>RSA/ECB/OAEPWithSHA-256AndMGF1Padding</td> 301 <td>23+</td> 302 <td></td> 303 </tr> 304 <tr> 305 <td>RSA/ECB/OAEPWithSHA-384AndMGF1Padding</td> 306 <td>23+</td> 307 <td></td> 308 </tr> 309 <tr> 310 <td>RSA/ECB/OAEPWithSHA-512AndMGF1Padding</td> 311 <td>23+</td> 312 <td></td> 313 </tr> 314 <tr> 315 <td>RSA/ECB/OAEPPadding</td> 316 <td>23+</td> 317 <td></td> 318 </tr> 319 </tbody> 320</table> 321 322<h3 id="SupportedKeyGenerators">KeyGenerator</h3> 323<table> 324 <thead> 325 <tr> 326 <th>Algorithm</th> 327 <th>Supported (API Levels)</th> 328 <th>Notes</th> 329 </tr> 330 </thead> 331 <tbody> 332 <tr> 333 <td>AES</td> 334 <td>23+</td> 335 <td>Supported sizes: 128, 192, 256</td> 336 </tr> 337 <tr> 338 <td>HmacSHA1</td> 339 <td>23+</td> 340 <td> 341 <ul> 342 <li>Supported sizes: 8--1024 (inclusive), must be multiple of 8</li> 343 <li>Default size: 160</li> 344 <ul> 345 </td> 346 </tr> 347 <tr> 348 <td>HmacSHA224</td> 349 <td>23+</td> 350 <td> 351 <ul> 352 <li>Supported sizes: 8--1024 (inclusive), must be multiple of 8</li> 353 <li>Default size: 224</li> 354 <ul> 355 </td> 356 </tr> 357 <tr> 358 <td>HmacSHA256</td> 359 <td>23+</td> 360 <td> 361 <ul> 362 <li>Supported sizes: 8--1024 (inclusive), must be multiple of 8</li> 363 <li>Default size: 256</li> 364 <ul> 365 </td> 366 </tr> 367 <tr> 368 <td>HmacSHA384</td> 369 <td>23+</td> 370 <td> 371 <ul> 372 <li>Supported sizes: 8--1024 (inclusive), must be multiple of 8</li> 373 <li>Default size: 384</li> 374 <ul> 375 </td> 376 </tr> 377 <tr> 378 <td>HmacSHA512</td> 379 <td>23+</td> 380 <td> 381 <ul> 382 <li>Supported sizes: 8--1024 (inclusive), must be multiple of 8</li> 383 <li>Default size: 512</li> 384 <ul> 385 </td> 386 </tr> 387 </tbody> 388</table> 389 390<h3 id="SupportedKeyFactories">KeyFactory</h3> 391<table> 392 <thead> 393 <tr> 394 <th>Algorithm</th> 395 <th>Supported (API Levels)</th> 396 <th>Notes</th> 397 </tr> 398 </thead> 399 <tbody> 400 <tr> 401 <td>EC</td> 402 <td>23+</td> 403 <td>Supported key specs: {@link android.security.keystore.KeyInfo} (private key only), 404 {@link java.security.spec.ECPublicKeySpec} (public key only), 405 {@link java.security.spec.X509EncodedKeySpec} (public key only) 406 </td> 407 </tr> 408 <tr> 409 <td>RSA</td> 410 <td>23+</td> 411 <td>Supported key specs: {@link android.security.keystore.KeyInfo} (private key only), 412 {@link java.security.spec.RSAPublicKeySpec} (public key only), 413 {@link java.security.spec.X509EncodedKeySpec} (public key only) 414 </td> 415 </tr> 416 </tbody> 417</table> 418 419<h3 id="SupportedKeyStoreKeys">KeyStore</h3> 420KeyStore supports the same key types as 421<a href="#SupportedKeyPairGenerators">{@code KeyPairGenerator}</a> and 422<a href="#SupportedKeyGenerators">{@code KeyGenerator}</a>. 423 424<h3 id="SupportedKeyPairGenerators">KeyPairGenerator</h3> 425<table> 426 <thead> 427 <tr> 428 <th>Algorithm</th> 429 <th>Supported (API Levels)</th> 430 <th>Notes</th> 431 </tr> 432 </thead> 433 <tbody> 434 <tr class="deprecated"> 435 <td>DSA</td> 436 <td>19–22</td> 437 <td></td> 438 </tr> 439 <tr> 440 <td>EC</td> 441 <td>23+</td> 442 <td> 443 <ul> 444 <li>Supported sizes: 224, 256, 384, 521</li> 445 <li>Supported named curves: P-224 (secp256r1), P-256 (aka secp256r1 and prime256v1), P-384 446 (aka secp384r1), P-521 (aka secp521r1)</li> 447 </ul> 448 449 <p>Prior to API Level 23, EC keys can be generated using KeyPairGenerator of algorithm "RSA" 450 initialized {@link android.security.KeyPairGeneratorSpec} whose key type is set to "EC" 451 using {@link android.security.KeyPairGeneratorSpec.Builder#setKeyType(String)}. EC curve 452 name cannot be specified using this method -- a NIST P-curve is automatically chosen based 453 on the requested key size. 454 </td> 455 </tr> 456 <tr> 457 <td>RSA</td> 458 <td>18+</td> 459 <td> 460 <ul> 461 <li>Supported sizes: 512, 768, 1024, 2048, 3072, 4096</li> 462 <li>Supported public exponents: 3, 65537</li> 463 <li>Default public exponent: 65537</li> 464 </ul> 465 </td> 466 </tr> 467 </tbody> 468</table> 469 470<h3 id="SupportedMacs">Mac</h3> 471<table> 472 <thead> 473 <tr> 474 <th>Algorithm</th> 475 <th>Supported (API Levels)</th> 476 <th>Notes</th> 477 </tr> 478 </thead> 479 <tbody> 480 <tr> 481 <td>HmacSHA1</td> 482 <td>23+</td> 483 <td></td> 484 </tr> 485 <tr> 486 <td>HmacSHA224</td> 487 <td>23+</td> 488 <td></td> 489 </tr> 490 <tr> 491 <td>HmacSHA256</td> 492 <td>23+</td> 493 <td></td> 494 </tr> 495 <tr> 496 <td>HmacSHA384</td> 497 <td>23+</td> 498 <td></td> 499 </tr> 500 <tr> 501 <td>HmacSHA512</td> 502 <td>23+</td> 503 <td></td> 504 </tr> 505 </tbody> 506</table> 507 508<h3 id="SupportedSignatures">Signature</h3> 509<table> 510 <thead> 511 <tr> 512 <th>Algorithm</th> 513 <th>Supported (API Levels)</th> 514 <th>Notes</th> 515 </tr> 516 </thead> 517 <tbody> 518 <tr> 519 <td>MD5withRSA</td> 520 <td>18+</td> 521 <td></td> 522 </tr> 523 <tr> 524 <td>NONEwithECDSA</td> 525 <td>23+</td> 526 <td></td> 527 </tr> 528 <tr> 529 <td>NONEwithRSA</td> 530 <td>18+</td> 531 <td></td> 532 </tr> 533 <tr class="deprecated"> 534 <td>SHA1withDSA</td> 535 <td>19–22</td> 536 <td></td> 537 </tr> 538 <tr> 539 <td>SHA1withECDSA</td> 540 <td>19+</td> 541 <td></td> 542 </tr> 543 <tr> 544 <td>SHA1withRSA</td> 545 <td>18+</td> 546 <td></td> 547 </tr> 548 <tr> 549 <td>SHA1withRSA/PSS</td> 550 <td>23+</td> 551 <td></td> 552 </tr> 553 <tr class="deprecated"> 554 <td>SHA224withDSA</td> 555 <td>20–22</td> 556 <td></td> 557 </tr> 558 <tr> 559 <td>SHA224withECDSA</td> 560 <td>20+</td> 561 <td></td> 562 </tr> 563 <tr> 564 <td>SHA224withRSA</td> 565 <td>20+</td> 566 <td></td> 567 </tr> 568 <tr> 569 <td>SHA224withRSA/PSS</td> 570 <td>23+</td> 571 <td></td> 572 </tr> 573 <tr class="deprecated"> 574 <td>SHA256withDSA</td> 575 <td>19–22</td> 576 <td></td> 577 </tr> 578 <tr> 579 <td>SHA256withECDSA</td> 580 <td>19+</td> 581 <td></td> 582 </tr> 583 <tr> 584 <td>SHA256withRSA</td> 585 <td>18+</td> 586 <td></td> 587 </tr> 588 <tr> 589 <td>SHA256withRSA/PSS</td> 590 <td>23+</td> 591 <td></td> 592 </tr> 593 <tr class="deprecated"> 594 <td>SHA384withDSA</td> 595 <td>19–22</td> 596 <td></td> 597 </tr> 598 <tr> 599 <td>SHA384withECDSA</td> 600 <td>19+</td> 601 <td></td> 602 </tr> 603 <tr> 604 <td>SHA384withRSA</td> 605 <td>18+</td> 606 <td></td> 607 </tr> 608 <tr> 609 <td>SHA384withRSA/PSS</td> 610 <td>23+</td> 611 <td></td> 612 </tr> 613 <tr class="deprecated"> 614 <td>SHA512withDSA</td> 615 <td>19–22</td> 616 <td></td> 617 </tr> 618 <tr> 619 <td>SHA512withECDSA</td> 620 <td>19+</td> 621 <td></td> 622 </tr> 623 <tr> 624 <td>SHA512withRSA</td> 625 <td>18+</td> 626 <td></td> 627 </tr> 628 <tr> 629 <td>SHA512withRSA/PSS</td> 630 <td>23+</td> 631 <td></td> 632 </tr> 633 </tbody> 634</table> 635 636<h3 id="SupportedSecretKeyFactories">SecretKeyFactory</h3> 637<table> 638 <thead> 639 <tr> 640 <th>Algorithm</th> 641 <th>Supported (API Levels)</th> 642 <th>Notes</th> 643 </tr> 644 </thead> 645 <tbody> 646 <tr> 647 <td>AES</td> 648 <td>23+</td> 649 <td>Supported key specs: {@link android.security.keystore.KeyInfo}</td> 650 </tr> 651 <tr> 652 <td>HmacSHA1</td> 653 <td>23+</td> 654 <td>Supported key specs: {@link android.security.keystore.KeyInfo}</td> 655 </tr> 656 <tr> 657 <td>HmacSHA224</td> 658 <td>23+</td> 659 <td>Supported key specs: {@link android.security.keystore.KeyInfo}</td> 660 </tr> 661 <tr> 662 <td>HmacSHA256</td> 663 <td>23+</td> 664 <td>Supported key specs: {@link android.security.keystore.KeyInfo}</td> 665 </tr> 666 <tr> 667 <td>HmacSHA384</td> 668 <td>23+</td> 669 <td>Supported key specs: {@link android.security.keystore.KeyInfo}</td> 670 </tr> 671 <tr> 672 <td>HmacSHA512</td> 673 <td>23+</td> 674 <td>Supported key specs: {@link android.security.keystore.KeyInfo}</td> 675 </tr> 676 </tbody> 677</table>