Commit 980b0b49 authored by David Benjamin's avatar David Benjamin Committed by Commit Bot

Fix the key type for ECDSA client certificates in Android

We map key types from the TLS code points to Android key types so
choosePrivateKeyAlias can filter the selection. Prior to Android 10, the
API ignored the parameter so it didn't actually matter what was passed
in. Starting Android 10, the filter is applied.

We had mapped ECDSA to "ECDSA", however the actual string is "EC". See:
https://developer.android.com/reference/android/security/KeyChain.html#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String%5B%5D,%20java.security.Principal%5B%5D,%20java.lang.String,%20int,%20java.lang.String)
https://developer.android.com/reference/android/security/keystore/KeyProperties.html#KEY_ALGORITHM_EC
https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#KeyFactory

Tested manually by importing an EC key on an Android 10 device and
testing with a TLS 1.2 server. (Note TLS 1.3 doesn't use the old client
certificate types anymore and we do not currently do anything with the
new values.)

Bug: none
Change-Id: I8fd222093c603962f8455b3fbde76d7a0d511042
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1863377
Auto-Submit: David Benjamin <davidben@chromium.org>
Commit-Queue: Yaron Friedman <yfriedman@chromium.org>
Reviewed-by: default avatarYaron Friedman <yfriedman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#706271}
parent f456d8ca
...@@ -160,7 +160,7 @@ static void StartClientCertificateRequest( ...@@ -160,7 +160,7 @@ static void StartClientCertificateRequest(
key_types.push_back("RSA"); key_types.push_back("RSA");
break; break;
case net::CLIENT_CERT_ECDSA_SIGN: case net::CLIENT_CERT_ECDSA_SIGN:
key_types.push_back("ECDSA"); key_types.push_back("EC");
break; break;
default: default:
// Ignore unknown types. // Ignore unknown types.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment