Node / meshtastic / Meshtastic-Android / files / core / service / src / androidMain / kotlin / org / meshtastic / core / service / SecurityKeyBackupStoreImpl.kt

Displaying Raw • Download

T8b949e/*

* Copyright (c) 2026 Meshtastic LLC

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <https://www.gnu.org/licenses/>.

*/

Tff7b72package T7ee787org.meshtastic.core.service

Tff7b72import T7ee787android.app.Application

Tff7b72import T7ee787android.content.SharedPreferences

Tff7b72import T7ee787androidx.security.crypto.EncryptedSharedPreferences

Tff7b72import T7ee787androidx.security.crypto.MasterKey

Tff7b72import T7ee787co.touchlab.kermit.Logger

Tff7b72import T7ee787org.koin.core.annotation.Single

Tff7b72import T7ee787org.meshtastic.core.repository.SecurityKeyBackupStore

Tff7b72import T7ee787org.meshtastic.core.repository.StoredSecurityKeys

T8b949e/**

* Encrypted per-node storage for security key backups.

*

* Uses EncryptedSharedPreferences backed by an AES-256-GCM MasterKey (hardware keystore when available), mirroring

* [LockdownPassphraseStoreImpl]. Keyed by node number, matching iOS's per-node Keychain entries.

*/

Tf0883e@SingleTb4b4b4(Te6edf3binds Tff7b72= Tff7b72[Te6edf3SecurityKeyBackupStoreTff7b72::Te6edf3classTff7b72]Tb4b4b4)

Tff7b72class T56d364SecurityKeyBackupStoreImplTb4b4b4(Te6edf3appTb4b4b4: Te6edf3ApplicationTb4b4b4) Tb4b4b4: Te6edf3SecurityKeyBackupStore Tb4b4b4{

T8b949e// androidx.security.crypto (MasterKey / EncryptedSharedPreferences) is deprecated by Google with no

T8b949e// drop-in AndroidX replacement yet. Migrating encrypted storage is a separate, security-sensitive

T8b949e// effort; suppress until a stable replacement (e.g. Tink) is adopted.

Tf0883e@SuppressTb4b4b4(Ta5d6ff"Ta5d6ffTooGenericExceptionCaughtTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffDEPRECATIONTa5d6ff"Tb4b4b4)

Tff7b72private Tff7b72val Te6edf3prefsTb4b4b4: Te6edf3SharedPreferences? Tff7b72by Te6edf3lazy Tb4b4b4{

Tff7b72try Tb4b4b4{

Tff7b72val Te6edf3masterKey Tff7b72= Te6edf3MasterKeyTb4b4b4.Te6edf3BuilderTb4b4b4(Te6edf3appTb4b4b4)Tb4b4b4.Te6edf3setKeySchemeTb4b4b4(Te6edf3MasterKeyTb4b4b4.Te6edf3KeySchemeTb4b4b4.Te6edf3AES256_GCMTb4b4b4)Tb4b4b4.Te6edf3buildTb4b4b4(Tb4b4b4)

Te6edf3EncryptedSharedPreferencesTb4b4b4.Te6edf3createTb4b4b4(

Te6edf3appTb4b4b4,

Te6edf3PREFS_FILE_NAMETb4b4b4,

Te6edf3masterKeyTb4b4b4,

Te6edf3EncryptedSharedPreferencesTb4b4b4.Te6edf3PrefKeyEncryptionSchemeTb4b4b4.Te6edf3AES256_SIVTb4b4b4,

Te6edf3EncryptedSharedPreferencesTb4b4b4.Te6edf3PrefValueEncryptionSchemeTb4b4b4.Te6edf3AES256_GCMTb4b4b4,

Tb4b4b4)

Tb4b4b4} Tff7b72catch Tb4b4b4(Te6edf3eTb4b4b4: Te6edf3ExceptionTb4b4b4) Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3eTb4b4b4(Te6edf3eTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffFailed to initialize encrypted security key backup storeTa5d6ff" Tb4b4b4}

Tff7b72null

Tb4b4b4}

Tb4b4b4}

Tf0883e@SuppressTb4b4b4(Ta5d6ff"Ta5d6ffReturnCountTa5d6ff"Tb4b4b4)

Tff7b72override Tff7b72fun Td2a8ffgetTb4b4b4(Te6edf3nodeNumTb4b4b4: Tffa657IntTb4b4b4)Tb4b4b4: Te6edf3StoredSecurityKeys? Tb4b4b4{

Tff7b72val Te6edf3p Tff7b72= Te6edf3prefs Tff7b72?: Tff7b72return Tff7b72null

Tff7b72val Te6edf3publicKey Tff7b72= Te6edf3pTb4b4b4.Te6edf3getStringTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_publicTa5d6ff"Tb4b4b4, Tff7b72nullTb4b4b4) Tff7b72?: Tff7b72return Tff7b72null

Tff7b72val Te6edf3privateKey Tff7b72= Te6edf3pTb4b4b4.Te6edf3getStringTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_privateTa5d6ff"Tb4b4b4, Tff7b72nullTb4b4b4) Tff7b72?: Tff7b72return Tff7b72null

Tff7b72val Te6edf3timestamp Tff7b72= Te6edf3pTb4b4b4.Te6edf3getLongTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_timestampTa5d6ff"Tb4b4b4, T79c0ff0LTb4b4b4)

Tff7b72return Te6edf3StoredSecurityKeysTb4b4b4(Te6edf3publicKeyTb4b4b4, Te6edf3privateKeyTb4b4b4, Te6edf3timestampTb4b4b4)

Tb4b4b4}

Tff7b72override Tff7b72fun Td2a8ffsaveTb4b4b4(Te6edf3nodeNumTb4b4b4: Tffa657IntTb4b4b4, Te6edf3publicKeyBase64Tb4b4b4: Tffa657StringTb4b4b4, Te6edf3privateKeyBase64Tb4b4b4: Tffa657StringTb4b4b4, Te6edf3timestampTb4b4b4: Tffa657LongTb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3p Tff7b72= Te6edf3prefs Tff7b72?: Te6edf3errorTb4b4b4(Ta5d6ff"Ta5d6ffEncrypted security key backup store unavailableTa5d6ff"Tb4b4b4)

Te6edf3pTb4b4b4.Te6edf3editTb4b4b4(Tb4b4b4)

Tb4b4b4.Te6edf3putStringTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_publicTa5d6ff"Tb4b4b4, Te6edf3publicKeyBase64Tb4b4b4)

Tb4b4b4.Te6edf3putStringTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_privateTa5d6ff"Tb4b4b4, Te6edf3privateKeyBase64Tb4b4b4)

Tb4b4b4.Te6edf3putLongTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_timestampTa5d6ff"Tb4b4b4, Te6edf3timestampTb4b4b4)

Tb4b4b4.Te6edf3applyTb4b4b4(Tb4b4b4)

Tb4b4b4}

Tff7b72override Tff7b72fun Td2a8ffdeleteTb4b4b4(Te6edf3nodeNumTb4b4b4: Tffa657IntTb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3p Tff7b72= Te6edf3prefs Tff7b72?: Tff7b72return

Te6edf3pTb4b4b4.Te6edf3editTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3removeTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_publicTa5d6ff"Tb4b4b4)Tb4b4b4.Te6edf3removeTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_privateTa5d6ff"Tb4b4b4)Tb4b4b4.Te6edf3removeTb4b4b4(Ta5d6ff"Tffd700${Te6edf3nodeNumTffd700}Ta5d6ff_timestampTa5d6ff"Tb4b4b4)Tb4b4b4.Te6edf3applyTb4b4b4(Tb4b4b4)

Tb4b4b4}

Tff7b72private Tff7b72companion Tff7b72object Tb4b4b4{

Tff7b72private Tff7b72const Tff7b72val Te6edf3PREFS_FILE_NAME Tff7b72= Ta5d6ff"Ta5d6ffsecurity_key_backup_storeTa5d6ff"

Tb4b4b4}

Tb4b4b4}