Check android keystore keypass for correctness

Question

I'm automating some things that involve the android keytool and jarsigner. The tool takes a keystore, the password for the keystore, the alias name, and the password for the alias / key, and I'm trying to find a way to explicitly check to see if the supplied password for the alias / key is correct.

Any ideas? Also, I need to check it without a jar file to sign - getting that file in my context is lengthy, so I want to abort sooner rather than later.

Answer 1

You can do it a couple of ways:

A. With keytool

If you run the command keytool -keypasswd -keystore <keystore> -alias <alias> -storepass <storepass> -keypass <keypass> -new <keypass> then you will get the error Keystore was tampered with, or password was incorrect if the keystore password is wrong, or the error Cannot recover key if the alias password is wrong. Unfortunately the return code is 1 in both cases, so you will need to do parsing of the program's output if you want to be smart about the type of error.

B. With a small Java program

Something along these lines:

KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

try (FileInputStream fis = new FileInputStream(keystore)) {
    ks.load(fis, ksPw.toCharArray());
}

ks.getEntry(alias, new KeyStore.PasswordProtection(aliasPw.toCharArray()));

will fail at line 4 with a java.io.IOException if the key store password is wrong, or with a java.security.UnrecoverableKeyException at line 7 if the alias password is wrong.

Answer 2

You can also check if the password is correct without attempting to change the password. I did it by listing the properties of the keystore with this command:

keytool -list -keystore <keystorefile> -storepass <passwordtocheck>