tree d2e1720b1594e1d105da3d9a5cb4bfab12af6fe8
parent 898be8bc76c873cf885d7bdf293b4f58563a1648
author Alex Klyubin <klyubin@google.com> 1434406569 -0700
committer Alex Klyubin <klyubin@google.com> 1434406939 -0700

Fix Android Keystore key gen for keys requiring user auth.

When Android Keystore generates an asymmetric key pair, it needs to
create a self-signed certificate for that pair, in order to expose
the key pair in the JCA KeyStore abstraction through which keys are
later retrieved. The self-signed certificate is normally signed with
the private key.

This CL avoids using the private key to sign the certificate if the
private key can be used only once the user has been authenticated.
For such keys, a fake (non-verifying) signature is used on the
certificate, same as for cases where the key is not authorized for
signing.

Bug: 21852844
Change-Id: Id78bc1f51d12950db4e37c1e0da6c60057d4e693