android: V4.9 + V4.10 Kotlin ports + KeystoreStorage adapter

Pure-JVM additions to shade-android (no Android SDK needed): - V4.9 blob primitives: BlobKdf (HKDF deriveBlobSlotId/Key/SigningSeed), BlobAead (nonce||ct||tag with shade-profile-aad-v1:<slot> AAD), BlobClient (java.net.http with hand-written canonical JSON signing matching TS signPayload output), Profile high-level namespace. - V4.10 approval helpers: CanonicalProfileBlob schema with denormalized trustedApproverFingerprints, build/sign/verify proxy approvals via length-prefixed u16 BE UTF-8 canonical signing payload. - Password KDFs: scrypt + argon2id via Bouncy Castle, NFKC-normalized. - SessionStateJson at-rest serializer for persistence layer. Cross-platform vectors (test-vectors/blob.json, approval.json) gate byte-identical output between TS and Kotlin, including a TS-signed Ed25519 signature the Kotlin port verifies and reproduces (Ed25519 is deterministic). New shade-android-keystore sibling Gradle module (Android-specific): - KeystoreMasterKey: hardware-backed AES-256-GCM with BIOMETRIC_STRONG gating, StrongBox-backed when available, invalidated on enrollment. - BiometricUnlock: coroutine wrapper around BiometricPrompt with tagged cancellation/failure exceptions. - KeystoreStorage: StorageProvider over biometric-gated AES-encrypted SharedPreferences with AAD-bound row keys. All 25 SDK packages typecheck clean; 104 SDK tests + 24 new Kotlin tests + 11 cross-platform vector tests all green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-09 17:38:15 +02:00
parent 1bd7037a6d
commit 188c3db56a
26 changed files with 3181 additions and 1 deletions
--- a/test-vectors/approval.json
+++ b/test-vectors/approval.json
@@ -0,0 +1,46 @@
+{
+  "version": 2,
+  "vectors": [
+    {
+      "description": "V4.10 approval signing payload (length-prefixed u16 BE UTF-8)",
+      "domain": "shade-link-approve-v1",
+      "requestId": "aabbccddeeff00112233445566778899",
+      "hostFingerprint": "11111 22222 33333 44444",
+      "requestingDeviceFingerprint": "55555 66666 77777 88888",
+      "decision": "approve",
+      "signingPayload": "001573686164652d6c696e6b2d617070726f76652d76310020616162626363646465656666303031313232333334343535363637373838393900173131313131203232323232203333333333203434343434001735353535352036363636362037373737372038383838380007617070726f7665"
+    },
+    {
+      "description": "V4.10 approval signing payload (length-prefixed u16 BE UTF-8)",
+      "domain": "shade-link-approve-v1",
+      "requestId": "aabbccddeeff00112233445566778899",
+      "hostFingerprint": "11111 22222 33333 44444",
+      "requestingDeviceFingerprint": "55555 66666 77777 88888",
+      "decision": "reject",
+      "signingPayload": "001573686164652d6c696e6b2d617070726f76652d7631002061616262636364646565666630303131323233333434353536363737383839390017313131313120323232323220333333333320343434343400173535353535203636363636203737373737203838383838000672656a656374"
+    },
+    {
+      "description": "V4.10 approval signing payload (length-prefixed u16 BE UTF-8)",
+      "domain": "prism-link-approve-v1",
+      "requestId": "00000000000000000000000000000000",
+      "hostFingerprint": "a",
+      "requestingDeviceFingerprint": "b",
+      "decision": "approve",
+      "signingPayload": "0015707269736d2d6c696e6b2d617070726f76652d7631002030303030303030303030303030303030303030303030303030303030303030300001610001620007617070726f7665"
+    },
+    {
+      "description": "V4.10 approval Ed25519 sign/verify (deterministic seed)",
+      "seed": "101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f",
+      "publicKey": "7776e870b93354f2a0b24c23f2a36cc4e80e223218c1b97926fdd018396a2b9b",
+      "request": {
+        "requestId": "cafebabe1234567890abcdef00112233",
+        "hostFingerprint": "host-fp",
+        "requestingDeviceFingerprint": "req-fp",
+        "decision": "approve",
+        "domain": "shade-link-approve-v1"
+      },
+      "signingPayload": "001573686164652d6c696e6b2d617070726f76652d7631002063616665626162653132333435363738393061626364656630303131323233330007686f73742d667000067265712d66700007617070726f7665",
+      "signature": "2a60910d161466a10c5b256548267c6d58f7b25d6035dae4c7ab7770dfb1fe321c5b86120749544d18d0f40e1a3e9ca713724692e265083160da23cee926220e"
+    }
+  ]
+}
--- a/test-vectors/blob.json
+++ b/test-vectors/blob.json
@@ -0,0 +1,48 @@
+{
+  "version": 2,
+  "vectors": [
+    {
+      "description": "V4.9 blob KDF (master + app=\"prism-profile-v1\")",
+      "masterKey": "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20",
+      "app": "prism-profile-v1",
+      "slotId": "cee6fe19af3c3ad20f91382938cd05ccf7f314566209f5debad17d8427508323",
+      "blobKey": "47ad8fc8fcb0f15ec75be95246e6040bb0674b1a9e4bc3cf7a2c3d1c1e57877b",
+      "signingSeed": "0bb58f21b588b44f22d5837602c1ee0049e56f99df5241702b65e5de0a1a0dab",
+      "ownerPubkey": "2be918c7af82278fb446bb3901e5a7691f5ac4123275d5e1b202882da2a637bc"
+    },
+    {
+      "description": "V4.9 blob KDF (master + app=\"test-namespace\")",
+      "masterKey": "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20",
+      "app": "test-namespace",
+      "slotId": "b10a7e64f9902f48bc566d48c09c0276cdad2dc9ad55d456374c02a8f160aa46",
+      "blobKey": "9e140339142d23291f0f360f03072c66049cec2449994dce1b77a3aed43eeb37",
+      "signingSeed": "feec2d85ba7320fe34940abca082f056d5fa7927d940b267d44ae24acb486773",
+      "ownerPubkey": "94e8298ea69ba4b160934fb813ee3fa5b2a4254cc78cb3dd8339bdc7b68e660c"
+    },
+    {
+      "description": "V4.9 blob KDF (master + app=\"prism-profile-v1\")",
+      "masterKey": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "app": "prism-profile-v1",
+      "slotId": "deffbe4e2934965ce63fff247331186579ff4ef13c867fa4597059c1d7047bfb",
+      "blobKey": "f498052d24513dccbdf538f2b9c13e9d6519fb06ead58eb3dfadf6b92d94227a",
+      "signingSeed": "e904e2f0f42297f16a29e636c43b9b72d57a49841ab0b9bfd29c03345e9f16d0",
+      "ownerPubkey": "822609f6b07f78d4692bfe708c05ce2d4d3c4eb25cf84a16a9d9e900015b3ca0"
+    },
+    {
+      "description": "V4.9 blob AEAD: nonce || AES-256-GCM(key, plaintext, aad=\"shade-profile-aad-v1:<slotIdHex>\")",
+      "key": "abababababababababababababababababababababababababababababababab",
+      "nonce": "010101010101010101010101",
+      "slotIdHex": "0000000000000000000000000000000000000000000000000000000000000000",
+      "plaintext": "68656c6c6f2073686164652d626c6f622d7631",
+      "wire": "0101010101010101010101014590dd4c26e2abcaafd91815d4b40dab6512fecc82205c3484d87454602ca189ad213f"
+    },
+    {
+      "description": "V4.9 blob AEAD: nonce || AES-256-GCM(key, plaintext, aad=\"shade-profile-aad-v1:<slotIdHex>\")",
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "nonce": "a0a1a2a3a4a5a6a7a8a9aaab",
+      "slotIdHex": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "plaintext": "7b2276657273696f6e223a312c22686f737473223a5b5d2c22636c69656e7473223a5b5d2c2274727573746564417070726f76657246696e6765727072696e7473223a5b5d2c22757064617465644174223a317d",
+      "wire": "a0a1a2a3a4a5a6a7a8a9aaab9d3a0a4837b86bd00c47bde22b58a8b103d82a32a8ec1f40be6d4aef1ac50172f04c1ca28300274f2aef70ad6d3bf3893574302d10967310263b792ed619ebc4c79ebf346d89c69584869e6ceaaa8dceef319ad9e4a96b1a15607fb08082dbb0f959738b"
+    }
+  ]
+}