Check android keystore keypass for correctness

Question

I'm automating some things that involve the android keytool and jarsigner. The tool takes a keystore, the password for the keystore, the alias name, and the password for the alias / key, and I'm trying to find a way to explicitly check to see if the supplied password for the alias / key is correct.

Any ideas? Also, I need to check it without a jar file to sign - getting that file in my context is lengthy, so I want to abort sooner rather than later.

Yep! Although but damn it's been awhile since I touched any of this. — Narfanator, Mar 02 '18 at 22:09

score 132 · Accepted Answer · answered Mar 13 '17 at 16:00

132

You can also check if the password is correct without attempting to change the password. I did it by listing the properties of the keystore with this command:

keytool -list -keystore <keystorefile> -storepass <passwordtocheck>

answered Mar 13 '17 at 16:00

Jeff LaFay

12,882
13
71
101

1

I am getting this - **The syntax of the command is incorrect.** – Kavin Raju S Dec 24 '18 at 01:18
25

Note that this doesn't test correctness of the alias password – Tom Jan 16 '19 at 00:54
2

@VijayKumar The answer below uses `keytool -keypasswd` to try and change the alias' password (to the same password), which will fail if the password is incorrect. – Tom Jan 27 '20 at 19:36

score 30 · Answer 2 · edited Apr 20 '16 at 10:36

You can do it a couple of ways:

A. With keytool

If you run the command keytool -keypasswd -keystore <keystore> -alias <alias> -storepass <storepass> -keypass <keypass> -new <keypass> then you will get the error Keystore was tampered with, or password was incorrect if the keystore password is wrong, or the error Cannot recover key if the alias password is wrong. Unfortunately the return code is 1 in both cases, so you will need to do parsing of the program's output if you want to be smart about the type of error.

B. With a small Java program

Something along these lines:

KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

try (FileInputStream fis = new FileInputStream(keystore)) {
    ks.load(fis, ksPw.toCharArray());
}

ks.getEntry(alias, new KeyStore.PasswordProtection(aliasPw.toCharArray()));

will fail at line 4 with a java.io.IOException if the key store password is wrong, or with a java.security.UnrecoverableKeyException at line 7 if the alias password is wrong.

Check android keystore keypass for correctness

2 Answers2

Linked