Android: Support payloads > 245 bytes

Plain RSA encryption only supports payloads of 245 bytes. Work around
this by generating an AES key, encrypting the AES key with RSA, then
store the RSA-encrypted AES key and the AES-encrypted payload.

Backward-compatibility is maintained by using a magic prefix for the new
format.

Fixes #263

Implemented with the help of Github Copilot (Claude Sonnet 4.6)

Author: frankosterfeld

qtkeychain/androidkeystore.cpp

@@ -271,13 +271,7 @@ bool InputStream::readAll(QByteArray &out, QString *errorString) const
     const jclass cls = env->GetObjectClass(obj);
     const jmethodID readMethod = env->GetMethodID(cls, "read", "()I");
     env->DeleteLocalRef(cls);
-    if (!readMethod) {
-        if (env->ExceptionCheck())
-            env->ExceptionClear();
-        if (errorString)
-            *errorString = QStringLiteral("Could not find InputStream.read() method");
-        return false;
-    }
+    Q_ASSERT(readMethod);
 
     out.clear();
     while (true) {
@@ -310,11 +304,7 @@ bool OutputStream::close() const
     const jclass cls = env->GetObjectClass(object());
     const jmethodID closeMethod = env->GetMethodID(cls, "close", "()V");
     env->DeleteLocalRef(cls);
-    if (!closeMethod) {
-        if (env->ExceptionCheck())
-            env->ExceptionClear();
-        return false;
-    }
+    Q_ASSERT(closeMethod);
     env->CallVoidMethod(object(), closeMethod);
     if (env->ExceptionCheck()) {
         env->ExceptionClear();
@@ -342,6 +332,88 @@ bool Cipher::init(int opMode, const Key &key) const
     return handleExceptions();
 }
 
+bool Cipher::init(int opMode, const Key &key,
+                  const java::security::spec::AlgorithmParameterSpec &params) const
+{
+    callMethod<void>("init",
+                     "(ILjava/security/Key;Ljava/security/spec/AlgorithmParameterSpec;)V",
+                     opMode, key.object(), params.object());
+    return handleExceptions();
+}
+
+bool Cipher::doFinal(const QByteArray &input, QByteArray &output, QString *errorString) const
+{
+    QAndroidJniEnvironment env;
+    const jobject obj = object();
+    const jclass cls = env->GetObjectClass(obj);
+    const jmethodID method = env->GetMethodID(cls, "doFinal", "([B)[B");
+    env->DeleteLocalRef(cls);
+    Q_ASSERT(method);
+    const jobject resultObj =
+            env->CallObjectMethod(obj, method, toArray(input).object());
+    if (env->ExceptionCheck()) {
+        const jthrowable exception = env->ExceptionOccurred();
+        env->ExceptionClear();
+        if (errorString && exception) {
+            *errorString = QAndroidJniObject(exception)
+                                   .callObjectMethod<jstring>("toString")
+                                   .toString();
+            env->DeleteLocalRef(exception);
+        }
+        if (resultObj)
+            env->DeleteLocalRef(resultObj);
+        return false;
+    }
+    output = fromArray(static_cast<jbyteArray>(resultObj));
+    env->DeleteLocalRef(resultObj);
+    return true;
+}
+
+SecureRandom::SecureRandom()
+    : Object(QAndroidJniObject("java/security/SecureRandom"))
+{
+    handleExceptions();
+}
+
+bool SecureRandom::nextBytes(QByteArray &bytes) const
+{
+    QAndroidJniEnvironment env;
+    const jsize size = static_cast<jsize>(bytes.size());
+    const jbyteArray array = env->NewByteArray(size);
+    if (!array)
+        return false;
+    const jobject obj = object();
+    const jclass cls = env->GetObjectClass(obj);
+    const jmethodID method = env->GetMethodID(cls, "nextBytes", "([B)V");
+    env->DeleteLocalRef(cls);
+    Q_ASSERT(method);
+    env->CallVoidMethod(obj, method, array);
+    if (env->ExceptionCheck()) {
+        env->ExceptionClear();
+        env->DeleteLocalRef(array);
+        return false;
+    }
+    bytes = fromArray(array);
+    env->DeleteLocalRef(array);
+    return true;
+}
+
+SecretKeySpec::SecretKeySpec(const QByteArray &key, const QString &algorithm)
+    : Key(QAndroidJniObject("javax/crypto/spec/SecretKeySpec",
+                            "([BLjava/lang/String;)V",
+                            toArray(key).object(), fromString(algorithm).object()))
+{
+    handleExceptions();
+}
+
+GCMParameterSpec::GCMParameterSpec(int tLen, const QByteArray &iv)
+    : AlgorithmParameterSpec(QAndroidJniObject("javax/crypto/spec/GCMParameterSpec",
+                                               "(I[B)V",
+                                               static_cast<jint>(tLen), toArray(iv).object()))
+{
+    handleExceptions();
+}
+
 CipherOutputStream::CipherOutputStream(const OutputStream &stream, const Cipher &cipher)
     : FilterOutputStream(QAndroidJniObject("javax/crypto/CipherOutputStream",
                                            "(Ljava/io/OutputStream;Ljavax/crypto/Cipher;)V",

qtkeychain/androidkeystore_p.h

@@ -200,6 +200,13 @@ class PublicKey : public Key
     PublicKey(const Key &init) : Key(init) { }
 };
 
+class SecureRandom : public java::lang::Object
+{
+public:
+    SecureRandom();
+    bool nextBytes(QByteArray &bytes) const;
+};
+
 class KeyPair : public java::lang::Object
 {
 public:
@@ -320,6 +327,22 @@ class KeyPairGeneratorSpec : public java::security::spec::AlgorithmParameterSpec
 namespace javax {
 namespace crypto {
 
+class SecretKeySpec : public java::security::Key
+{
+public:
+    using Key::Key;
+
+    explicit SecretKeySpec(const QByteArray &key, const QString &algorithm);
+};
+
+class GCMParameterSpec : public java::security::spec::AlgorithmParameterSpec
+{
+public:
+    using AlgorithmParameterSpec::AlgorithmParameterSpec;
+
+    explicit GCMParameterSpec(int tLen, const QByteArray &iv);
+};
+
 class Cipher : public java::lang::Object
 {
 public:
@@ -330,6 +353,10 @@ class Cipher : public java::lang::Object
 
     static Cipher getInstance(const QString &transformation);
     bool init(int opMode, const java::security::Key &key) const;
+    bool init(int opMode, const java::security::Key &key,
+              const java::security::spec::AlgorithmParameterSpec &params) const;
+    bool doFinal(const QByteArray &input, QByteArray &output,
+                 QString *errorString = nullptr) const;
 };
 
 class CipherInputStream : public java::io::FilterInputStream

qtkeychain/keychain_android.cpp

@@ -22,7 +22,7 @@ using android::content::Context;
 using android::security::KeyPairGeneratorSpec;
 
 using java::io::ByteArrayInputStream;
-using java::io::ByteArrayOutputStream;
+using java::security::SecureRandom;
 using java::security::KeyPair;
 using java::security::KeyPairGenerator;
 using java::security::KeyStore;
@@ -32,7 +32,8 @@ using java::util::Calendar;
 
 using javax::crypto::Cipher;
 using javax::crypto::CipherInputStream;
-using javax::crypto::CipherOutputStream;
+using javax::crypto::GCMParameterSpec;
+using javax::crypto::SecretKeySpec;
 using javax::security::auth::x500::X500Principal;
 
 namespace {
@@ -42,6 +43,10 @@ inline QString makeAlias(const QString &service, const QString &key)
     return service + QLatin1Char('/') + key;
 }
 
+// Magic prefix identifying the hybrid RSA+AES-GCM format (v2).
+// Legacy entries have no prefix and are raw RSA ciphertext.
+const QByteArray kHybridMagic("QKCA", 4);
+
 } // namespace
 
 void ReadPasswordJobPrivate::scheduledStart()
@@ -70,20 +75,78 @@ void ReadPasswordJobPrivate::scheduledStart()
         return;
     }
 
-    const auto cipher = Cipher::getInstance(QStringLiteral("RSA/ECB/PKCS1Padding"));
+    QByteArray plainData;
 
-    if (!cipher || !cipher.init(Cipher::DECRYPT_MODE, entry.getPrivateKey())) {
-        q->emitFinishedWithError(Error::OtherError, tr("Could not create decryption cipher"));
-        return;
-    }
+    if (encryptedData.startsWith(kHybridMagic)) {
+        // Hybrid format: kHybridMagic(4) + encKeyLen(4 BE) + RSA(AESkey) + IV(12) + AES-GCM ciphertext
+        const int minSize = kHybridMagic.size() + 4 + 1 + 12 + 16;
+        if (encryptedData.size() < minSize) {
+            q->emitFinishedWithError(Error::OtherError, tr("Encrypted data is too short"));
+            return;
+        }
 
-    QByteArray plainData;
-    const CipherInputStream inputStream(ByteArrayInputStream(encryptedData), cipher);
+        const int lenOffset = kHybridMagic.size();
+        const quint32 encKeyLen =
+                (static_cast<quint32>(static_cast<unsigned char>(encryptedData[lenOffset])) << 24)
+                | (static_cast<quint32>(static_cast<unsigned char>(encryptedData[lenOffset + 1])) << 16)
+                | (static_cast<quint32>(static_cast<unsigned char>(encryptedData[lenOffset + 2])) << 8)
+                | (static_cast<quint32>(static_cast<unsigned char>(encryptedData[lenOffset + 3])));
 
-    QString readError;
-    if (!inputStream.readAll(plainData, &readError)) {
-        q->emitFinishedWithError(Error::OtherError, tr("Could not decrypt data: %1").arg(readError));
-        return;
+        const int dataOffset = lenOffset + 4;
+        if (encryptedData.size() < dataOffset + (int)encKeyLen + 12 + 16) {
+            q->emitFinishedWithError(Error::OtherError, tr("Encrypted data is too short"));
+            return;
+        }
+
+        const QByteArray encryptedKey = encryptedData.mid(dataOffset, encKeyLen);
+        const QByteArray iv = encryptedData.mid(dataOffset + encKeyLen, 12);
+        const QByteArray encryptedPayload = encryptedData.mid(dataOffset + encKeyLen + 12);
+
+        // Decrypt the AES key with RSA
+        const auto rsaCipher = Cipher::getInstance(QStringLiteral("RSA/ECB/PKCS1Padding"));
+        if (!rsaCipher || !rsaCipher.init(Cipher::DECRYPT_MODE, entry.getPrivateKey())) {
+            q->emitFinishedWithError(Error::OtherError, tr("Could not create RSA decryption cipher"));
+            return;
+        }
+
+        QByteArray aesKeyBytes;
+        QString decryptError;
+        if (!rsaCipher.doFinal(encryptedKey, aesKeyBytes, &decryptError)) {
+            q->emitFinishedWithError(Error::OtherError,
+                                     tr("Could not decrypt AES key: %1").arg(decryptError));
+            return;
+        }
+
+        // Decrypt the payload with AES-GCM
+        const SecretKeySpec aesKey(aesKeyBytes, QStringLiteral("AES"));
+        const GCMParameterSpec gcmSpec(128, iv);
+        const auto aesCipher = Cipher::getInstance(QStringLiteral("AES/GCM/NoPadding"));
+        if (!aesCipher || !aesCipher.init(Cipher::DECRYPT_MODE, aesKey, gcmSpec)) {
+            q->emitFinishedWithError(Error::OtherError,
+                                     tr("Could not create AES decryption cipher"));
+            return;
+        }
+
+        if (!aesCipher.doFinal(encryptedPayload, plainData, &decryptError)) {
+            q->emitFinishedWithError(Error::OtherError,
+                                     tr("Could not decrypt data: %1").arg(decryptError));
+            return;
+        }
+    } else {
+        // Legacy format: raw RSA-encrypted blob (only works for data <= ~245 bytes)
+        const auto cipher = Cipher::getInstance(QStringLiteral("RSA/ECB/PKCS1Padding"));
+        if (!cipher || !cipher.init(Cipher::DECRYPT_MODE, entry.getPrivateKey())) {
+            q->emitFinishedWithError(Error::OtherError, tr("Could not create decryption cipher"));
+            return;
+        }
+
+        const CipherInputStream inputStream(ByteArrayInputStream(encryptedData), cipher);
+        QString readError;
+        if (!inputStream.readAll(plainData, &readError)) {
+            q->emitFinishedWithError(Error::OtherError,
+                                     tr("Could not decrypt data: %1").arg(readError));
+            return;
+        }
     }
 
     mode = plainTextStore.readMode(q->key());
@@ -157,23 +220,69 @@ void WritePasswordJobPrivate::scheduledStart()
     }
 
     const RSAPublicKey publicKey = entry.getCertificate().getPublicKey();
-    const auto cipher = Cipher::getInstance(QStringLiteral("RSA/ECB/PKCS1Padding"));
 
-    if (!cipher || !cipher.init(Cipher::ENCRYPT_MODE, publicKey)) {
-        q->emitFinishedWithError(Error::OtherError, tr("Could not create encryption cipher"));
+    // Generate a random AES-256 key
+    QByteArray aesKeyBytes(32, '\0');
+    SecureRandom secureRandom;
+    if (!secureRandom || !secureRandom.nextBytes(aesKeyBytes)) {
+        q->emitFinishedWithError(Error::OtherError, tr("Could not generate AES key"));
         return;
     }
 
-    ByteArrayOutputStream outputStream;
-    CipherOutputStream cipherOutputStream(outputStream, cipher);
+    // Generate a random 12-byte IV for AES-GCM
+    QByteArray iv(12, '\0');
+    if (!secureRandom.nextBytes(iv)) {
+        q->emitFinishedWithError(Error::OtherError, tr("Could not generate IV"));
+        return;
+    }
 
-    if (!cipherOutputStream.write(data) || !cipherOutputStream.close()) {
-        q->emitFinishedWithError(Error::OtherError, tr("Could not encrypt data"));
+    // Encrypt the payload with AES/GCM/NoPadding
+    const SecretKeySpec aesKey(aesKeyBytes, QStringLiteral("AES"));
+    const GCMParameterSpec gcmSpec(128, iv);
+    const auto aesCipher = Cipher::getInstance(QStringLiteral("AES/GCM/NoPadding"));
+    if (!aesCipher || !aesCipher.init(Cipher::ENCRYPT_MODE, aesKey, gcmSpec)) {
+        q->emitFinishedWithError(Error::OtherError, tr("Could not create AES encryption cipher"));
         return;
     }
 
+    QByteArray encryptedPayload;
+    QString encryptError;
+    if (!aesCipher.doFinal(data, encryptedPayload, &encryptError)) {
+        q->emitFinishedWithError(Error::OtherError,
+                                 tr("Could not encrypt data: %1").arg(encryptError));
+        return;
+    }
+
+    // Encrypt the AES key with RSA (32 bytes always fits within RSA-2048 limit)
+    const auto rsaCipher = Cipher::getInstance(QStringLiteral("RSA/ECB/PKCS1Padding"));
+    if (!rsaCipher || !rsaCipher.init(Cipher::ENCRYPT_MODE, publicKey)) {
+        q->emitFinishedWithError(Error::OtherError, tr("Could not create RSA encryption cipher"));
+        return;
+    }
+
+    QByteArray encryptedKey;
+    if (!rsaCipher.doFinal(aesKeyBytes, encryptedKey, &encryptError)) {
+        q->emitFinishedWithError(Error::OtherError,
+                                 tr("Could not encrypt AES key: %1").arg(encryptError));
+        return;
+    }
+
+    // Assemble blob: kHybridMagic(4) + encKeyLen(4 BE) + encryptedKey + iv(12) + encryptedPayload
+    const quint32 encKeyLen = static_cast<quint32>(encryptedKey.size());
+    QByteArray blob;
+    blob.reserve(kHybridMagic.size() + 4 + encryptedKey.size() + iv.size()
+                 + encryptedPayload.size());
+    blob += kHybridMagic;
+    blob += static_cast<char>((encKeyLen >> 24) & 0xFF);
+    blob += static_cast<char>((encKeyLen >> 16) & 0xFF);
+    blob += static_cast<char>((encKeyLen >> 8) & 0xFF);
+    blob += static_cast<char>(encKeyLen & 0xFF);
+    blob += encryptedKey;
+    blob += iv;
+    blob += encryptedPayload;
+
     PlainTextStore plainTextStore(q->service(), q->settings());
-    plainTextStore.write(q->key(), outputStream.toByteArray(), mode);
+    plainTextStore.write(q->key(), blob, mode);
 
     if (plainTextStore.error() != NoError)
         q->emitFinishedWithError(plainTextStore.error(), plainTextStore.errorString());