title: KeyStore not applying / enforcing private key password for PKCS12 file in Android with BouncyCastle
body: <p>I am finding that when I create a password-protected PKCS12 file that also contains a password-protected private key and its associated public key / certificate, I am able to decrypt the private key regardless of the password provided to <code>getKey()</code> (internal encrypted content) as long as the correct password is provided to <code>KeyStore</code>'s initial <code>load()</code>.  Is this a known issue or has anyone else seen this?  It really looks like the private key password is being unused or ignored all together.  I am using Android with BouncyCastle as the provider. I am also curious if this problem is true for JKS and not just BouncyCastle?  Error checking in the code below has been removed for clarity.</p>
  
  <p>When I create my PKCS12 file I use the following code (<code>privateKey</code> is an <code>RSAPrivateKey</code> and <code>signedCert</code> is an <code>X509Certificate</code>):</p>
  
  <pre><code>KeyStore store;
  store = KeyStore.getInstance( "PKCS12", "BC" );
  store.load( null, null );
  
  X509Certificate[] chain = new X509Certificate[1];
  chain[0] = signedCert;
  
  store.setKeyEntry( pkcs12Alias, privateKey, p12PkeyPass.toCharArray(), chain );
  
  FileOutputStream fos;
  File outputDir = appContext.getFilesDir();
  File pkcs12File = new File( outputDir, p12Filename );
  fos = new FileOutputStream( pkcs12File );
  
  store.store( fos, p12Pass.toCharArray() );
  fos.flush();
  fos.close();
  </code></pre>
  
  <p>When I go to load the PKCS12 contents, no matter what I put for the private key password, the extracted private keys are all correctly loaded and all the same (pkey1 == pkey2 == pkey3 tested with the .equals()).</p>
  
  <pre><code>FileInputStream fis;
  KeyStore store;
  File pkcs12File = new File( activity.getFilesDir(), p12Filename );
  fis = new FileInputStream( pkcs12File );
  store = KeyStore.getInstance( "PKCS12", "BC" );
  store.load( fis, p12Pass.toCharArray() );
  
  X509Certificate signedCert = (X509Certificate) store.getCertificate( pkcs12Alias );
  
  // try to get the private key with different passwords - result is the same
  RSAPrivateKey pkey1 = (RSAPrivateKey) store.getKey( pkcs12Alias, p12PkeyPass.toCharArray() );
  RSAPrivateKey pkey2 = (RSAPrivateKey) store.getKey( pkcs12Alias, "".toCharArray() );
  RSAPrivateKey pkey3 = (RSAPrivateKey) store.getKey( pkcs12Alias, "something completely different".toCharArray() );
  
  fis.close();
  </code></pre>
  
  <p>Thanks in advance!</p>