The key manager provides a secure repository protected by Tizen platform for keys, certificates, and sensitive data of users and/or their APPs. Additionally, the key manager provides secure cryptographic operations for non-exportable keys without revealing key values to clients.

Overview

API	Description
Key Manager Client	Provides APIs for accessing the secure repository and additional secure cryptographic operations.
Key Manager Data Types	Defines data types used in these APIs and provides utility methods handling them.

It provides a secure repository for keys, certificates, and sensitive data of users and/or their APPs which are protected by Tizen platform. Additionally, it provides secure cryptographic operations for non-exportable keys without revealing key values to clients.

The key manager provides 2 types of API.

secure repository APIs: These APIs provides storing, retrieving, and removing functions for keys, certificates, and data.
secure crypto APIs: These APIs provides additional cryptographic operations (create asymmetric key pair, sign/verify signature, verify certificate). Data Store Policy: A client can specify simple access rules when storing data in Key Manager.
- Exportable/Non-Exportable: Only for data tagged as exportable, Key Manager returns the raw value of the data. If data is tagged as non-exportable, Key Manager does not return its raw value. In that case, Key Manager provides secure cryptographic operations for non-exportable keys without revealing key values to clients.
- Per Key Password: All data in Key Manager is protected by Tizen platform. Besides, a client can encrypt its data using its own password additionally. If a client provides a password when storing a data, the data will be encrypted with the password. This password should be provided when getting the data from Key Manager. Data Access Control
- By default, only the owner of a data can access to the data.
- If the owner grants the access to other applications, those applications can read or delete the data from key-manager DB.
- When an application is deleted, the data and access control information granted by the application are also removed. Alias Format
- The format of alias is "package_id name".
- If package_id is not provided by a client, the key-manager will add the package_id of the client to the name internally.
- The client can specify only its own package id in the alias when storing a key, certificate, or data.
- A client should specify the package id of the owner in the alias to retrieve a a key, certificate, or data shared by other applications.
- Aliases are returned as the format of "package_id name" from the key-manager.