xyz.truenight.rxinapps.util

Class Security

java.lang.Object

xyz.truenight.rxinapps.util.Security

public class Security
extends java.lang.Object

Security-related methods. For a secure implementation, all of this code should be implemented on a server that communicates with the application on the device. For the sake of simplicity and clarity of this example, this code is included here and is executed on the device. If you must verify the purchases on the phone, you should obfuscate this code to make it harder for an attacker to replace the code with stubs that treat all purchases as verified.

Constructor Summary

Constructors

Constructor and Description
Security()

Method Summary

Modifier and Type	Method and Description
static java.security.PublicKey	generatePublicKey(java.lang.String encodedPublicKey) Generates a PublicKey instance from a string containing the Base64-encoded public key.
static boolean	verify(java.security.PublicKey publicKey, java.lang.String signedData, java.lang.String signature) Verifies that the signature from the server matches the computed signature on the data.
static boolean	verifyPurchase(java.lang.String productId, java.lang.String base64PublicKey, java.lang.String signedData, java.lang.String signature) Verifies that the data was signed with the given signature, and returns the verified purchase.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Security

public Security()

Method Detail

verifyPurchase

public static boolean verifyPurchase(java.lang.String productId,
                                     java.lang.String base64PublicKey,
                                     java.lang.String signedData,
                                     java.lang.String signature)

Verifies that the data was signed with the given signature, and returns the verified purchase. The data is in JSON format and signed with a private key.

Parameters:

productId - the product Id used for debug validation.

base64PublicKey - the base64-encoded public key to use for verifying.

signedData - the signed JSON string (signed, not encrypted)

signature - the signature for the data, signed with the private key

generatePublicKey

public static java.security.PublicKey generatePublicKey(java.lang.String encodedPublicKey)

Generates a PublicKey instance from a string containing the Base64-encoded public key.

Parameters:

encodedPublicKey - Base64-encoded public key

Throws:

java.lang.IllegalArgumentException - if encodedPublicKey is invalid

verify

public static boolean verify(java.security.PublicKey publicKey,
                             java.lang.String signedData,
                             java.lang.String signature)

Verifies that the signature from the server matches the computed signature on the data. Returns true if the data is correctly signed.

Parameters:

publicKey - public key associated with the developer account

signedData - signed data from server

signature - server signature

Returns:

true if the data and signature match