From 22cbe5a9a795cc4ef2a3c6a584f6c07ce41a33ff Mon Sep 17 00:00:00 2001
From: Qing <44231502+byemaxx@users.noreply.github.com>
Date: Thu, 27 Nov 2025 17:26:42 -0500
Subject: [PATCH] Clear generated key cache on keybox updates for Android 12+
 (#16)

Ensures that the cache of generated keys is invalidated and cleared whenever a keybox file is updated. This prevents the system from using stale certificates after a keybox change.

Co-authored-by: JingMatrix <jingmatrix@gmail.com>
---
 .../matrix/TEESimulator/config/ConfigurationManager.kt | 10 ++++++++--
 .../keystore/shim/KeyMintSecurityLevelInterceptor.kt   |  9 +++++++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt b/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt
index 3b5f84a..7ad7038 100644
--- a/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt
@@ -247,14 +247,20 @@ object ConfigurationManager {
             when (path) {
                 TARGET_PACKAGES_FILE -> loadTargetPackages(file!!)
                 PATCH_LEVEL_FILE -> loadPatchLevelConfig(file!!)
-                // Any change to an XML file is assumed to be a keybox. The cache in KeyBoxUtils
-                // will handle reloading it on its next use.
+                // Any change to an XML file is assumed to be a keybox.
+                // The cache in KeyBoxManager will handle reloading it on its next use.
                 else ->
                     if (path.endsWith(".xml")) {
                         SystemLogger.info(
                             "Keybox file $path may have changed. It will be reloaded on next access."
                         )
                         KeyBoxManager.invalidateCache(path)
+                        if (Build.VERSION.SDK_INT > Build.VERSION_CODES.R) {
+                            // Clear cached keys possibly containing old certificates
+                            org.matrix.TEESimulator.interception.keystore.shim
+                                .KeyMintSecurityLevelInterceptor
+                                .clearAllGeneratedKeys("updating $file")
+                        }
                     }
             }
         }
diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
index 5a07822..7d1f7bc 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
@@ -218,6 +218,15 @@ class KeyMintSecurityLevelInterceptor(
                 SystemLogger.debug("Remove cached attestaion key ${keyId}")
             }
         }
+
+        // Clears all cached keys.
+        fun clearAllGeneratedKeys(reason: String? = null) {
+            val count = generatedKeys.size
+            val reasonMessage = reason?.let { " due to $it" } ?: ""
+            generatedKeys.clear()
+            attestationKeys.clear()
+            SystemLogger.info("Cleared all cached keys ($count entries)$reasonMessage.")
+        }
     }
 }