Document when encrypted AndroidKeyStore keys are wiped.

This also drops the boolean parameter from
KeyGeneratorSpec.Builder.setEncryptionRequired to match the already
launched KeyPairGeneratorSpec.Builder.setEncryptionRequired.

Bug: 18088752
Change-Id: I91a3e8c77958971b1bda8329319f1a0d8043b669

1 files changed, 6 insertions, 3 deletions

diff --git a/keystore/java/android/security/KeyPairGeneratorSpec.java b/keystore/java/android/security/KeyPairGeneratorSpec.java
index 1fcb355a874f..7fd5cb5af35f 100644
--- a/keystore/java/android/security/KeyPairGeneratorSpec.java
+++ b/keystore/java/android/security/KeyPairGeneratorSpec.java
@@ -654,11 +654,14 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec {
         }
 
         /**
-         * Indicates that this key must be encrypted at rest. This will protect the key pair with
-         * the secure lock screen credential (e.g., password, PIN, or pattern).
+         * Indicates that this key pair must be encrypted at rest. This will protect the key pair
+         * with the secure lock screen credential (e.g., password, PIN, or pattern).
          *
          * <p>Note that this feature requires that the secure lock screen (e.g., password, PIN,
-         * pattern) is set up. Otherwise key pair generation will fail.
+         * pattern) is set up, otherwise key pair generation will fail. Moreover, this key pair will
+         * be deleted when the secure lock screen is disabled or reset (e.g., by the user or a
+         * Device Administrator). Finally, this key pair cannot be used until the user unlocks the
+         * secure lock screen after boot.
          *
          * @see KeyguardManager#isDeviceSecure()
          */