Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 01e3a48d authored by Mykola Kondratenko's avatar Mykola Kondratenko Committed by Rubin Xu
Browse files

Fix AES encryption for SP

Synthetic password is double encrypted by both a random auth-bound
keymaster key and a secret derived from user password.

The value 256 (AES_KEY_LENGTH) is declared as default key size for
secret derived from user password.

Auth-bound keymaster key is not a KeyStore-backed secret key
but is one that is PRNG created by JCA classes and stored
into KeyStore through import key material routine,
constraining particular purpose (only PURPOSE_DECRYPT).

Size for random auth-bound keymaster key is not set.

The default size of the AES key generated by KeyGenerator
(if keysize is not set) is 128.

Following fix is aiming to:

* Ensures that both wrapping keys are using the same key size (=256).

* Ensures that GCM encryption parameters generated by the provider are
the same (tag size equals 128).

How to verify:
Check the synthetic_password_X keystore blob size diff (479 -> 495) at
/data/misc/keystore/user_XX

Bug: 124030743
Test: Manual - see issue
Change-Id: I44346b8c1d98773ef1c168d63b03bc5d2bf0f746
parent c49800f1
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment