Merge "Add support for app-generated attestation keys." (50a66e39) · Commits · e / os / android_frameworks_base

core/api/current.txt

+4 −0

Original line number	Diff line number	Diff line
		@@ -12135,6 +12135,7 @@ package android.content.pm {
		field public static final String FEATURE_INPUT_METHODS = "android.software.input_methods";
		field public static final String FEATURE_IPSEC_TUNNELS = "android.software.ipsec_tunnels";
		field public static final String FEATURE_IRIS = "android.hardware.biometrics.iris";
		field public static final String FEATURE_KEYSTORE_APP_ATTEST_KEY = "android.hardware.keystore.app_attest_key";
		field public static final String FEATURE_KEYSTORE_LIMITED_USE_KEY = "android.hardware.keystore.limited_use_key";
		field public static final String FEATURE_KEYSTORE_SINGLE_USE_KEY = "android.hardware.keystore.single_use_key";
		field public static final String FEATURE_LEANBACK = "android.software.leanback";
		@@ -36290,6 +36291,7 @@ package android.security.keystore {

		public final class KeyGenParameterSpec implements java.security.spec.AlgorithmParameterSpec {
		method @Nullable public java.security.spec.AlgorithmParameterSpec getAlgorithmParameterSpec();
		method @Nullable public String getAttestKeyAlias();
		method public byte[] getAttestationChallenge();
		method @NonNull public String[] getBlockModes();
		method @NonNull public java.util.Date getCertificateNotAfter();
		@@ -36324,6 +36326,7 @@ package android.security.keystore {
		ctor public KeyGenParameterSpec.Builder(@NonNull String, int);
		method @NonNull public android.security.keystore.KeyGenParameterSpec build();
		method public android.security.keystore.KeyGenParameterSpec.Builder setAlgorithmParameterSpec(@NonNull java.security.spec.AlgorithmParameterSpec);
		method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setAttestKeyAlias(@Nullable String);
		method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setAttestationChallenge(byte[]);
		method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setBlockModes(java.lang.String...);
		method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setCertificateNotAfter(@NonNull java.util.Date);
		@@ -36421,6 +36424,7 @@ package android.security.keystore {
		field public static final int ORIGIN_SECURELY_IMPORTED = 8; // 0x8
		field public static final int ORIGIN_UNKNOWN = 4; // 0x4
		field public static final int PURPOSE_AGREE_KEY = 64; // 0x40
		field public static final int PURPOSE_ATTEST_KEY = 128; // 0x80
		field public static final int PURPOSE_DECRYPT = 2; // 0x2
		field public static final int PURPOSE_ENCRYPT = 1; // 0x1
		field public static final int PURPOSE_SIGN = 4; // 0x4

core/java/android/content/pm/PackageManager.java

+9 −0

Original line number	Diff line number	Diff line
		@@ -3272,6 +3272,15 @@ public abstract class PackageManager {
		public static final String FEATURE_KEYSTORE_LIMITED_USE_KEY =
		"android.hardware.keystore.limited_use_key";

		/**
		* Feature for {@link #getSystemAvailableFeatures} and {@link #hasSystemFeature}: The device has
		* a Keystore implementation that can create application-specific attestation keys.
		* See {@link android.security.keystore.KeyGenParameterSpec.Builder#setAttestKeyAlias}.
		*/
		@SdkConstant(SdkConstantType.FEATURE)
		public static final String FEATURE_KEYSTORE_APP_ATTEST_KEY =
		"android.hardware.keystore.app_attest_key";

		/** @hide */
		public static final boolean APP_ENUMERATION_ENABLED_BY_DEFAULT = true;

core/java/android/security/keymaster/KeymasterDefs.java

+1 −0

Original line number	Diff line number	Diff line
		@@ -188,6 +188,7 @@ public final class KeymasterDefs {
		public static final int KM_PURPOSE_VERIFY = KeyPurpose.VERIFY;
		public static final int KM_PURPOSE_WRAP = KeyPurpose.WRAP_KEY;
		public static final int KM_PURPOSE_AGREE_KEY = KeyPurpose.AGREE_KEY;
		public static final int KM_PURPOSE_ATTEST_KEY = KeyPurpose.ATTEST_KEY;

		// Key formats.
		public static final int KM_KEY_FORMAT_X509 = KeyFormat.X509;

keystore/java/android/security/keystore/KeyGenParameterSpec.java

+44 −4

Original line number	Diff line number	Diff line
		@@ -279,8 +279,8 @@ import javax.security.auth.x500.X500Principal;
		* }
		*/
		public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAuthArgs {

		private static final X500Principal DEFAULT_CERT_SUBJECT = new X500Principal("CN=fake");
		private static final X500Principal DEFAULT_CERT_SUBJECT =
		new X500Principal("CN=Android Keystore Key");
		private static final BigInteger DEFAULT_CERT_SERIAL_NUMBER = new BigInteger("1");
		private static final Date DEFAULT_CERT_NOT_BEFORE = new Date(0L); // Jan 1 1970
		private static final Date DEFAULT_CERT_NOT_AFTER = new Date(2461449600000L); // Jan 1 2048
		@@ -317,6 +317,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		private final boolean mUnlockedDeviceRequired;
		private final boolean mCriticalToDeviceEncryption;
		private final int mMaxUsageCount;
		private final String mAttestKeyAlias;
		/*
		* *NOTE*: All new fields MUST also be added to the following:
		* ParcelableKeyGenParameterSpec class.
		@@ -358,7 +359,8 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		boolean userConfirmationRequired,
		boolean unlockedDeviceRequired,
		boolean criticalToDeviceEncryption,
		int maxUsageCount) {
		int maxUsageCount,
		String attestKeyAlias) {
		if (TextUtils.isEmpty(keyStoreAlias)) {
		throw new IllegalArgumentException("keyStoreAlias must not be empty");
		}
		@@ -413,6 +415,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		mUnlockedDeviceRequired = unlockedDeviceRequired;
		mCriticalToDeviceEncryption = criticalToDeviceEncryption;
		mMaxUsageCount = maxUsageCount;
		mAttestKeyAlias = attestKeyAlias;
		}

		/**
		@@ -868,6 +871,18 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		return mMaxUsageCount;
		}

		/**
		* Returns the alias of the attestation key that will be used to sign the attestation
		* certificate of the generated key. Note that an attestation certificate will only be
		* generated if an attestation challenge is set.
		*
		* @see Builder#setAttestKeyAlias(String)
		*/
		@Nullable
		public String getAttestKeyAlias() {
		return mAttestKeyAlias;
		}

		/**
		* Builder of {@link KeyGenParameterSpec} instances.
		*/
		@@ -906,6 +921,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		private boolean mUnlockedDeviceRequired = false;
		private boolean mCriticalToDeviceEncryption = false;
		private int mMaxUsageCount = KeyProperties.UNRESTRICTED_USAGE_COUNT;
		private String mAttestKeyAlias = null;

		/**
		* Creates a new instance of the {@code Builder}.
		@@ -975,6 +991,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		mUnlockedDeviceRequired = sourceSpec.isUnlockedDeviceRequired();
		mCriticalToDeviceEncryption = sourceSpec.isCriticalToDeviceEncryption();
		mMaxUsageCount = sourceSpec.getMaxUsageCount();
		mAttestKeyAlias = sourceSpec.getAttestKeyAlias();
		}

		/**
		@@ -1694,6 +1711,28 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		throw new IllegalArgumentException("maxUsageCount is not valid");
		}

		/**
		* Sets the alias of the attestation key that will be used to sign the attestation
		* certificate for the generated key pair, if an attestation challenge is set with {@link
		* #setAttestationChallenge}. If an attestKeyAlias is set but no challenge, {@link
		* java.security.KeyPairGenerator#initialize} will throw {@link
		* java.security.InvalidAlgorithmParameterException}.
		*
		* <p>If the attestKeyAlias is set to null (the default), Android Keystore will select an
		* appropriate system-provided attestation signing key. If not null, the alias must
		* reference an Android Keystore Key that was created with {@link
		* android.security.keystore.KeyProperties#PURPOSE_ATTEST_KEY}, or key generation will throw
		* {@link java.security.InvalidAlgorithmParameterException}.
		*
		* @param attestKeyAlias the alias of the attestation key to be used to sign the
		* attestation certificate.
		*/
		@NonNull
		public Builder setAttestKeyAlias(@Nullable String attestKeyAlias) {
		mAttestKeyAlias = attestKeyAlias;
		return this;
		}

		/**
		* Builds an instance of {@code KeyGenParameterSpec}.
		*/
		@@ -1731,7 +1770,8 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
		mUserConfirmationRequired,
		mUnlockedDeviceRequired,
		mCriticalToDeviceEncryption,
		mMaxUsageCount);
		mMaxUsageCount,
		mAttestKeyAlias);
		}
		}
		}

keystore/java/android/security/keystore/KeyProperties.java

+12 −0

Original line number	Diff line number	Diff line
		@@ -70,6 +70,7 @@ public abstract class KeyProperties {
		PURPOSE_VERIFY,
		PURPOSE_WRAP_KEY,
		PURPOSE_AGREE_KEY,
		PURPOSE_ATTEST_KEY,
		})
		public @interface PurposeEnum {}

		@@ -112,6 +113,13 @@ public abstract class KeyProperties {
		*/
		public static final int PURPOSE_AGREE_KEY = 1 << 6;

		/**
		* Purpose of key: Signing attestaions. This purpose is incompatible with all others, meaning
		* that when generating a key with PURPOSE_ATTEST_KEY, no other purposes may be specified. In
		* addition, PURPOSE_ATTEST_KEY may not be specified for imported keys.
		*/
		public static final int PURPOSE_ATTEST_KEY = 1 << 7;

		/**
		* @hide
		*/
		@@ -132,6 +140,8 @@ public abstract class KeyProperties {
		return KeymasterDefs.KM_PURPOSE_WRAP;
		case PURPOSE_AGREE_KEY:
		return KeymasterDefs.KM_PURPOSE_AGREE_KEY;
		case PURPOSE_ATTEST_KEY:
		return KeymasterDefs.KM_PURPOSE_ATTEST_KEY;
		default:
		throw new IllegalArgumentException("Unknown purpose: " + purpose);
		}
		@@ -151,6 +161,8 @@ public abstract class KeyProperties {
		return PURPOSE_WRAP_KEY;
		case KeymasterDefs.KM_PURPOSE_AGREE_KEY:
		return PURPOSE_AGREE_KEY;
		case KeymasterDefs.KM_PURPOSE_ATTEST_KEY:
		return PURPOSE_ATTEST_KEY;
		default:
		throw new IllegalArgumentException("Unknown purpose: " + purpose);
		}