Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51ef1ed2 authored by Eric Biggers's avatar Eric Biggers Committed by Automerger Merge Worker
Browse files

Merge "Add isUnlockedDeviceRequired() method to KeyInfo" into main am: c5f61a2d am: 7ce9b0f2 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2971712



Change-Id: I581d9910a3de0c74f81b67b5a18f4d9463f31f88
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents bd856080 7ce9b0f2

core/api/current.txt

+1 −0
Original line number Original line Diff line number Diff line
@@ -39799,6 +39799,7 @@ package android.security.keystore { 
    method @Deprecated public boolean isInsideSecureHardware();

    method @Deprecated public boolean isInsideSecureHardware();

    method public boolean isInvalidatedByBiometricEnrollment();

    method public boolean isInvalidatedByBiometricEnrollment();

    method public boolean isTrustedUserPresenceRequired();

    method public boolean isTrustedUserPresenceRequired();

    method @FlaggedApi("android.security.keyinfo_unlocked_device_required") public boolean isUnlockedDeviceRequired();

    method public boolean isUserAuthenticationRequired();

    method public boolean isUserAuthenticationRequired();

    method public boolean isUserAuthenticationRequirementEnforcedBySecureHardware();

    method public boolean isUserAuthenticationRequirementEnforcedBySecureHardware();

    method public boolean isUserAuthenticationValidWhileOnBody();

    method public boolean isUserAuthenticationValidWhileOnBody();

core/java/android/security/flags.aconfig

+7 −0
Original line number Original line Diff line number Diff line
@@ -30,6 +30,13 @@ flag { 
    is_fixed_read_only: true

    is_fixed_read_only: true

}

}





flag {

    name: "keyinfo_unlocked_device_required"

    namespace: "hardware_backed_security"

    description: "Add the API android.security.keystore.KeyInfo#isUnlockedDeviceRequired()"

    bug: "296475382"

}



flag {

flag {

    name: "deprecate_fsv_sig"

    name: "deprecate_fsv_sig"

    namespace: "hardware_backed_security"

    namespace: "hardware_backed_security"

keystore/java/android/security/keystore/KeyInfo.java

+18 −0
Original line number Original line Diff line number Diff line
@@ -16,6 +16,7 @@ 




package android.security.keystore;

package android.security.keystore;





import android.annotation.FlaggedApi;

import android.annotation.NonNull;

import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.Nullable;
@@ -81,6 +82,7 @@ public class KeyInfo implements KeySpec { 
    private final @KeyProperties.AuthEnum int mUserAuthenticationType;

    private final @KeyProperties.AuthEnum int mUserAuthenticationType;

    private final boolean mUserAuthenticationRequirementEnforcedBySecureHardware;

    private final boolean mUserAuthenticationRequirementEnforcedBySecureHardware;

    private final boolean mUserAuthenticationValidWhileOnBody;

    private final boolean mUserAuthenticationValidWhileOnBody;

    private final boolean mUnlockedDeviceRequired;

    private final boolean mTrustedUserPresenceRequired;

    private final boolean mTrustedUserPresenceRequired;

    private final boolean mInvalidatedByBiometricEnrollment;

    private final boolean mInvalidatedByBiometricEnrollment;

    private final boolean mUserConfirmationRequired;

    private final boolean mUserConfirmationRequired;
@@ -107,6 +109,7 @@ public class KeyInfo implements KeySpec { 
            @KeyProperties.AuthEnum int userAuthenticationType,

            @KeyProperties.AuthEnum int userAuthenticationType,

            boolean userAuthenticationRequirementEnforcedBySecureHardware,

            boolean userAuthenticationRequirementEnforcedBySecureHardware,

            boolean userAuthenticationValidWhileOnBody,

            boolean userAuthenticationValidWhileOnBody,

            boolean unlockedDeviceRequired,

            boolean trustedUserPresenceRequired,

            boolean trustedUserPresenceRequired,

            boolean invalidatedByBiometricEnrollment,

            boolean invalidatedByBiometricEnrollment,

            boolean userConfirmationRequired,

            boolean userConfirmationRequired,
@@ -132,6 +135,7 @@ public class KeyInfo implements KeySpec { 
        mUserAuthenticationRequirementEnforcedBySecureHardware =

        mUserAuthenticationRequirementEnforcedBySecureHardware =

                userAuthenticationRequirementEnforcedBySecureHardware;

                userAuthenticationRequirementEnforcedBySecureHardware;

        mUserAuthenticationValidWhileOnBody = userAuthenticationValidWhileOnBody;

        mUserAuthenticationValidWhileOnBody = userAuthenticationValidWhileOnBody;

        mUnlockedDeviceRequired = unlockedDeviceRequired;

        mTrustedUserPresenceRequired = trustedUserPresenceRequired;

        mTrustedUserPresenceRequired = trustedUserPresenceRequired;

        mInvalidatedByBiometricEnrollment = invalidatedByBiometricEnrollment;

        mInvalidatedByBiometricEnrollment = invalidatedByBiometricEnrollment;

        mUserConfirmationRequired = userConfirmationRequired;

        mUserConfirmationRequired = userConfirmationRequired;
@@ -274,6 +278,20 @@ public class KeyInfo implements KeySpec { 
        return mUserAuthenticationRequired;

        return mUserAuthenticationRequired;

    }

    }





    /**

     * Returns {@code true} if the key is authorized to be used only when the device is unlocked.

     *

     * <p>This authorization applies only to secret key and private key operations. Public key

     * operations are not restricted.

     *

     * @see KeyGenParameterSpec.Builder#setUnlockedDeviceRequired(boolean)

     * @see KeyProtection.Builder#setUnlockedDeviceRequired(boolean)

     */

    @FlaggedApi(android.security.Flags.FLAG_KEYINFO_UNLOCKED_DEVICE_REQUIRED)

    public boolean isUnlockedDeviceRequired() {

        return mUnlockedDeviceRequired;

    }



    /**

    /**

     * Returns {@code true} if the key is authorized to be used only for messages confirmed by the

     * Returns {@code true} if the key is authorized to be used only for messages confirmed by the

     * user.

     * user.

keystore/java/android/security/keystore2/AndroidKeyStoreSecretKeyFactorySpi.java

+5 −0
Original line number Original line Diff line number Diff line
@@ -93,6 +93,7 @@ public class AndroidKeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { 
        long userAuthenticationValidityDurationSeconds = 0;

        long userAuthenticationValidityDurationSeconds = 0;

        boolean userAuthenticationRequired = true;

        boolean userAuthenticationRequired = true;

        boolean userAuthenticationValidWhileOnBody = false;

        boolean userAuthenticationValidWhileOnBody = false;

        boolean unlockedDeviceRequired = false;

        boolean trustedUserPresenceRequired = false;

        boolean trustedUserPresenceRequired = false;

        boolean trustedUserConfirmationRequired = false;

        boolean trustedUserConfirmationRequired = false;

        int remainingUsageCount = KeyProperties.UNRESTRICTED_USAGE_COUNT;

        int remainingUsageCount = KeyProperties.UNRESTRICTED_USAGE_COUNT;
@@ -184,6 +185,9 @@ public class AndroidKeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { 
                                    + userAuthenticationValidityDurationSeconds + " seconds");

                                    + userAuthenticationValidityDurationSeconds + " seconds");

                        }

                        }

                        break;

                        break;

                    case KeymasterDefs.KM_TAG_UNLOCKED_DEVICE_REQUIRED:

                        unlockedDeviceRequired = true;

                        break;

                    case KeymasterDefs.KM_TAG_ALLOW_WHILE_ON_BODY:

                    case KeymasterDefs.KM_TAG_ALLOW_WHILE_ON_BODY:

                        userAuthenticationValidWhileOnBody =

                        userAuthenticationValidWhileOnBody =

                                KeyStore2ParameterUtils.isSecureHardware(a.securityLevel);

                                KeyStore2ParameterUtils.isSecureHardware(a.securityLevel);
@@ -257,6 +261,7 @@ public class AndroidKeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { 
                        : keymasterSwEnforcedUserAuthenticators,

                        : keymasterSwEnforcedUserAuthenticators,

                userAuthenticationRequirementEnforcedBySecureHardware,

                userAuthenticationRequirementEnforcedBySecureHardware,

                userAuthenticationValidWhileOnBody,

                userAuthenticationValidWhileOnBody,

                unlockedDeviceRequired,

                trustedUserPresenceRequired,

                trustedUserPresenceRequired,

                invalidatedByBiometricEnrollment,

                invalidatedByBiometricEnrollment,

                trustedUserConfirmationRequired,

                trustedUserConfirmationRequired,