Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 717fca1d authored by Max Bires's avatar Max Bires Committed by android-build-merger
Browse files

Merge "Adding check for HMAC/EC key size for StrongBox" am: ffee7d8c 

am: f5992f89

Change-Id: Ib360b46f5094d9c19769aacb8e193a2bfcf750ce
parents af248179 f5992f89

keystore/java/android/security/keystore/AndroidKeyStoreKeyGeneratorSpi.java

+4 −0
Original line number Original line Diff line number Diff line
@@ -210,6 +210,10 @@ public abstract class AndroidKeyStoreKeyGeneratorSpi extends KeyGeneratorSpi { 
                        throw new InvalidAlgorithmParameterException(

                        throw new InvalidAlgorithmParameterException(

                            "HMAC key size must be at least 64 bits.");

                            "HMAC key size must be at least 64 bits.");

                    }

                    }

                    if (mKeySizeBits > 512 && spec.isStrongBoxBacked()) {

                        throw new InvalidAlgorithmParameterException(

                            "StrongBox HMAC key size must be smaller than 512 bits.");

                    }





                    // JCA HMAC key algorithm implies a digest (e.g., HmacSHA256 key algorithm

                    // JCA HMAC key algorithm implies a digest (e.g., HmacSHA256 key algorithm

                    // implies SHA-256 digest). Because keymaster HMAC key is authorized only for

                    // implies SHA-256 digest). Because keymaster HMAC key is authorized only for

keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java

+10 −2
Original line number Original line Diff line number Diff line
@@ -303,7 +303,7 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato 
            if (mKeySizeBits == -1) {

            if (mKeySizeBits == -1) {

                mKeySizeBits = getDefaultKeySize(keymasterAlgorithm);

                mKeySizeBits = getDefaultKeySize(keymasterAlgorithm);

            }

            }

            checkValidKeySize(keymasterAlgorithm, mKeySizeBits);

            checkValidKeySize(keymasterAlgorithm, mKeySizeBits, mSpec.isStrongBoxBacked());





            if (spec.getKeystoreAlias() == null) {

            if (spec.getKeystoreAlias() == null) {

                throw new InvalidAlgorithmParameterException("KeyStore entry alias not provided");

                throw new InvalidAlgorithmParameterException("KeyStore entry alias not provided");
@@ -724,10 +724,18 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato 
        }

        }

    }

    }





    private static void checkValidKeySize(int keymasterAlgorithm, int keySize)

    private static void checkValidKeySize(

            int keymasterAlgorithm,

            int keySize,

            boolean isStrongBoxBacked)

            throws InvalidAlgorithmParameterException {

            throws InvalidAlgorithmParameterException {

        switch (keymasterAlgorithm) {

        switch (keymasterAlgorithm) {

            case KeymasterDefs.KM_ALGORITHM_EC:

            case KeymasterDefs.KM_ALGORITHM_EC:

                if (isStrongBoxBacked && keySize != 256) {

                    throw new InvalidAlgorithmParameterException(

                            "Unsupported StrongBox EC key size: "

                            + keySize + " bits. Supported: 256");

                }

                if (!SUPPORTED_EC_NIST_CURVE_SIZES.contains(keySize)) {

                if (!SUPPORTED_EC_NIST_CURVE_SIZES.contains(keySize)) {

                    throw new InvalidAlgorithmParameterException("Unsupported EC key size: "

                    throw new InvalidAlgorithmParameterException("Unsupported EC key size: "

                            + keySize + " bits. Supported: " + SUPPORTED_EC_NIST_CURVE_SIZES);

                            + keySize + " bits. Supported: " + SUPPORTED_EC_NIST_CURVE_SIZES);