Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5bdd77f authored by Janis Danisevskis's avatar Janis Danisevskis
Browse files

Keystore 2.0 SPI: Update KeyInfo and KeyGenParameterSpec 

This patch adds set/getSecurityLevel to KeyInfo and KeyGenParameterSpec
and it deprecates the superseded function isInSecureHardware.

It also deprecates the system API set/getUid and replaces it with the
more generic set/getNamespace.

Test: None
Change-Id: Id2f54596510954862b5077a935f3daf07211f29c
parent 145e11ff

api/current.txt

+2 −1
Original line number Diff line number Diff line
@@ -42808,10 +42808,11 @@ package android.security.keystore { 
    method public String getKeystoreAlias();

    method public int getOrigin();

    method public int getPurposes();

    method public int getSecurityLevel();

    method @NonNull public String[] getSignaturePaddings();

    method public int getUserAuthenticationType();

    method public int getUserAuthenticationValidityDurationSeconds();

    method public boolean isInsideSecureHardware();

    method @Deprecated public boolean isInsideSecureHardware();

    method public boolean isInvalidatedByBiometricEnrollment();

    method public boolean isTrustedUserPresenceRequired();

    method public boolean isUserAuthenticationRequired();

api/system-current.txt

+6 −1
Original line number Diff line number Diff line
@@ -9374,8 +9374,13 @@ package android.security.keystore { 
    ctor public DeviceIdAttestationException(@Nullable String, @Nullable Throwable);

  }













  public final class KeyGenParameterSpec implements java.security.spec.AlgorithmParameterSpec {













    method public int getNamespace();













  }



























  public static final class KeyGenParameterSpec.Builder {













    method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUid(int);













    method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setNamespace(int);













    method @Deprecated @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUid(int);















  }





























}

























core/api/current.txt



+2
−1




























Original line number
Diff line number
Diff line








@@ -40976,10 +40976,11 @@ package android.security.keystore {













    method public String getKeystoreAlias();















    method public int getOrigin();















    method public int getPurposes();













    method public int getSecurityLevel();















    method @NonNull public String[] getSignaturePaddings();















    method public int getUserAuthenticationType();















    method public int getUserAuthenticationValidityDurationSeconds();













    method public boolean isInsideSecureHardware();













    method @Deprecated public boolean isInsideSecureHardware();















    method public boolean isInvalidatedByBiometricEnrollment();















    method public boolean isTrustedUserPresenceRequired();















    method public boolean isUserAuthenticationRequired();

























core/api/system-current.txt



+6
−1




























Original line number
Diff line number
Diff line








@@ -8256,8 +8256,13 @@ package android.security.keystore {













    ctor public DeviceIdAttestationException(@Nullable String, @Nullable Throwable);















  }



























  public final class KeyGenParameterSpec implements java.security.spec.AlgorithmParameterSpec {













    method public int getNamespace();













  }



























  public static final class KeyGenParameterSpec.Builder {













    method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUid(int);













    method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setNamespace(int);













    method @Deprecated @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUid(int);















  }





























}

























keystore/java/android/security/keystore/AndroidKeyStoreProvider.java



+26
−0




























Original line number
Diff line number
Diff line








@@ -23,6 +23,7 @@ import android.security.KeyStore;













import android.security.keymaster.ExportResult;















import android.security.keymaster.KeyCharacteristics;















import android.security.keymaster.KeymasterDefs;













import android.sysprop.Keystore2Properties;































import java.io.IOException;















import java.security.KeyFactory;










@@ -111,6 +112,26 @@ public class AndroidKeyStoreProvider extends Provider {













        putSecretKeyFactoryImpl("HmacSHA512");















    }





























    private static boolean sKeystore2Enabled;



























    /**













     * This function indicates whether or not Keystore 2.0 is enabled. Some parts of the













     * Keystore SPI must behave subtly differently when Keystore 2.0 is enabled. However,













     * the platform property that indicates that Keystore 2.0 is enabled is not readable













     * by applications. So we set this value when {@code install()} is called because it













     * is called by zygote, which can access Keystore2Properties.













     *













     * This function can be removed once the transition to Keystore 2.0 is complete.













     * b/171305684













     *













     * @return true if Keystore 2.0 is enabled.













     * @hide













     */













    public static boolean isKeystore2Enabled() {













        return sKeystore2Enabled;













    }











































    /**















     * Installs a new instance of this provider (and the















     * {@link AndroidKeyStoreBCWorkaroundProvider}).










@@ -138,6 +159,11 @@ public class AndroidKeyStoreProvider extends Provider {













            // priority.















            Security.addProvider(workaroundProvider);















        }



























        // {@code install()} is run by zygote when this property is still accessible. We store its













        // value so that the Keystore SPI can act accordingly without having to access an internal













        // property.













        sKeystore2Enabled = Keystore2Properties.keystore2_enabled().orElse(false);















    }































    private void putSecretKeyFactoryImpl(String algorithm) {