Merge "Enable per-use user authenticated keys to be used." into mnc-dev (f0abe000) · Commits · e / os / android_frameworks_base

keystore/java/android/security/KeyStore.java

+3 −0

Original line number	Diff line number	Diff line
		@@ -543,6 +543,8 @@ public class KeyStore {
		return new KeyStoreException(errorCode, "Key not found");
		case VALUE_CORRUPTED:
		return new KeyStoreException(errorCode, "Key blob corrupted");
		case OP_AUTH_NEEDED:
		return new KeyStoreException(errorCode, "Operation requires authorization");
		default:
		return new KeyStoreException(errorCode, String.valueOf(errorCode));
		}
		@@ -572,6 +574,7 @@ public class KeyStore {
		case KeymasterDefs.KM_ERROR_KEY_NOT_YET_VALID:
		return new KeyNotYetValidException();
		case KeymasterDefs.KM_ERROR_KEY_USER_NOT_AUTHENTICATED:
		case OP_AUTH_NEEDED:
		{
		// We now need to determine whether the key/operation can become usable if user
		// authentication is performed, or whether it can never become usable again.

+4 −1

Original line number	Diff line number	Diff line
		@@ -298,7 +298,8 @@ public abstract class KeyStoreCipherSpi extends CipherSpi implements KeyStoreCry
		mAdditionalEntropyForBegin = null;
		if (opResult == null) {
		throw new KeyStoreConnectException();
		} else if (opResult.resultCode != KeyStore.NO_ERROR) {
		} else if ((opResult.resultCode != KeyStore.NO_ERROR)
		&& (opResult.resultCode != KeyStore.OP_AUTH_NEEDED)) {
		switch (opResult.resultCode) {
		case KeymasterDefs.KM_ERROR_INVALID_NONCE:
		throw new InvalidAlgorithmParameterException("Invalid IV");
		@@ -309,6 +310,8 @@ public abstract class KeyStoreCipherSpi extends CipherSpi implements KeyStoreCry
		if (opResult.token == null) {
		throw new IllegalStateException("Keystore returned null operation token");
		}
		// The operation handle/token is now either valid for use immediately or needs to be
		// authorized through user authentication (if the error code was OP_AUTH_NEEDED).
		mOperationToken = opResult.token;
		mOperationHandle = opResult.operationHandle;
		loadAlgorithmSpecificParametersFromBeginResult(keymasterOutputArgs);

+5 −1

Original line number	Diff line number	Diff line
		@@ -168,12 +168,16 @@ public abstract class KeyStoreHmacSpi extends MacSpi implements KeyStoreCryptoOp
		new KeymasterArguments());
		if (opResult == null) {
		throw new KeyStoreConnectException();
		} else if (opResult.resultCode != KeyStore.NO_ERROR) {
		} else if ((opResult.resultCode != KeyStore.NO_ERROR)
		&& (opResult.resultCode != KeyStore.OP_AUTH_NEEDED)) {
		throw mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode);
		}

		if (opResult.token == null) {
		throw new IllegalStateException("Keystore returned null operation token");
		}
		// The operation handle/token is now either valid for use immediately or needs to be
		// authorized through user authentication (if the error code was OP_AUTH_NEEDED).
		mOperationToken = opResult.token;
		mOperationHandle = opResult.operationHandle;
		mChunkedStreamer = new KeyStoreCryptoOperationChunkedStreamer(