Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fbb369e2 authored by Karuna Wadhera's avatar Karuna Wadhera
Browse files

MODULE_HASH documentation 

Bug: 369375199
Test: builds
Change-Id: If4a0be1314c0a98409b2fd0289d099a45120ce33
parent e7ae25fc

core/java/android/content/pm/PackageManager.java

+2 −0
Original line number Diff line number Diff line
@@ -4614,6 +4614,7 @@ public abstract class PackageManager { 
     * the Android Keystore backed by an isolated execution environment. The version indicates

     * which features are implemented in the isolated execution environment:

     * <ul>

     * <li>400: Inclusion of module information (via tag MODULE_HASH) in the attestation record.

     * <li>300: Ability to include a second IMEI in the ID attestation record, see

     * {@link android.app.admin.DevicePolicyManager#ID_TYPE_IMEI}.

     * <li>200: Hardware support for Curve 25519 (including both Ed25519 signature generation and
@@ -4647,6 +4648,7 @@ public abstract class PackageManager { 
     * StrongBox</a>. If this feature has a version, the version number indicates which features are

     * implemented in StrongBox:

     * <ul>

     * <li>400: Inclusion of module information (via tag MODULE_HASH) in the attestation record.

     * <li>300: Ability to include a second IMEI in the ID attestation record, see

     * {@link android.app.admin.DevicePolicyManager#ID_TYPE_IMEI}.

     * <li>200: No new features for StrongBox (the Android Keystore environment backed by an

keystore/java/android/security/keystore/KeyStoreManager.java

+4 −2
Original line number Diff line number Diff line
@@ -312,9 +312,11 @@ public final class KeyStoreManager { 
     * When passed into getSupplementaryAttestationInfo, getSupplementaryAttestationInfo returns the

     * DER-encoded structure corresponding to the `Modules` schema described in the KeyMint HAL's

     * KeyCreationResult.aidl. The SHA-256 hash of this encoded structure is what's included with

     * the tag in attestations.

     * the tag in attestations. To ensure the returned encoded structure is the one attested to,

     * clients should verify its SHA-256 hash matches the one in the attestation. Note that the

     * returned structure can vary between boots.

     */

    // TODO(b/369375199): Replace with Tag.MODULE_HASH when flagging is removed.

    // TODO(b/380020528): Replace with Tag.MODULE_HASH when KeyMint V4 is frozen.

    public static final int MODULE_HASH = TagType.BYTES | 724;



    /**