Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ffee7d8c authored by Treehugger Robot's avatar Treehugger Robot Committed by Gerrit Code Review
Browse files

Merge "Adding check for HMAC/EC key size for StrongBox"

parents 7d615aae d255a213

keystore/java/android/security/keystore/AndroidKeyStoreKeyGeneratorSpi.java

+4 −0
Original line number Diff line number Diff line
@@ -210,6 +210,10 @@ public abstract class AndroidKeyStoreKeyGeneratorSpi extends KeyGeneratorSpi { 
                        throw new InvalidAlgorithmParameterException(

                            "HMAC key size must be at least 64 bits.");

                    }

                    if (mKeySizeBits > 512 && spec.isStrongBoxBacked()) {

                        throw new InvalidAlgorithmParameterException(

                            "StrongBox HMAC key size must be smaller than 512 bits.");

                    }



                    // JCA HMAC key algorithm implies a digest (e.g., HmacSHA256 key algorithm

                    // implies SHA-256 digest). Because keymaster HMAC key is authorized only for

keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java

+10 −2
Original line number Diff line number Diff line
@@ -303,7 +303,7 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato 
            if (mKeySizeBits == -1) {

                mKeySizeBits = getDefaultKeySize(keymasterAlgorithm);

            }

            checkValidKeySize(keymasterAlgorithm, mKeySizeBits);

            checkValidKeySize(keymasterAlgorithm, mKeySizeBits, mSpec.isStrongBoxBacked());



            if (spec.getKeystoreAlias() == null) {

                throw new InvalidAlgorithmParameterException("KeyStore entry alias not provided");
@@ -724,10 +724,18 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato 
        }

    }



    private static void checkValidKeySize(int keymasterAlgorithm, int keySize)

    private static void checkValidKeySize(

            int keymasterAlgorithm,

            int keySize,

            boolean isStrongBoxBacked)

            throws InvalidAlgorithmParameterException {

        switch (keymasterAlgorithm) {

            case KeymasterDefs.KM_ALGORITHM_EC:

                if (isStrongBoxBacked && keySize != 256) {

                    throw new InvalidAlgorithmParameterException(

                            "Unsupported StrongBox EC key size: "

                            + keySize + " bits. Supported: 256");

                }

                if (!SUPPORTED_EC_NIST_CURVE_SIZES.contains(keySize)) {

                    throw new InvalidAlgorithmParameterException("Unsupported EC key size: "

                            + keySize + " bits. Supported: " + SUPPORTED_EC_NIST_CURVE_SIZES);