Merge changes Ibfb6a54c,Ifa0f95fd am: 4af9762ef7 (1eb867fc) · Commits · e / os / android_hardware_interfaces

security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl

+3 −1

Original line number	Diff line number	Diff line
		@@ -96,7 +96,9 @@ import android.hardware.security.secureclock.TimeStampToken;
		* - TRUSTED_ENVRIONMENT IKeyMintDevices must support curve 25519 for Purpose::SIGN (Ed25519,
		* as specified in RFC 8032), Purpose::ATTEST_KEY (Ed25519) or for KeyPurpose::AGREE_KEY
		* (X25519, as specified in RFC 7748). However, a key must have exactly one of these
		* purpose values; the same key cannot be used for multiple purposes.
		* purpose values; the same key cannot be used for multiple purposes. Signing operations
		* (Purpose::SIGN) have a message size limit of 16 KiB; operations on messages longer than
		* this limit must fail with ErrorCode::INVALID_INPUT_LENGTH.
		* STRONGBOX IKeyMintDevices do not support curve 25519.
		*
		* o AES

security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp

+53 −4

Original line number	Diff line number	Diff line
		@@ -25,6 +25,7 @@
		#include <cppbor_parse.h>
		#include <cutils/properties.h>
		#include <gmock/gmock.h>
		#include <openssl/evp.h>
		#include <openssl/mem.h>
		#include <remote_prov/remote_prov_utils.h>

		@@ -206,6 +207,21 @@ uint32_t KeyMintAidlTestBase::boot_patch_level() {
		return boot_patch_level(key_characteristics_);
		}

		bool KeyMintAidlTestBase::Curve25519Supported() {
		// Strongbox never supports curve 25519.
		if (SecLevel() == SecurityLevel::STRONGBOX) {
		return false;
		}

		// Curve 25519 was included in version 2 of the KeyMint interface.
		int32_t version = 0;
		auto status = keymint_->getInterfaceVersion(&version);
		if (!status.isOk()) {
		ADD_FAILURE() << "Failed to determine interface version";
		}
		return version >= 2;
		}

		ErrorCode KeyMintAidlTestBase::GetReturnErrorCode(const Status& result) {
		if (result.isOk()) return ErrorCode::OK;

		@@ -543,7 +559,12 @@ ErrorCode KeyMintAidlTestBase::Update(const string& input, string* output) {
		std::vector<uint8_t> o_put;
		result = op_->update(vector<uint8_t>(input.begin(), input.end()), {}, {}, &o_put);

		if (result.isOk()) output->append(o_put.begin(), o_put.end());
		if (result.isOk()) {
		output->append(o_put.begin(), o_put.end());
		} else {
		// Failure always terminates the operation.
		op_ = {};
		}

		return GetReturnErrorCode(result);
		}
		@@ -740,6 +761,19 @@ void KeyMintAidlTestBase::LocalVerifyMessage(const string& message, const string

		if (digest == Digest::NONE) {
		switch (EVP_PKEY_id(pub_key.get())) {
		case EVP_PKEY_ED25519: {
		ASSERT_EQ(64, signature.size());
		uint8_t pub_keydata[32];
		size_t pub_len = sizeof(pub_keydata);
		ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(pub_key.get(), pub_keydata, &pub_len));
		ASSERT_EQ(sizeof(pub_keydata), pub_len);
		ASSERT_EQ(1, ED25519_verify(reinterpret_cast<const uint8_t*>(message.data()),
		message.size(),
		reinterpret_cast<const uint8_t*>(signature.data()),
		pub_keydata));
		break;
		}

		case EVP_PKEY_EC: {
		vector<uint8_t> data((EVP_PKEY_bits(pub_key.get()) + 7) / 8);
		size_t data_size = std::min(data.size(), message.size());
		@@ -1166,16 +1200,31 @@ vector<PaddingMode> KeyMintAidlTestBase::InvalidPaddingModes(Algorithm algorithm
		vector<EcCurve> KeyMintAidlTestBase::ValidCurves() {
		if (securityLevel_ == SecurityLevel::STRONGBOX) {
		return {EcCurve::P_256};
		} else if (Curve25519Supported()) {
		return {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521,
		EcCurve::CURVE_25519};
		} else {
		return {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521};
		return {
		EcCurve::P_224,
		EcCurve::P_256,
		EcCurve::P_384,
		EcCurve::P_521,
		};
		}
		}

		vector<EcCurve> KeyMintAidlTestBase::InvalidCurves() {
		if (SecLevel() == SecurityLevel::STRONGBOX) {
		return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521};
		// Curve 25519 is not supported, either because:
		// - KeyMint v1: it's an unknown enum value
		// - KeyMint v2+: it's not supported by StrongBox.
		return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521, EcCurve::CURVE_25519};
		} else {
		if (Curve25519Supported()) {
		return {};
		} else {
		return {EcCurve::CURVE_25519};
		}
		}
		}

security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -80,6 +80,8 @@ class KeyMintAidlTestBase : public ::testing::TestWithParam<string> {
		uint32_t boot_patch_level(const vector<KeyCharacteristics>& key_characteristics);
		uint32_t boot_patch_level();

		bool Curve25519Supported();

		ErrorCode GetReturnErrorCode(const Status& result);

		ErrorCode GenerateKey(const AuthorizationSet& key_desc, vector<uint8_t>* key_blob,

security/keymint/aidl/vts/functional/KeyMintTest.cpp

+864 −78

File changed.

Preview size limit exceeded, changes collapsed.