Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f0d75f1 authored by David Drysdale's avatar David Drysdale Committed by Automerger Merge Worker
Browse files

Merge "KeyMint VTS: strict test only for v2+" am: d057fc0c 

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2033925

Change-Id: I18f6f997439f31ea4d2a95deffe318d07f9048b9
parents bbbc2783 d057fc0c

security/keymint/aidl/vts/functional/AttestKeyTest.cpp

+15 −0
Original line number Original line Diff line number Diff line
@@ -183,6 +183,14 @@ TEST_P(AttestKeyTest, AllRsaSizes) { 
 * This test attempts to create an RSA attestation key that also allows signing.

 * This test attempts to create an RSA attestation key that also allows signing.

 */

 */

TEST_P(AttestKeyTest, RsaAttestKeyMultiPurposeFail) {

TEST_P(AttestKeyTest, RsaAttestKeyMultiPurposeFail) {

    if (AidlVersion() < 2) {

        // The KeyMint v1 spec required that KeyPurpose::ATTEST_KEY not be combined

        // with other key purposes.  However, this was not checked at the time

        // so we can only be strict about checking this for implementations of KeyMint

        // version 2 and above.

        GTEST_SKIP() << "Single-purpose for KeyPurpose::ATTEST_KEY only strict since KeyMint v2";

    }



    vector<uint8_t> attest_key_blob;

    vector<uint8_t> attest_key_blob;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    vector<Certificate> attest_key_cert_chain;
@@ -453,6 +461,13 @@ TEST_P(AttestKeyTest, EcAttestKeyChaining) { 
 * This test attempts to create an EC attestation key that also allows signing.

 * This test attempts to create an EC attestation key that also allows signing.

 */

 */

TEST_P(AttestKeyTest, EcAttestKeyMultiPurposeFail) {

TEST_P(AttestKeyTest, EcAttestKeyMultiPurposeFail) {

    if (AidlVersion() < 2) {

        // The KeyMint v1 spec required that KeyPurpose::ATTEST_KEY not be combined

        // with other key purposes.  However, this was not checked at the time

        // so we can only be strict about checking this for implementations of KeyMint

        // version 2 and above.

        GTEST_SKIP() << "Single-purpose for KeyPurpose::ATTEST_KEY only strict since KeyMint v2";

    }

    vector<uint8_t> attest_key_blob;

    vector<uint8_t> attest_key_blob;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    vector<Certificate> attest_key_cert_chain;

security/keymint/aidl/vts/functional/KeyMintTest.cpp

+14 −0
Original line number Original line Diff line number Diff line
@@ -3821,6 +3821,13 @@ TEST_P(ImportKeyTest, RsaPublicExponentMismatch) { 
 * Verifies that importing an RSA key pair with purpose ATTEST_KEY+SIGN fails.

 * Verifies that importing an RSA key pair with purpose ATTEST_KEY+SIGN fails.

 */

 */

TEST_P(ImportKeyTest, RsaAttestMultiPurposeFail) {

TEST_P(ImportKeyTest, RsaAttestMultiPurposeFail) {

    if (AidlVersion() < 2) {

        // The KeyMint v1 spec required that KeyPurpose::ATTEST_KEY not be combined

        // with other key purposes.  However, this was not checked at the time

        // so we can only be strict about checking this for implementations of KeyMint

        // version 2 and above.

        GTEST_SKIP() << "Single-purpose for KeyPurpose::ATTEST_KEY only strict since KeyMint v2";

    }

    uint32_t key_size = 2048;

    uint32_t key_size = 2048;

    string key = rsa_2048_key;

    string key = rsa_2048_key;
@@ -3959,6 +3966,13 @@ TEST_P(ImportKeyTest, EcdsaCurveMismatch) { 
 * Verifies that importing and using an ECDSA P-256 key pair with purpose ATTEST_KEY+SIGN fails.

 * Verifies that importing and using an ECDSA P-256 key pair with purpose ATTEST_KEY+SIGN fails.

 */

 */

TEST_P(ImportKeyTest, EcdsaAttestMultiPurposeFail) {

TEST_P(ImportKeyTest, EcdsaAttestMultiPurposeFail) {

    if (AidlVersion() < 2) {

        // The KeyMint v1 spec required that KeyPurpose::ATTEST_KEY not be combined

        // with other key purposes.  However, this was not checked at the time

        // so we can only be strict about checking this for implementations of KeyMint

        // version 2 and above.

        GTEST_SKIP() << "Single-purpose for KeyPurpose::ATTEST_KEY only strict since KeyMint v2";

    }

    ASSERT_EQ(ErrorCode::INCOMPATIBLE_PURPOSE,

    ASSERT_EQ(ErrorCode::INCOMPATIBLE_PURPOSE,

              ImportKey(AuthorizationSetBuilder()

              ImportKey(AuthorizationSetBuilder()

                                .Authorization(TAG_NO_AUTH_REQUIRED)

                                .Authorization(TAG_NO_AUTH_REQUIRED)