Merge "Keymint: Add CERTIFICATE_* tags required for certificate generation." (2679ad6f) · Commits · e / os / android_hardware_interfaces

security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/ErrorCode.aidl

+2 −0

Original line number	Diff line number	Diff line
		@@ -111,6 +111,8 @@ enum ErrorCode {
		STORAGE_KEY_UNSUPPORTED = -77,
		INCOMPATIBLE_MGF_DIGEST = -78,
		UNSUPPORTED_MGF_DIGEST = -79,
		MISSING_NOT_BEFORE = -80,
		MISSING_NOT_AFTER = -81,
		UNIMPLEMENTED = -100,
		VERSION_MISMATCH = -101,
		UNKNOWN_ERROR = -1000,

security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/Tag.aidl

+4 −0

Original line number	Diff line number	Diff line
		@@ -94,4 +94,8 @@ enum Tag {
		MAC_LENGTH = 805307371,
		RESET_SINCE_ID_ROTATION = 1879049196,
		CONFIRMATION_TOKEN = -1879047187,
		CERTIFICATE_SERIAL = -2147482642,
		CERTIFICATE_SUBJECT = -1879047185,
		CERTIFICATE_NOT_BEFORE = 1610613744,
		CERTIFICATE_NOT_AFTER = 1610613745,
		}

security/keymint/aidl/android/hardware/security/keymint/ErrorCode.aidl

+3 −1

Original line number	Diff line number	Diff line
		@@ -101,6 +101,8 @@ enum ErrorCode {
		STORAGE_KEY_UNSUPPORTED = -77,
		INCOMPATIBLE_MGF_DIGEST = -78,
		UNSUPPORTED_MGF_DIGEST = -79,
		MISSING_NOT_BEFORE = -80,
		MISSING_NOT_AFTER = -81,

		UNIMPLEMENTED = -100,
		VERSION_MISMATCH = -101,

security/keymint/aidl/android/hardware/security/keymint/Tag.aidl

+31 −0

Original line number	Diff line number	Diff line
		@@ -933,4 +933,35 @@ enum Tag {
		* Must never appear in KeyCharacteristics.
		*/
		CONFIRMATION_TOKEN = (9 << 28) /* TagType:BYTES */ \| 1005,

		/**
		* Tag::CERTIFICATE_SERIAL specifies the serial number to be assigned to the
		* attestation certificate to be generated for the given key. This parameter should only
		* be passed to keyMint in the attestation parameters during generateKey() and importKey().
		*/
		CERTIFICATE_SERIAL = (8 << 28) /* TagType:BIGNUM */ \| 1006,

		/**
		* Tag::CERTIFICATE_SUBJECT the certificate subject. The value is a DER encoded X509 NAME.
		* This value is used when generating a self signed certificates. This tag may be specified
		* during generateKey and importKey. If not provided the subject name shall default to
		* <TODO default subject here>.
		*/
		CERTIFICATE_SUBJECT = (9 << 28) /* TagType:BYTES */ \| 1007,

		/**
		* Tag::CERTIFICATE_NOT_BEFORE the beginning of the validity of the certificate in UNIX epoch
		* time in seconds. This value is used when generating attestation or self signed certificates.
		* ErrorCode::MISSING_NOT_BEFORE must be returned if this tag is not provided if this tag is
		* not provided to generateKey or importKey.
		*/
		CERTIFICATE_NOT_BEFORE = (6 << 28) /* TagType:DATE */ \| 1008,

		/**
		* Tag::CERTIFICATE_NOT_AFTER the end of the validity of the certificate in UNIX epoch
		* time in seconds. This value is used when generating attestation or self signed certificates.
		* ErrorCode::MISSING_NOT_AFTER must be returned if this tag is not provided to generateKey
		* or importKey.
		*/
		CERTIFICATE_NOT_AFTER = (6 << 28) /* TagType:DATE */ \| 1009,
		}

security/keymint/support/include/keymint_support/keymint_tags.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -126,6 +126,10 @@ DECLARE_TYPED_TAG(USER_ID);
		DECLARE_TYPED_TAG(USER_SECURE_ID);
		DECLARE_TYPED_TAG(VENDOR_PATCHLEVEL);
		DECLARE_TYPED_TAG(RSA_OAEP_MGF_DIGEST);
		DECLARE_TYPED_TAG(CERTIFICATE_SERIAL);
		DECLARE_TYPED_TAG(CERTIFICATE_SUBJECT);
		DECLARE_TYPED_TAG(CERTIFICATE_NOT_BEFORE);
		DECLARE_TYPED_TAG(CERTIFICATE_NOT_AFTER);

		#undef DECLARE_TYPED_TAG