Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 34a71394 authored by Treehugger Robot's avatar Treehugger Robot Committed by Gerrit Code Review
Browse files

Merge changes from topic "keymint_aidl_impl" 

* changes:
  Vts tests for earlyBoot and deviceLocked functionality. Test: atest VtsAidlKeyMintTargetTest Bug: b/171287439.
  The aidl changes related to device locked, entryBootEnded and hw info. Test: atest VtsAidlKeyMintTargetTest Bug: b/178222844, 179062062
parents 9717a37b 9ea6a0ad

security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/IKeyMintDevice.aidl

+2 −0
Original line number Diff line number Diff line
@@ -43,5 +43,7 @@ interface IKeyMintDevice { 
  void deleteAllKeys();

  void destroyAttestationIds();

  android.hardware.security.keymint.BeginResult begin(in android.hardware.security.keymint.KeyPurpose inPurpose, in byte[] inKeyBlob, in android.hardware.security.keymint.KeyParameter[] inParams, in android.hardware.security.keymint.HardwareAuthToken inAuthToken);

  void deviceLocked(in boolean passwordOnly, in @nullable android.hardware.security.secureclock.TimeStampToken timestampToken);

  void earlyBootEnded();

  const int AUTH_TOKEN_MAC_LENGTH = 32;

}

security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/KeyMintHardwareInfo.aidl

+1 −0
Original line number Diff line number Diff line
@@ -37,4 +37,5 @@ parcelable KeyMintHardwareInfo { 
  android.hardware.security.keymint.SecurityLevel securityLevel;

  @utf8InCpp String keyMintName;

  @utf8InCpp String keyMintAuthorName;

  boolean timestampTokenRequired;

}

security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl

+47 −13
Original line number Diff line number Diff line
@@ -22,10 +22,11 @@ import android.hardware.security.keymint.HardwareAuthToken; 
import android.hardware.security.keymint.IKeyMintOperation;

import android.hardware.security.keymint.KeyCreationResult;

import android.hardware.security.keymint.KeyFormat;

import android.hardware.security.keymint.KeyParameter;

import android.hardware.security.keymint.KeyMintHardwareInfo;

import android.hardware.security.keymint.KeyParameter;

import android.hardware.security.keymint.KeyPurpose;

import android.hardware.security.keymint.SecurityLevel;

import android.hardware.security.secureclock.TimeStampToken;



/**

 * KeyMint device definition.
@@ -346,8 +347,8 @@ interface IKeyMintDevice { 
     *

     * @return The result of key creation.  See KeyCreationResult.aidl.

     */

    KeyCreationResult importKey(in KeyParameter[] keyParams, in KeyFormat keyFormat,

                                in byte[] keyData);

    KeyCreationResult importKey(

            in KeyParameter[] keyParams, in KeyFormat keyFormat, in byte[] keyData);



    /**

     * Securely imports a key, or key pair, returning a key blob and a description of the imported
@@ -429,11 +430,8 @@ interface IKeyMintDevice { 
     *

     * @return The result of key creation.  See KeyCreationResult.aidl.

     */

     KeyCreationResult importWrappedKey(in byte[] wrappedKeyData,

                                        in byte[] wrappingKeyBlob,

                                        in byte[] maskingKey,

                                        in KeyParameter[] unwrappingParams,

                                        in long passwordSid,

    KeyCreationResult importWrappedKey(in byte[] wrappedKeyData, in byte[] wrappingKeyBlob,

            in byte[] maskingKey, in KeyParameter[] unwrappingParams, in long passwordSid,

            in long biometricSid);



    /**
@@ -705,8 +703,44 @@ interface IKeyMintDevice { 
     *         from operations that generate an IV or nonce, and IKeyMintOperation object pointer

     *         which is used to perform update(), finish() or abort() operations.

     */

    BeginResult begin(in KeyPurpose inPurpose,

               in byte[] inKeyBlob,

               in KeyParameter[] inParams,

    BeginResult begin(in KeyPurpose inPurpose, in byte[] inKeyBlob, in KeyParameter[] inParams,

            in HardwareAuthToken inAuthToken);



    /**

     * Called by client to notify the IKeyMintDevice that the device is now locked, and keys with

     * the UNLOCKED_DEVICE_REQUIRED tag should no longer be usable.  When this function is called,

     * the IKeyMintDevice should note the current timestamp, and attempts to use

     * UNLOCKED_DEVICE_REQUIRED keys must be rejected with Error::DEVICE_LOCKED until an

     * authentication token with a later timestamp is presented.  If the `passwordOnly' argument is

     * set to true the sufficiently-recent authentication token must indicate that the user

     * authenticated with a password, not a biometric.

     *

     * Note that the IKeyMintDevice UNLOCKED_DEVICE_REQUIRED semantics are slightly different from

     * the UNLOCKED_DEVICE_REQUIRED semantics enforced by keystore.  Keystore handles device locking

     * on a per-user basis.  Because auth tokens do not contain an Android user ID, it's not

     * possible to replicate the keystore enformcement logic in IKeyMintDevice.  So from the

     * IKeyMintDevice perspective, any user unlock unlocks all UNLOCKED_DEVICE_REQUIRED keys.

     * Keystore will continue enforcing the per-user device locking.

     *

     * @param passwordOnly specifies whether the device must be unlocked with a password, rather

     * than a biometric, before UNLOCKED_DEVICE_REQUIRED keys can be used.

     *

     * @param timestampToken is used by StrongBox implementations of IKeyMintDevice.  It

     * provides the StrongBox IKeyMintDevice with a fresh, MACed timestamp which it can use as the

     * device-lock time, for future comparison against auth tokens when operations using

     * UNLOCKED_DEVICE_REQUIRED keys are attempted.  Unless the auth token timestamp is newer than

     * the timestamp in the timestampToken, the device is still considered to be locked.

     * Crucially, if a StrongBox IKeyMintDevice receives a deviceLocked() call with a timestampToken

     * timestamp that is less than the timestamp in the last deviceLocked() call, it must ignore the

     * new timestamp.  TEE IKeyMintDevice implementations will receive an empty timestampToken (zero

     * values and empty vectors) and should use their own clock as the device-lock time.

     */

    void deviceLocked(in boolean passwordOnly, in @nullable TimeStampToken timestampToken);



    /**

     * Called by client to notify the IKeyMintDevice that the device has left the early boot

     * state, and that keys with the EARLY_BOOT_ONLY tag may no longer be used.  All attempts to use

     * an EARLY_BOOT_ONLY key after this method is called must fail with Error::INVALID_KEY_BLOB.

     */

    void earlyBootEnded();

}

security/keymint/aidl/android/hardware/security/keymint/KeyMintHardwareInfo.aidl

+7 −0
Original line number Diff line number Diff line
@@ -45,4 +45,11 @@ parcelable KeyMintHardwareInfo { 
     *         same author.

     */

    @utf8InCpp String keyMintAuthorName;



    /* The timestampTokenRequired is a boolean flag, which when true reflects that IKeyMintDevice

     * instance will expect a valid TimeStampToken with various operations. This will typically

     * required by the StrongBox implementations that generally don't have secure clock hardware to

     * generate timestamp tokens.

     */

    boolean timestampTokenRequired;

}

security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp

+58 −1
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ using std::optional; 
namespace test {



namespace {



typedef KeyMintAidlTestBase::KeyData KeyData;

// Predicate for testing basic characteristics validity in generation or import.

bool KeyCharacteristicsBasicallyValid(SecurityLevel secLevel,

                                      const vector<KeyCharacteristics>& key_characteristics) {
@@ -461,6 +461,34 @@ void KeyMintAidlTestBase::AbortIfNeeded() { 
    }

}



auto KeyMintAidlTestBase::ProcessMessage(const vector<uint8_t>& key_blob, KeyPurpose operation,

                                         const string& message, const AuthorizationSet& in_params)

        -> std::tuple<ErrorCode, string, AuthorizationSet /* out_params */> {

    AuthorizationSet begin_out_params;

    ErrorCode result = Begin(operation, key_blob, in_params, &begin_out_params);

    AuthorizationSet out_params(std::move(begin_out_params));

    if (result != ErrorCode::OK) {

        return {result, {}, out_params};

    }



    string output;

    int32_t consumed = 0;

    AuthorizationSet update_params;

    AuthorizationSet update_out_params;

    result = Update(update_params, message, &update_out_params, &output, &consumed);

    out_params.push_back(update_out_params);

    if (result != ErrorCode::OK) {

        return {result, output, out_params};

    }



    string unused;

    AuthorizationSet finish_params;

    AuthorizationSet finish_out_params;

    result = Finish(finish_params, message.substr(consumed), unused, &finish_out_params, &output);

    out_params.push_back(finish_out_params);

    return {result, output, out_params};

}



string KeyMintAidlTestBase::ProcessMessage(const vector<uint8_t>& key_blob, KeyPurpose operation,

                                           const string& message, const AuthorizationSet& in_params,

                                           AuthorizationSet* out_params) {
@@ -859,6 +887,35 @@ AuthorizationSet KeyMintAidlTestBase::SwEnforcedAuthorizations( 
    return authList;

}



ErrorCode KeyMintAidlTestBase::UseAesKey(const vector<uint8_t>& aesKeyBlob) {

    auto [result, ciphertext, out_params] = ProcessMessage(

            aesKeyBlob, KeyPurpose::ENCRYPT, "1234567890123456",

            AuthorizationSetBuilder().BlockMode(BlockMode::ECB).Padding(PaddingMode::NONE));

    return result;

}



ErrorCode KeyMintAidlTestBase::UseHmacKey(const vector<uint8_t>& hmacKeyBlob) {

    auto [result, mac, out_params] = ProcessMessage(

            hmacKeyBlob, KeyPurpose::SIGN, "1234567890123456",

            AuthorizationSetBuilder().Authorization(TAG_MAC_LENGTH, 128).Digest(Digest::SHA_2_256));

    return result;

}



ErrorCode KeyMintAidlTestBase::UseRsaKey(const vector<uint8_t>& rsaKeyBlob) {

    std::string message(2048 / 8, 'a');

    auto [result, signature, out_params] = ProcessMessage(

            rsaKeyBlob, KeyPurpose::SIGN, message,

            AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE));

    return result;

}



ErrorCode KeyMintAidlTestBase::UseEcdsaKey(const vector<uint8_t>& ecdsaKeyBlob) {

    auto [result, signature, out_params] =

            ProcessMessage(ecdsaKeyBlob, KeyPurpose::SIGN, "a",

                           AuthorizationSetBuilder().Digest(Digest::SHA_2_256));

    return result;

}



}  // namespace test



}  // namespace aidl::android::hardware::security::keymint