Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3803a10f authored by David Drysdale's avatar David Drysdale
Browse files

[conflict] Merge "KeyMint VTS: cope with ATTEST_KEY +/- SIGN" into... 

[conflict] Merge "KeyMint VTS: cope with ATTEST_KEY +/- SIGN" into android12-tests-dev am: bbecb456

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2117528



Change-Id: I7d5a6e121c3dc1a73382713ef4af9d6ae08ae887
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 94755b90 bbecb456

security/keymint/aidl/vts/functional/AttestKeyTest.cpp

+112 −81
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


#define LOG_TAG "keymint_1_attest_key_test"

#include <cutils/log.h>

#include <cutils/properties.h>



#include <keymint_support/key_param_output.h>

#include <keymint_support/openssl_utils.h>
@@ -33,7 +34,33 @@ bool IsSelfSigned(const vector<Certificate>& chain) { 


}  // namespace



using AttestKeyTest = KeyMintAidlTestBase;

class AttestKeyTest : public KeyMintAidlTestBase {

  protected:

    ErrorCode GenerateAttestKey(const AuthorizationSet& key_desc,

                                const optional<AttestationKey>& attest_key,

                                vector<uint8_t>* key_blob,

                                vector<KeyCharacteristics>* key_characteristics,

                                vector<Certificate>* cert_chain) {

        // The original specification for KeyMint v1 required ATTEST_KEY not be combined

        // with any other key purpose, but the original VTS tests incorrectly did exactly that.

        // This means that a device that launched prior to Android T (API level 33) may

        // accept or even require KeyPurpose::SIGN too.

        if (property_get_int32("ro.board.first_api_level", 0) < 33) {

            AuthorizationSet key_desc_plus_sign = key_desc;

            key_desc_plus_sign.push_back(TAG_PURPOSE, KeyPurpose::SIGN);



            auto result = GenerateKey(key_desc_plus_sign, attest_key, key_blob, key_characteristics,

                                      cert_chain);

            if (result == ErrorCode::OK) {

                return result;

            }

            // If the key generation failed, it may be because the device is (correctly)

            // rejecting the combination of ATTEST_KEY+SIGN.  Fall through to try again with

            // just ATTEST_KEY.

        }

        return GenerateKey(key_desc, attest_key, key_blob, key_characteristics, cert_chain);

    }

};



/*

 * AttestKeyTest.AllRsaSizes
@@ -49,7 +76,8 @@ TEST_P(AttestKeyTest, AllRsaSizes) { 
        AttestationKey attest_key;

        vector<KeyCharacteristics> attest_key_characteristics;

        vector<Certificate> attest_key_cert_chain;

        ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()

        ASSERT_EQ(ErrorCode::OK,

                  GenerateAttestKey(AuthorizationSetBuilder()

                                            .RsaKey(size, 65537)

                                            .AttestKey()

                                            .SetDefaultValidity(),
@@ -199,7 +227,7 @@ TEST_P(AttestKeyTest, RsaAttestedAttestKeys) { 
    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    ASSERT_EQ(ErrorCode::OK,

              GenerateKey(AuthorizationSetBuilder()

              GenerateAttestKey(AuthorizationSetBuilder()

                                        .RsaKey(2048, 65537)

                                        .AttestKey()

                                        .AttestationChallenge(challenge)
@@ -298,7 +326,7 @@ TEST_P(AttestKeyTest, RsaAttestKeyChaining) { 
        }



        EXPECT_EQ(ErrorCode::OK,

                  GenerateKey(AuthorizationSetBuilder()

                  GenerateAttestKey(AuthorizationSetBuilder()

                                            .RsaKey(2048, 65537)

                                            .AttestKey()

                                            .AttestationChallenge("foo")
@@ -307,8 +335,8 @@ TEST_P(AttestKeyTest, RsaAttestKeyChaining) { 
                                            .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)

                                            .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                            .SetDefaultValidity(),

                              attest_key_opt, &key_blob_list[i], &attested_key_characteristics,

                              &cert_chain_list[i]));

                                    attest_key_opt, &key_blob_list[i],

                                    &attested_key_characteristics, &cert_chain_list[i]));



        AuthorizationSet hw_enforced = HwEnforcedAuthorizations(attested_key_characteristics);

        AuthorizationSet sw_enforced = SwEnforcedAuthorizations(attested_key_characteristics);
@@ -370,7 +398,7 @@ TEST_P(AttestKeyTest, EcAttestKeyChaining) { 
        }



        EXPECT_EQ(ErrorCode::OK,

                  GenerateKey(AuthorizationSetBuilder()

                  GenerateAttestKey(AuthorizationSetBuilder()

                                            .EcdsaKey(EcCurve::P_256)

                                            .AttestKey()

                                            .AttestationChallenge("foo")
@@ -379,8 +407,8 @@ TEST_P(AttestKeyTest, EcAttestKeyChaining) { 
                                            .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                            .Authorization(TAG_NO_AUTH_REQUIRED)

                                            .SetDefaultValidity(),

                              attest_key_opt, &key_blob_list[i], &attested_key_characteristics,

                              &cert_chain_list[i]));

                                    attest_key_opt, &key_blob_list[i],

                                    &attested_key_characteristics, &cert_chain_list[i]));



        AuthorizationSet hw_enforced = HwEnforcedAuthorizations(attested_key_characteristics);

        AuthorizationSet sw_enforced = SwEnforcedAuthorizations(attested_key_characteristics);
@@ -445,7 +473,7 @@ TEST_P(AttestKeyTest, AlternateAttestKeyChaining) { 


        if ((i & 0x1) == 1) {

            EXPECT_EQ(ErrorCode::OK,

                      GenerateKey(AuthorizationSetBuilder()

                      GenerateAttestKey(AuthorizationSetBuilder()

                                                .EcdsaKey(EcCurve::P_256)

                                                .AttestKey()

                                                .AttestationChallenge("foo")
@@ -454,11 +482,11 @@ TEST_P(AttestKeyTest, AlternateAttestKeyChaining) { 
                                                .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                                .Authorization(TAG_NO_AUTH_REQUIRED)

                                                .SetDefaultValidity(),

                                  attest_key_opt, &key_blob_list[i], &attested_key_characteristics,

                                  &cert_chain_list[i]));

                                        attest_key_opt, &key_blob_list[i],

                                        &attested_key_characteristics, &cert_chain_list[i]));

        } else {

            EXPECT_EQ(ErrorCode::OK,

                      GenerateKey(AuthorizationSetBuilder()

                      GenerateAttestKey(AuthorizationSetBuilder()

                                                .RsaKey(2048, 65537)

                                                .AttestKey()

                                                .AttestationChallenge("foo")
@@ -467,8 +495,8 @@ TEST_P(AttestKeyTest, AlternateAttestKeyChaining) { 
                                                .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)

                                                .Authorization(TAG_NO_AUTH_REQUIRED)

                                                .SetDefaultValidity(),

                                  attest_key_opt, &key_blob_list[i], &attested_key_characteristics,

                                  &cert_chain_list[i]));

                                        attest_key_opt, &key_blob_list[i],

                                        &attested_key_characteristics, &cert_chain_list[i]));

        }



        AuthorizationSet hw_enforced = HwEnforcedAuthorizations(attested_key_characteristics);
@@ -508,7 +536,8 @@ TEST_P(AttestKeyTest, MissingChallenge) { 
        AttestationKey attest_key;

        vector<KeyCharacteristics> attest_key_characteristics;

        vector<Certificate> attest_key_cert_chain;

        ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()

        ASSERT_EQ(ErrorCode::OK,

                  GenerateAttestKey(AuthorizationSetBuilder()

                                            .RsaKey(size, 65537)

                                            .AttestKey()

                                            .SetDefaultValidity(),
@@ -557,7 +586,7 @@ TEST_P(AttestKeyTest, AllEcCurves) { 
        vector<Certificate> attest_key_cert_chain;

        ASSERT_EQ(

                ErrorCode::OK,

                GenerateKey(

                GenerateAttestKey(

                        AuthorizationSetBuilder().EcdsaKey(curve).AttestKey().SetDefaultValidity(),

                        {} /* attestation signing key */, &attest_key.keyBlob,

                        &attest_key_characteristics, &attest_key_cert_chain));
@@ -670,7 +699,8 @@ TEST_P(AttestKeyTest, EcdsaAttestationID) { 
    AttestationKey attest_key;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()

    ASSERT_EQ(ErrorCode::OK,

              GenerateAttestKey(AuthorizationSetBuilder()

                                        .EcdsaKey(EcCurve::P_256)

                                        .AttestKey()

                                        .SetDefaultValidity(),
@@ -734,7 +764,8 @@ TEST_P(AttestKeyTest, EcdsaAttestationMismatchID) { 
    AttestationKey attest_key;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()

    ASSERT_EQ(ErrorCode::OK,

              GenerateAttestKey(AuthorizationSetBuilder()

                                        .EcdsaKey(EcCurve::P_256)

                                        .AttestKey()

                                        .SetDefaultValidity(),