Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ae0b0d4 authored by Android Build Coastguard Worker's avatar Android Build Coastguard Worker
Browse files

Snap for 7546365 from 17ae17af to sc-v2-release

Change-Id: I1a3cba3fc1fc95724f0744bb313c64c592667111
parents a2fa4a42 17ae17af
Loading
Loading
Loading
Loading
+13 −3
Original line number Diff line number Diff line
@@ -831,11 +831,21 @@ enum Tag {
    /**
     * DEVICE_UNIQUE_ATTESTATION is an argument to IKeyMintDevice::attested key generation/import
     * operations.  It indicates that attestation using a device-unique key is requested, rather
     * than a batch key.  When a device-unique key is used, the returned chain should contain two
     * certificates:
     * than a batch key. When a device-unique key is used, the returned chain contains two or
     * three certificates.
     *
     * In case the chain contains two certificates, they should be:
     *    * The attestation certificate, containing the attestation extension, as described in
            KeyCreationResult.aidl.
     *      KeyCreationResult.aidl.
     *    * A self-signed root certificate, signed by the device-unique key.
     *
     * In case the chain contains three certificates, they should be:
     *    * The attestation certificate, containing the attestation extension, as described in
     *      KeyCreationResult.aidl, signed by the device-unique key.
     *    * An intermediate certificate, containing the public portion of the device-unique key.
     *    * A self-signed root certificate, signed by a dedicated key, certifying the
     *      intermediate.
     *
     * No additional chained certificates are provided. Only SecurityLevel::STRONGBOX
     * IKeyMintDevices may support device-unique attestations.  SecurityLevel::TRUSTED_ENVIRONMENT
     * IKeyMintDevices must return ErrorCode::INVALID_ARGUMENT if they receive
+9 −4
Original line number Diff line number Diff line
@@ -40,11 +40,16 @@ class DeviceUniqueAttestationTest : public KeyMintAidlTestBase {

        AuthorizationSet crypto_params = SecLevelAuthorizations(key_characteristics);

        // The device-unique attestation chain should contain exactly two certificates:
        // The device-unique attestation chain should contain exactly three certificates:
        // * The leaf with the attestation extension.
        // * A self-signed root, signed using the device-unique key.
        ASSERT_EQ(cert_chain_.size(), 2);
        EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_));
        // * An intermediate, signing the leaf using the device-unique key.
        // * A self-signed root, signed using some authority's key, certifying
        //   the device-unique key.
        const size_t chain_length = cert_chain_.size();
        ASSERT_TRUE(chain_length == 2 || chain_length == 3);
        // TODO(b/191361618): Once StrongBox implementations use a correctly-issued
        // certificate chain, do not skip issuers matching.
        EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_, /* strict_issuer_check= */ false));

        AuthorizationSet sw_enforced = SwEnforcedAuthorizations(key_characteristics);
        EXPECT_TRUE(verify_attestation_record("challenge", "foo", sw_enforced, hw_enforced,
+3 −2
Original line number Diff line number Diff line
@@ -1493,7 +1493,8 @@ AuthorizationSet SwEnforcedAuthorizations(const vector<KeyCharacteristics>& key_
    return authList;
}

AssertionResult ChainSignaturesAreValid(const vector<Certificate>& chain) {
AssertionResult ChainSignaturesAreValid(const vector<Certificate>& chain,
                                        bool strict_issuer_check) {
    std::stringstream cert_data;

    for (size_t i = 0; i < chain.size(); ++i) {
@@ -1520,7 +1521,7 @@ AssertionResult ChainSignaturesAreValid(const vector<Certificate>& chain) {

        string cert_issuer = x509NameToStr(X509_get_issuer_name(key_cert.get()));
        string signer_subj = x509NameToStr(X509_get_subject_name(signing_cert.get()));
        if (cert_issuer != signer_subj) {
        if (cert_issuer != signer_subj && strict_issuer_check) {
            return AssertionFailure() << "Cert " << i << " has wrong issuer.\n"
                                      << " Signer subject is " << signer_subj
                                      << " Issuer subject is " << cert_issuer << endl
+2 −1
Original line number Diff line number Diff line
@@ -349,7 +349,8 @@ void p256_pub_key(const vector<uint8_t>& coseKeyData, EVP_PKEY_Ptr* signingKey);

AuthorizationSet HwEnforcedAuthorizations(const vector<KeyCharacteristics>& key_characteristics);
AuthorizationSet SwEnforcedAuthorizations(const vector<KeyCharacteristics>& key_characteristics);
::testing::AssertionResult ChainSignaturesAreValid(const vector<Certificate>& chain);
::testing::AssertionResult ChainSignaturesAreValid(const vector<Certificate>& chain,
                                                   bool strict_issuer_check = true);

#define INSTANTIATE_KEYMINT_AIDL_TEST(name)                                          \
    INSTANTIATE_TEST_SUITE_P(PerInstance, name,                                      \
+4 −6
Original line number Diff line number Diff line
@@ -1487,9 +1487,8 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationTags) {
            tag.tag == TAG_ROLLBACK_RESISTANCE) {
            continue;
        }
        if (result == ErrorCode::UNSUPPORTED_TAG &&
            (tag.tag == TAG_ALLOW_WHILE_ON_BODY || tag.tag == TAG_TRUSTED_USER_PRESENCE_REQUIRED)) {
            // Optional tag not supported by this KeyMint implementation.
        if (result == ErrorCode::UNSUPPORTED_TAG && tag.tag == TAG_TRUSTED_USER_PRESENCE_REQUIRED) {
            // Tag not required to be supported by all KeyMint implementations.
            continue;
        }
        ASSERT_EQ(result, ErrorCode::OK);
@@ -1501,9 +1500,8 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationTags) {

        AuthorizationSet hw_enforced = HwEnforcedAuthorizations(key_characteristics);
        AuthorizationSet sw_enforced = SwEnforcedAuthorizations(key_characteristics);
        if (tag.tag != TAG_ATTESTATION_APPLICATION_ID) {
            // Expect to find most of the extra tags in the key characteristics
            // of the generated key (but not for ATTESTATION_APPLICATION_ID).
        // Some tags are optional, so don't require them to be in the enforcements.
        if (tag.tag != TAG_ATTESTATION_APPLICATION_ID && tag.tag != TAG_ALLOW_WHILE_ON_BODY) {
            EXPECT_TRUE(hw_enforced.Contains(tag.tag) || sw_enforced.Contains(tag.tag))
                    << tag << " not in hw:" << hw_enforced << " nor sw:" << sw_enforced;
        }