Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ae9bcd1 authored by David Drysdale's avatar David Drysdale Committed by Automerger Merge Worker
Browse files

Merge "KeyMint HAL: clarify leaf cert requirements" am: 824c5d8f am:... 

Merge "KeyMint HAL: clarify leaf cert requirements" am: 824c5d8f am: ac42d601 am: a25bb1ce am: 7cda119c

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2154073



Change-Id: I4516fbb5a36d8446b39ed7a574333e8969936fe3
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 9f7fcb82 7cda119c

security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl

+3 −3
Original line number Diff line number Diff line
@@ -99,8 +99,7 @@ parcelable KeyCreationResult { 
     * X.509 certificates ordered such that each certificate is signed by the subsequent one, up to

     * the root which must be self-signed (or contain a fake signature in the case of case 4 above).

     * The first certificate in the chain signs the public key info of the newly-generated or

     * newly-imported key pair.  In the attestation cases (1 and 2 above), the first certificate

     * must also satisfy some other requirements:

     * newly-imported key pair.  The first certificate must also satisfy some other requirements:

     *

     * o It must have the serial number provided in Tag::CERTIFICATE_SERIAL, or default to 1 if the

     *   tag is not provided.
@@ -119,7 +118,8 @@ parcelable KeyCreationResult { 
     *    - the keyAgreement bit set iff the attested key has KeyPurpose::AGREE_KEY, and

     *    - the keyCertSignBit set iff the attested key has KeyPurpose::ATTEST_KEY.

     *

     * o it must contain a KeyDescription attestation extension with OID 1.3.6.1.4.1.11129.2.1.17.

     * In the attestation cases (1 and 2 above), the first certificate must contain a

     * KeyDescription attestation extension with OID 1.3.6.1.4.1.11129.2.1.17.

     *

     * The KeyDescription content is defined by the following ASN.1 schema, which is mostly a

     * straightforward translation of the KeyMint tag/value parameter lists to ASN.1.