Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 647318f7 authored by David Drysdale's avatar David Drysdale Committed by Automerger Merge Worker
Browse files

Merge "Align KeyMint AIDL with usage" am: 5cde787c am: 63bd1b14 

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1679847

Change-Id: Iab39fbb7383c15a7dfb5bc30acf67f03643f50ec
parents f07b44c1 63bd1b14

security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/IKeyMintDevice.aidl

+1 −2
Original line number Diff line number Diff line
@@ -44,10 +44,9 @@ interface IKeyMintDevice { 
  void deleteKey(in byte[] keyBlob);

  void deleteAllKeys();

  void destroyAttestationIds();

  android.hardware.security.keymint.BeginResult begin(in android.hardware.security.keymint.KeyPurpose purpose, in byte[] keyBlob, in android.hardware.security.keymint.KeyParameter[] params, in android.hardware.security.keymint.HardwareAuthToken authToken);

  android.hardware.security.keymint.BeginResult begin(in android.hardware.security.keymint.KeyPurpose purpose, in byte[] keyBlob, in android.hardware.security.keymint.KeyParameter[] params, in @nullable android.hardware.security.keymint.HardwareAuthToken authToken);

  void deviceLocked(in boolean passwordOnly, in @nullable android.hardware.security.secureclock.TimeStampToken timestampToken);

  void earlyBootEnded();

  byte[] convertStorageKeyToEphemeral(in byte[] storageKeyBlob);

  byte[] performOperation(in byte[] request);

  const int AUTH_TOKEN_MAC_LENGTH = 32;

}

security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/Tag.aidl

+0 −1
Original line number Diff line number Diff line
@@ -48,7 +48,6 @@ enum Tag { 
  RSA_PUBLIC_EXPONENT = 1342177480,

  INCLUDE_UNIQUE_ID = 1879048394,

  RSA_OAEP_MGF_DIGEST = 536871115,

  BLOB_USAGE_REQUIREMENTS = 268435757,

  BOOTLOADER_ONLY = 1879048494,

  ROLLBACK_RESISTANCE = 1879048495,

  HARDWARE_TYPE = 268435760,

security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl

+2 −21
Original line number Diff line number Diff line
@@ -257,9 +257,6 @@ interface IKeyMintDevice { 
     *

     * o Tag::ORIGIN with the value KeyOrigin::GENERATED.

     *

     * o Tag::BLOB_USAGE_REQUIREMENTS with the appropriate value (see KeyBlobUsageRequirements in

     *   Tag.aidl).

     *

     * o Tag::OS_VERSION, Tag::OS_PATCHLEVEL, Tag::VENDOR_PATCHLEVEL and Tag::BOOT_PATCHLEVEL with

     *   appropriate values.

     *
@@ -713,9 +710,7 @@ interface IKeyMintDevice { 
     *        contain a tag Tag::NONCE.  If Tag::NONCE is provided for a key without

     *        Tag:CALLER_NONCE, ErrorCode::CALLER_NONCE_PROHIBITED must be returned.

     *

     * @param inAuthToken Authentication token.  Callers that provide no token must set all numeric

     *        fields to zero and the MAC must be an empty vector.  TODO: make this field nullable.

     *        b/173483024.

     * @param inAuthToken Authentication token.

     *

     * @return BeginResult as output, which contains the challenge, KeyParameters which haves

     *         additional data from the operation initialization, notably to return the IV or nonce
@@ -723,7 +718,7 @@ interface IKeyMintDevice { 
     *         which is used to perform update(), finish() or abort() operations.

     */

    BeginResult begin(in KeyPurpose purpose, in byte[] keyBlob, in KeyParameter[] params,

            in HardwareAuthToken authToken);

            in @nullable HardwareAuthToken authToken);



    /**

     * Called by client to notify the IKeyMintDevice that the device is now locked, and keys with
@@ -783,18 +778,4 @@ interface IKeyMintDevice { 
     *         place of the input storageKeyBlob

     */

    byte[] convertStorageKeyToEphemeral(in byte[] storageKeyBlob);



    /**

     * Called by the client to perform a KeyMint operation.

     *

     *  This method is added primarily as a placeholder.  Details will be fleshed before the KeyMint

     *  V1 interface is frozen.  Until then, implementations must return ErrorCode::UNIMPLEMENTED.

     *

     * @param request is an encrypted buffer containing a description of the operation the client

     *        wishes to perform.  Structure, content and encryption are TBD.

     *

     * @return an encrypted buffer containing the result of the operation.  Structure, content and

     *         encryption are TBD.

     */

    byte[] performOperation(in byte[] request);

}

security/keymint/aidl/android/hardware/security/keymint/Tag.aidl

+1 −16
Original line number Diff line number Diff line
@@ -203,22 +203,7 @@ enum Tag { 
     */

    RSA_OAEP_MGF_DIGEST = (2 << 28) /* TagType:ENUM_REP */ | 203,



    /**

     * TODO(seleneh) this tag needs to be deleted from all codes.

     *

     * Tag::BLOB_USAGE_REQUIREMENTS specifies the necessary system environment conditions for the

     * generated key to be used.  Possible values are defined by the KeyBlobUsageRequirements enum.

     *

     * This tag is specified by the caller during key generation or import to require that the key

     * is usable in the specified condition.  If the caller specifies Tag::BLOB_USAGE_REQUIREMENTS

     * with value KeyBlobUsageRequirements::STANDALONE the IKeyMintDevice must return a key blob

     * that can be used without file system support.  This is critical for devices with encrypted

     * disks, where the file system may not be available until after a KeyMint key is used to

     * decrypt the disk.

     *

     * Must be hardware-enforced.

     */

    BLOB_USAGE_REQUIREMENTS = (1 << 28) /* TagType:ENUM */ | 301,

    // Tag 301 reserved



    /**

     * Tag::BOOTLOADER_ONLY specifies only the bootloader can use the key.

security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp

+2 −3
Original line number Diff line number Diff line
@@ -119,7 +119,6 @@ char nibble2hex[16] = {'0', '1', '2', '3', '4', '5', '6', '7', 
// Attestations don't contain everything in key authorization lists, so we need to filter the key

// lists to produce the lists that we expect to match the attestations.

auto kTagsToFilter = {

        Tag::BLOB_USAGE_REQUIREMENTS,  //

        Tag::CREATION_DATETIME,        //

        Tag::EC_CURVE,

        Tag::HARDWARE_TYPE,
@@ -348,7 +347,7 @@ ErrorCode KeyMintAidlTestBase::Begin(KeyPurpose purpose, const vector<uint8_t>& 
    SCOPED_TRACE("Begin");

    Status result;

    BeginResult out;

    result = keymint_->begin(purpose, key_blob, in_params.vector_data(), HardwareAuthToken(), &out);

    result = keymint_->begin(purpose, key_blob, in_params.vector_data(), std::nullopt, &out);



    if (result.isOk()) {

        *out_params = out.params;
@@ -366,7 +365,7 @@ ErrorCode KeyMintAidlTestBase::Begin(KeyPurpose purpose, const vector<uint8_t>& 
    Status result;

    BeginResult out;



    result = keymint_->begin(purpose, key_blob, in_params.vector_data(), HardwareAuthToken(), &out);

    result = keymint_->begin(purpose, key_blob, in_params.vector_data(), std::nullopt, &out);



    if (result.isOk()) {

        *out_params = out.params;