Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e202bd5 authored by Andrew Scull's avatar Andrew Scull Committed by Automerger Merge Worker
Browse files

Merge "Select the DICE validation rules based on the VSR" into main am:... 

Merge "Select the DICE validation rules based on the VSR" into main am: b484308d am: 68e76934 am: 44d47323 am: 2ac8eb35

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2678076



Change-Id: Idaf4f9892a53d5a91cce33e4e9a555568bd927cd
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 1850286d 2ac8eb35

security/keymint/support/remote_prov_utils.cpp

+20 −1
Original line number Diff line number Diff line
@@ -962,6 +962,20 @@ ErrMsgOr<bytevec> parseAndValidateAuthenticatedRequestSignedPayload( 
    return signedRequest->value();

}



ErrMsgOr<hwtrust::DiceChain::Kind> getDiceChainKind() {

    int vendor_api_level = ::android::base::GetIntProperty("ro.vendor.api_level", -1);

    switch (vendor_api_level) {

        case __ANDROID_API_T__:

            return hwtrust::DiceChain::Kind::kVsr13;

        case __ANDROID_API_U__:

            return hwtrust::DiceChain::Kind::kVsr14;

        case __ANDROID_API_V__:

            return hwtrust::DiceChain::Kind::kVsr15;

        default:

            return "Unsupported vendor API level: " + std::to_string(vendor_api_level);

    }

}



ErrMsgOr<bytevec> parseAndValidateAuthenticatedRequest(const std::vector<uint8_t>& request,

                                                       const std::vector<uint8_t>& challenge) {

    auto [parsedRequest, _, csrErrMsg] = cppbor::parse(request);
@@ -996,7 +1010,12 @@ ErrMsgOr<bytevec> parseAndValidateAuthenticatedRequest(const std::vector<uint8_t 
    }



    // DICE chain is [ pubkey, + DiceChainEntry ].

    auto diceContents = validateBcc(diceCertChain, hwtrust::DiceChain::Kind::kVsr14);

    auto diceChainKind = getDiceChainKind();

    if (!diceChainKind) {

        return diceChainKind.message();

    }



    auto diceContents = validateBcc(diceCertChain, *diceChainKind);

    if (!diceContents) {

        return diceContents.message() + "\n" + prettyPrint(diceCertChain);

    }

security/rkp/aidl/android/hardware/security/keymint/generateCertificateRequestV2.cddl

+2 −1
Original line number Diff line number Diff line
@@ -90,6 +90,7 @@ DiceCertChain = [ 
DiceChainEntryPayload = {                    ; CWT [RFC8392]

    1 : tstr,                                ; Issuer

    2 : tstr,                                ; Subject

    -4670554 : "android.15",                 ; Profile Name

    -4670552 : bstr .cbor PubKeyEd25519 /

            bstr .cbor PubKeyECDSA256 /

            bstr .cbor PubKeyECDSA384,       ; Subject Public Key