Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d83bad7d authored by Brian Young's avatar Brian Young Committed by Android (Google) Code Review
Browse files

Merge "Add "Unlocked device required" key API" into pi-dev

parents 04db1bfe 3f483226

current.txt

+1 −1
Original line number Diff line number Diff line
@@ -329,7 +329,7 @@ dd83be076b6b3f10ed62ab34d8c8b95f2415961fb785200eb842e7bfb2b0ee92 android.hardwar 
434c4c32c00b0e54bb05e40c79503208b40f786a318029a2a4f66e34f10f2a76 android.hardware.health@2.0::IHealthInfoCallback

c9e498f1ade5e26f00d290b4763a9671ec6720f915e7d592844b62e8cb1f9b5c android.hardware.health@2.0::types

a6cf986593c6ad15fe2ae3a1995d2cae233500bc32c055912a42723bdc076868 android.hardware.keymaster@4.0::IKeymasterDevice

3ce01f7a38013f15d2ffc9c66a81eb85061ab6585fb1e659fe6da36bdcbfa9cf android.hardware.keymaster@4.0::types

e15ebdf1e0a326ff5b8a59668d4d8cd3852bd88388eae91de13f5f7e1af50ed1 android.hardware.keymaster@4.0::types

6d5c646a83538f0f9d8438c259932509f4353410c6c76e56db0d6ca98b69c3bb android.hardware.media.bufferpool@1.0::IAccessor

b8c7ed58aa8740361e63d0ce9e7c94227572a629f356958840b34809d2393a7c android.hardware.media.bufferpool@1.0::IClientManager

4a2c0dc82780e6c90731725a103feab8ab6ecf85a64e049b9cbd2b2c61620fe1 android.hardware.media.bufferpool@1.0::IConnection

keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp

+22 −0
Original line number Diff line number Diff line
@@ -2917,6 +2917,28 @@ TEST_F(EncryptionOperationsTest, AesEcbRoundTripSuccess) { 
    EXPECT_EQ(message, plaintext);

}



/*

 * EncryptionOperationsTest.AesEcbWithUserId

 *

 * Verifies that AES ECB mode works when Tag::USER_ID is specified.

 */

TEST_F(EncryptionOperationsTest, AesEcbWithUserId) {

    string key = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};

    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()

                                           .Authorization(TAG_NO_AUTH_REQUIRED)

                                           .Authorization(TAG_USER_ID, 0)

                                           .AesEncryptionKey(key.size() * 8)

                                           .EcbMode()

                                           .Padding(PaddingMode::PKCS7),

                                       KeyFormat::RAW, key));



    string message = "Hello World!";

    auto params = AuthorizationSetBuilder().BlockMode(BlockMode::ECB).Padding(PaddingMode::PKCS7);

    string ciphertext = EncryptMessage(message, params);

    string plaintext = DecryptMessage(ciphertext, params);

    EXPECT_EQ(message, plaintext);

}



/*

 * EncryptionOperationsTest.AesEcbRoundTripSuccess

 *

keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h

+17 −11
Original line number Diff line number Diff line
@@ -142,23 +142,27 @@ DECLARE_TYPED_TAG(ROOT_OF_TRUST); 
DECLARE_TYPED_TAG(RSA_PUBLIC_EXPONENT);

DECLARE_TYPED_TAG(TRUSTED_CONFIRMATION_REQUIRED);

DECLARE_TYPED_TAG(UNIQUE_ID);

DECLARE_TYPED_TAG(UNLOCKED_DEVICE_REQUIRED);

DECLARE_TYPED_TAG(USAGE_EXPIRE_DATETIME);

DECLARE_TYPED_TAG(USER_AUTH_TYPE);

DECLARE_TYPED_TAG(USER_ID);

DECLARE_TYPED_TAG(USER_SECURE_ID);



template <typename... Elems>

struct MetaList {};



using all_tags_t = MetaList<

    TAG_INVALID_t, TAG_KEY_SIZE_t, TAG_MAC_LENGTH_t, TAG_CALLER_NONCE_t, TAG_MIN_MAC_LENGTH_t,

    TAG_RSA_PUBLIC_EXPONENT_t, TAG_INCLUDE_UNIQUE_ID_t, TAG_ACTIVE_DATETIME_t,

    TAG_ORIGINATION_EXPIRE_DATETIME_t, TAG_USAGE_EXPIRE_DATETIME_t, TAG_MIN_SECONDS_BETWEEN_OPS_t,

    TAG_MAX_USES_PER_BOOT_t, TAG_USER_SECURE_ID_t, TAG_NO_AUTH_REQUIRED_t, TAG_AUTH_TIMEOUT_t,

    TAG_ALLOW_WHILE_ON_BODY_t, TAG_APPLICATION_ID_t, TAG_APPLICATION_DATA_t,

    TAG_CREATION_DATETIME_t, TAG_ROLLBACK_RESISTANCE_t, TAG_ROOT_OF_TRUST_t, TAG_ASSOCIATED_DATA_t,

    TAG_NONCE_t, TAG_BOOTLOADER_ONLY_t, TAG_OS_VERSION_t, TAG_OS_PATCHLEVEL_t, TAG_UNIQUE_ID_t,

    TAG_ATTESTATION_CHALLENGE_t, TAG_ATTESTATION_APPLICATION_ID_t, TAG_RESET_SINCE_ID_ROTATION_t,

    TAG_PURPOSE_t, TAG_ALGORITHM_t, TAG_BLOCK_MODE_t, TAG_DIGEST_t, TAG_PADDING_t,

using all_tags_t =

    MetaList<TAG_INVALID_t, TAG_KEY_SIZE_t, TAG_MAC_LENGTH_t, TAG_CALLER_NONCE_t,

             TAG_MIN_MAC_LENGTH_t, TAG_RSA_PUBLIC_EXPONENT_t, TAG_INCLUDE_UNIQUE_ID_t,

             TAG_ACTIVE_DATETIME_t, TAG_ORIGINATION_EXPIRE_DATETIME_t, TAG_USAGE_EXPIRE_DATETIME_t,

             TAG_MIN_SECONDS_BETWEEN_OPS_t, TAG_MAX_USES_PER_BOOT_t, TAG_USER_ID_t,

             TAG_USER_SECURE_ID_t, TAG_NO_AUTH_REQUIRED_t, TAG_AUTH_TIMEOUT_t,

             TAG_ALLOW_WHILE_ON_BODY_t, TAG_UNLOCKED_DEVICE_REQUIRED_t, TAG_APPLICATION_ID_t,

             TAG_APPLICATION_DATA_t, TAG_CREATION_DATETIME_t, TAG_ROLLBACK_RESISTANCE_t,

             TAG_ROOT_OF_TRUST_t, TAG_ASSOCIATED_DATA_t, TAG_NONCE_t, TAG_BOOTLOADER_ONLY_t,

             TAG_OS_VERSION_t, TAG_OS_PATCHLEVEL_t, TAG_UNIQUE_ID_t, TAG_ATTESTATION_CHALLENGE_t,

             TAG_ATTESTATION_APPLICATION_ID_t, TAG_RESET_SINCE_ID_ROTATION_t, TAG_PURPOSE_t,

             TAG_ALGORITHM_t, TAG_BLOCK_MODE_t, TAG_DIGEST_t, TAG_PADDING_t,

             TAG_BLOB_USAGE_REQUIREMENTS_t, TAG_ORIGIN_t, TAG_USER_AUTH_TYPE_t, TAG_EC_CURVE_t>;



template <typename TypedTagType>
@@ -343,6 +347,7 @@ inline bool operator==(const KeyParameter& a, const KeyParameter& b) { 
        case Tag::BOOTLOADER_ONLY:

        case Tag::NO_AUTH_REQUIRED:

        case Tag::ALLOW_WHILE_ON_BODY:

        case Tag::UNLOCKED_DEVICE_REQUIRED:

        case Tag::ROLLBACK_RESISTANCE:

        case Tag::RESET_SINCE_ID_ROTATION:

        case Tag::TRUSTED_CONFIRMATION_REQUIRED:
@@ -357,6 +362,7 @@ inline bool operator==(const KeyParameter& a, const KeyParameter& b) { 
        case Tag::OS_VERSION:

        case Tag::OS_PATCHLEVEL:

        case Tag::MAC_LENGTH:

        case Tag::USER_ID:

        case Tag::AUTH_TIMEOUT:

        case Tag::VENDOR_PATCHLEVEL:

        case Tag::BOOT_PATCHLEVEL:

keymaster/4.0/types.hal

+6 −1
Original line number Diff line number Diff line
@@ -118,7 +118,8 @@ enum Tag : uint32_t { 
                                                       * boot. */



    /* User authentication */

    // 500-501 reserved

    // 500 reserved

    USER_ID = TagType:UINT | 501,             /* Android ID of authorized user or authenticator(s), */

    USER_SECURE_ID = TagType:ULONG_REP | 502, /* Secure ID of authorized user or authenticator(s).

                                               * Disallowed if NO_AUTH_REQUIRED is present. */

    NO_AUTH_REQUIRED = TagType:BOOL | 503,    /* If key is usable without authentication. */
@@ -191,6 +192,9 @@ enum Tag : uint32_t { 
     * match the data described in the token, keymaster must return NO_USER_CONFIRMATION. */

    TRUSTED_CONFIRMATION_REQUIRED = TagType:BOOL | 508,



    UNLOCKED_DEVICE_REQUIRED = TagType:BOOL | 509, /* Require the device screen to be unlocked if

                                                    * the key is used. */



    /* Application access control */

    APPLICATION_ID = TagType:BYTES | 601, /* Byte string identifying the authorized application. */
@@ -471,6 +475,7 @@ enum ErrorCode : int32_t { 
    PROOF_OF_PRESENCE_REQUIRED = -69,

    CONCURRENT_PROOF_OF_PRESENCE_REQUESTED = -70,

    NO_USER_CONFIRMATION = -71,

    DEVICE_LOCKED = -72,



    UNIMPLEMENTED = -100,

    VERSION_MISMATCH = -101,