Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e60248c8 authored by David Drysdale's avatar David Drysdale
Browse files

KeyMint VTS: ATTEST_KEY has no other purpose 

The KeyMint spec has always required that keys with the ATTEST_KEY
purpose "must not have any other purpose".

Add explicit tests for combined-purpose keys to be rejected.

Also expand the spec text to require a specific error code, and to
explain the rationale for single-purpose ATTEST_KEY keys.

Bug: 197096139
Test: VtsAidlKeyMintTargetTest
Change-Id: I2a2014f0ddc497128ba51bb3f43671f759789912
parent b3b12149

security/keymint/aidl/android/hardware/security/keymint/KeyPurpose.aidl

+5 −1
Original line number Diff line number Diff line
@@ -44,6 +44,10 @@ enum KeyPurpose { 
    AGREE_KEY = 6,



    /* Usable as an attestation signing key.  Keys with this purpose must not have any other

     * purpose. */

     * purpose; if they do, key generation/import must be rejected with

     * ErrorCode::INCOMPATIBLE_PURPOSE. (Rationale: If key also included KeyPurpose::SIGN, then

     * it could be used to sign arbitrary data, including any tbsCertificate, and so an

     * attestation produced by the key would have no security properties.)

     */

    ATTEST_KEY = 7,

}

security/keymint/aidl/vts/functional/AttestKeyTest.cpp

+36 −0
Original line number Diff line number Diff line
@@ -174,6 +174,24 @@ TEST_P(AttestKeyTest, AllRsaSizes) { 
    }

}



/*

 * AttestKeyTest.RsaAttestKeyMultiPurposeFail

 *

 * This test attempts to create an RSA attestation key that also allows signing.

 */

TEST_P(AttestKeyTest, RsaAttestKeyMultiPurposeFail) {

    vector<uint8_t> attest_key_blob;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    ASSERT_EQ(ErrorCode::INCOMPATIBLE_PURPOSE,

              GenerateKey(AuthorizationSetBuilder()

                                  .RsaSigningKey(2048, 65537)

                                  .AttestKey()

                                  .SetDefaultValidity(),

                          {} /* attestation signing key */, &attest_key_blob,

                          &attest_key_characteristics, &attest_key_cert_chain));

}



/*

 * AttestKeyTest.RsaAttestedAttestKeys

 *
@@ -411,6 +429,24 @@ TEST_P(AttestKeyTest, EcAttestKeyChaining) { 
    }

}



/*

 * AttestKeyTest.EcAttestKeyMultiPurposeFail

 *

 * This test attempts to create an EC attestation key that also allows signing.

 */

TEST_P(AttestKeyTest, EcAttestKeyMultiPurposeFail) {

    vector<uint8_t> attest_key_blob;

    vector<KeyCharacteristics> attest_key_characteristics;

    vector<Certificate> attest_key_cert_chain;

    ASSERT_EQ(ErrorCode::INCOMPATIBLE_PURPOSE,

              GenerateKey(AuthorizationSetBuilder()

                                  .EcdsaSigningKey(EcCurve::P_256)

                                  .AttestKey()

                                  .SetDefaultValidity(),

                          {} /* attestation signing key */, &attest_key_blob,

                          &attest_key_characteristics, &attest_key_cert_chain));

}



/*

 * AttestKeyTest.AlternateAttestKeyChaining

 *

security/keymint/aidl/vts/functional/KeyMintTest.cpp

+36 −0
Original line number Diff line number Diff line
@@ -3283,6 +3283,26 @@ TEST_P(ImportKeyTest, RsaPublicExponentMismatch) { 
                        KeyFormat::PKCS8, rsa_key));

}



/*

 * ImportKeyTest.RsaAttestMultiPurposeFail

 *

 * Verifies that importing an RSA key pair with purpose ATTEST_KEY+SIGN fails.

 */

TEST_P(ImportKeyTest, RsaAttestMultiPurposeFail) {

    uint32_t key_size = 2048;

    string key = rsa_2048_key;



    ASSERT_EQ(ErrorCode::INCOMPATIBLE_PURPOSE,

              ImportKey(AuthorizationSetBuilder()

                                .Authorization(TAG_NO_AUTH_REQUIRED)

                                .RsaSigningKey(key_size, 65537)

                                .AttestKey()

                                .Digest(Digest::SHA_2_256)

                                .Padding(PaddingMode::RSA_PSS)

                                .SetDefaultValidity(),

                        KeyFormat::PKCS8, key));

}



/*

 * ImportKeyTest.EcdsaSuccess

 *
@@ -3401,6 +3421,22 @@ TEST_P(ImportKeyTest, EcdsaCurveMismatch) { 
                        KeyFormat::PKCS8, ec_256_key));

}



/*

 * ImportKeyTest.EcdsaAttestMultiPurposeFail

 *

 * Verifies that importing and using an ECDSA P-256 key pair with purpose ATTEST_KEY+SIGN fails.

 */

TEST_P(ImportKeyTest, EcdsaAttestMultiPurposeFail) {

    ASSERT_EQ(ErrorCode::INCOMPATIBLE_PURPOSE,

              ImportKey(AuthorizationSetBuilder()

                                .Authorization(TAG_NO_AUTH_REQUIRED)

                                .EcdsaSigningKey(EcCurve::P_256)

                                .AttestKey()

                                .Digest(Digest::SHA_2_256)

                                .SetDefaultValidity(),

                        KeyFormat::PKCS8, ec_256_key));

}



/*

 * ImportKeyTest.AesSuccess

 *