Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb69354d authored by Karuna Wadhera's avatar Karuna Wadhera
Browse files

Add moduleHash to attestation cert documentation

Bug: 369375199
Test: n/a
Change-Id: I28457dbe661dacfe22dfc97d1c1c9c21068af656
parent 3ba252f1
Loading
Loading
Loading
Loading
+14 −2
Original line number Diff line number Diff line
@@ -125,9 +125,9 @@ parcelable KeyCreationResult {
     * straightforward translation of the KeyMint tag/value parameter lists to ASN.1.
     *
     * KeyDescription ::= SEQUENCE {
     *     attestationVersion         INTEGER, # Value 300
     *     attestationVersion         INTEGER, # Value 400
     *     attestationSecurityLevel   SecurityLevel, # See below
     *     keyMintVersion             INTEGER, # Value 300
     *     keyMintVersion             INTEGER, # Value 400
     *     keymintSecurityLevel       SecurityLevel, # See below
     *     attestationChallenge       OCTET_STRING, # Tag::ATTESTATION_CHALLENGE from attestParams
     *     uniqueId                   OCTET_STRING, # Empty unless key has Tag::INCLUDE_UNIQUE_ID
@@ -158,6 +158,17 @@ parcelable KeyCreationResult {
     *     Failed                     (3),
     * }
     *
     * # Modules contains version info about APEX modules that have been updated after the last OTA.
     * # Note that the Modules information is DER-encoded before being hashed, which requires a
     * # specific ordering (lexicographic by encoded value) for the constituent Module entries. This
     * # ensures that the ordering of Module entries is predictable and that the resulting SHA-256
     * # hash value is identical for the same set of modules.
     * Modules ::= SET OF Module
     * Module ::= SEQUENCE {
     *     packageName                OCTET_STRING,
     *     version                    INTEGER, # As determined at boot time
     * }
     *
     * -- Note that the AuthorizationList SEQUENCE is also used in IKeyMintDevice::importWrappedKey
     * -- as a way of describing the authorizations associated with a key that is being securely
     * -- imported.  As such, it includes the ability to describe tags that are only relevant for
@@ -210,6 +221,7 @@ parcelable KeyCreationResult {
     *     bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
     *     deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
     *     attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
     *     moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL, -- SHA-256 hash of DER-encoded `Modules`
     * }
     */
    Certificate[] certificateChain;