| /* |
| * Copyright (C) 2016 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package android.keystore.cts; |
| |
| import static com.google.common.base.Functions.forMap; |
| import static com.google.common.collect.Collections2.transform; |
| |
| import android.security.keystore.KeyProperties; |
| import android.util.Log; |
| |
| import com.google.common.base.Joiner; |
| import com.google.common.collect.ImmutableMap; |
| import com.google.common.collect.ImmutableSet; |
| import com.google.common.collect.Lists; |
| |
| import org.bouncycastle.asn1.ASN1Encodable; |
| import org.bouncycastle.asn1.ASN1Primitive; |
| import org.bouncycastle.asn1.ASN1Sequence; |
| import org.bouncycastle.asn1.ASN1SequenceParser; |
| import org.bouncycastle.asn1.ASN1TaggedObject; |
| |
| import java.io.IOException; |
| import java.io.UnsupportedEncodingException; |
| import java.security.cert.CertificateParsingException; |
| import java.text.DateFormat; |
| import java.util.Collection; |
| import java.util.Date; |
| import java.util.List; |
| import java.util.Set; |
| |
| import co.nstant.in.cbor.model.DataItem; |
| import co.nstant.in.cbor.model.Number; |
| |
| public class AuthorizationList { |
| // Algorithm values. |
| public static final int KM_ALGORITHM_RSA = 1; |
| public static final int KM_ALGORITHM_EC = 3; |
| |
| // EC Curves |
| public static final int KM_EC_CURVE_P224 = 0; |
| public static final int KM_EC_CURVE_P256 = 1; |
| public static final int KM_EC_CURVE_P384 = 2; |
| public static final int KM_EC_CURVE_P521 = 3; |
| public static final int KM_EC_CURVE_25519 = 4; |
| |
| // Padding modes. |
| public static final int KM_PAD_NONE = 1; |
| public static final int KM_PAD_RSA_OAEP = 2; |
| public static final int KM_PAD_RSA_PSS = 3; |
| public static final int KM_PAD_RSA_PKCS1_1_5_ENCRYPT = 4; |
| public static final int KM_PAD_RSA_PKCS1_1_5_SIGN = 5; |
| |
| // Digest modes. |
| public static final int KM_DIGEST_NONE = 0; |
| public static final int KM_DIGEST_MD5 = 1; |
| public static final int KM_DIGEST_SHA1 = 2; |
| public static final int KM_DIGEST_SHA_2_224 = 3; |
| public static final int KM_DIGEST_SHA_2_256 = 4; |
| public static final int KM_DIGEST_SHA_2_384 = 5; |
| public static final int KM_DIGEST_SHA_2_512 = 6; |
| |
| // Key origins. |
| public static final int KM_ORIGIN_GENERATED = 0; |
| public static final int KM_ORIGIN_IMPORTED = 2; |
| public static final int KM_ORIGIN_UNKNOWN = 3; |
| |
| // Operation Purposes. |
| public static final int KM_PURPOSE_ENCRYPT = 0; |
| public static final int KM_PURPOSE_DECRYPT = 1; |
| public static final int KM_PURPOSE_SIGN = 2; |
| public static final int KM_PURPOSE_VERIFY = 3; |
| |
| // User authenticators. |
| public static final int HW_AUTH_PASSWORD = 1 << 0; |
| public static final int HW_AUTH_FINGERPRINT = 1 << 1; |
| |
| // Keymaster tag classes |
| private static final int KM_ENUM = 1 << 28; |
| private static final int KM_ENUM_REP = 2 << 28; |
| private static final int KM_UINT = 3 << 28; |
| private static final int KM_ULONG = 5 << 28; |
| private static final int KM_DATE = 6 << 28; |
| private static final int KM_BOOL = 7 << 28; |
| private static final int KM_BYTES = 9 << 28; |
| |
| // Tag class removal mask |
| private static final int KEYMASTER_TAG_TYPE_MASK = 0x0FFFFFFF; |
| |
| // Keymaster tags |
| private static final int KM_TAG_PURPOSE = KM_ENUM_REP | 1; |
| private static final int KM_TAG_ALGORITHM = KM_ENUM | 2; |
| private static final int KM_TAG_KEY_SIZE = KM_UINT | 3; |
| private static final int KM_TAG_DIGEST = KM_ENUM_REP | 5; |
| private static final int KM_TAG_PADDING = KM_ENUM_REP | 6; |
| private static final int KM_TAG_EC_CURVE = KM_ENUM | 10; |
| private static final int KM_TAG_RSA_PUBLIC_EXPONENT = KM_ULONG | 200; |
| private static final int KM_TAG_RSA_OAEP_MGF_DIGEST = KM_ENUM | 203; |
| private static final int KM_TAG_ROLLBACK_RESISTANCE = KM_BOOL | 303; |
| private static final int KM_TAG_ACTIVE_DATETIME = KM_DATE | 400; |
| private static final int KM_TAG_ORIGINATION_EXPIRE_DATETIME = KM_DATE | 401; |
| private static final int KM_TAG_USAGE_EXPIRE_DATETIME = KM_DATE | 402; |
| private static final int KM_TAG_NO_AUTH_REQUIRED = KM_BOOL | 503; |
| private static final int KM_TAG_USER_AUTH_TYPE = KM_ENUM | 504; |
| private static final int KM_TAG_AUTH_TIMEOUT = KM_UINT | 505; |
| private static final int KM_TAG_ALLOW_WHILE_ON_BODY = KM_BOOL | 506; |
| private static final int KM_TAG_TRUSTED_USER_PRESENCE_REQUIRED = KM_BOOL | 507; |
| private static final int KM_TAG_TRUSTED_CONFIRMATION_REQUIRED = KM_BOOL | 508; |
| private static final int KM_TAG_UNLOCKED_DEVICE_REQUIRED = KM_BOOL | 509; |
| private static final int KM_TAG_ALL_APPLICATIONS = KM_BOOL | 600; |
| private static final int KM_TAG_CREATION_DATETIME = KM_DATE | 701; |
| private static final int KM_TAG_ORIGIN = KM_ENUM | 702; |
| private static final int KM_TAG_ROLLBACK_RESISTANT = KM_BOOL | 703; |
| private static final int KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704; |
| private static final int KM_TAG_OS_VERSION = KM_UINT | 705; |
| private static final int KM_TAG_OS_PATCHLEVEL = KM_UINT | 706; |
| private static final int KM_TAG_ATTESTATION_APPLICATION_ID = KM_BYTES | 709; |
| private static final int KM_TAG_ATTESTATION_ID_BRAND = KM_BYTES | 710; |
| private static final int KM_TAG_ATTESTATION_ID_DEVICE = KM_BYTES | 711; |
| private static final int KM_TAG_ATTESTATION_ID_PRODUCT = KM_BYTES | 712; |
| private static final int KM_TAG_ATTESTATION_ID_SERIAL = KM_BYTES | 713; |
| private static final int KM_TAG_ATTESTATION_ID_IMEI = KM_BYTES | 714; |
| private static final int KM_TAG_ATTESTATION_ID_MEID = KM_BYTES | 715; |
| private static final int KM_TAG_ATTESTATION_ID_MANUFACTURER = KM_BYTES | 716; |
| private static final int KM_TAG_ATTESTATION_ID_MODEL = KM_BYTES | 717; |
| private static final int KM_TAG_VENDOR_PATCHLEVEL = KM_UINT | 718; |
| private static final int KM_TAG_BOOT_PATCHLEVEL = KM_UINT | 719; |
| private static final int KM_TAG_ATTESTATION_ID_SECOND_IMEI = KM_BYTES | 723; |
| |
| // Map for converting padding values to strings |
| private static final ImmutableMap<Integer, String> paddingMap = ImmutableMap |
| .<Integer, String> builder() |
| .put(KM_PAD_NONE, "NONE") |
| .put(KM_PAD_RSA_OAEP, "OAEP") |
| .put(KM_PAD_RSA_PSS, "PSS") |
| .put(KM_PAD_RSA_PKCS1_1_5_ENCRYPT, "PKCS1 ENCRYPT") |
| .put(KM_PAD_RSA_PKCS1_1_5_SIGN, "PKCS1 SIGN") |
| .build(); |
| |
| // Map for converting digest values to strings |
| private static final ImmutableMap<Integer, String> digestMap = ImmutableMap |
| .<Integer, String> builder() |
| .put(KM_DIGEST_NONE, "NONE") |
| .put(KM_DIGEST_MD5, "MD5") |
| .put(KM_DIGEST_SHA1, "SHA1") |
| .put(KM_DIGEST_SHA_2_224, "SHA224") |
| .put(KM_DIGEST_SHA_2_256, "SHA256") |
| .put(KM_DIGEST_SHA_2_384, "SHA384") |
| .put(KM_DIGEST_SHA_2_512, "SHA512") |
| .build(); |
| |
| // Map for converting purpose values to strings |
| private static final ImmutableMap<Integer, String> purposeMap = ImmutableMap |
| .<Integer, String> builder() |
| .put(KM_PURPOSE_DECRYPT, "DECRYPT") |
| .put(KM_PURPOSE_ENCRYPT, "ENCRYPT") |
| .put(KM_PURPOSE_SIGN, "SIGN") |
| .put(KM_PURPOSE_VERIFY, "VERIFY") |
| .build(); |
| |
| private Integer securityLevel; |
| private Set<Integer> purposes; |
| private Integer algorithm; |
| private Integer keySize; |
| private Set<Integer> digests; |
| private Set<Integer> paddingModes; |
| private Integer ecCurve; |
| private Long rsaPublicExponent; |
| private Set<Integer> mRsaOaepMgfDigests; |
| private Date activeDateTime; |
| private Date originationExpireDateTime; |
| private Date usageExpireDateTime; |
| private boolean noAuthRequired; |
| private Integer userAuthType; |
| private Integer authTimeout; |
| private boolean allowWhileOnBody; |
| private boolean allApplications; |
| private byte[] applicationId; |
| private Date creationDateTime; |
| private Integer origin; |
| private boolean rollbackResistant; |
| private boolean rollbackResistance; |
| private RootOfTrust rootOfTrust; |
| private Integer osVersion; |
| private Integer osPatchLevel; |
| private Integer vendorPatchLevel; |
| private Integer bootPatchLevel; |
| private AttestationApplicationId attestationApplicationId; |
| private String brand; |
| private String device; |
| private String serialNumber; |
| private String imei; |
| private String meid; |
| private String product; |
| private String manufacturer; |
| private String model; |
| private boolean userPresenceRequired; |
| private boolean confirmationRequired; |
| private String mSecondImei; |
| |
| public AuthorizationList(ASN1Encodable sequence, int attestationVersion) throws CertificateParsingException { |
| this(sequence, attestationVersion, true); |
| } |
| |
| public AuthorizationList(ASN1Encodable sequence, int attestationVersion, boolean strictParsing) throws CertificateParsingException { |
| if (!(sequence instanceof ASN1Sequence)) { |
| throw new CertificateParsingException("Expected sequence for authorization list, found " |
| + sequence.getClass().getName()); |
| } |
| |
| ASN1SequenceParser parser = ((ASN1Sequence) sequence).parser(); |
| ASN1TaggedObject entry = parseAsn1TaggedObject(parser); |
| int currentTag = 0, prevTag = 0; |
| for (; entry != null; entry = parseAsn1TaggedObject(parser)) { |
| prevTag = currentTag; |
| currentTag = entry.getTagNo(); |
| if (prevTag > currentTag) { |
| throw new CertificateParsingException( |
| "Incorrect order of tags in authorization list: " + currentTag); |
| } |
| ASN1Primitive value = entry.getObject(); |
| Log.i("Attestation", "Parsing tag: [" + currentTag + "], value: [" + value + "]"); |
| switch (currentTag) { |
| default: |
| throw new CertificateParsingException("Unknown tag " + currentTag + " found"); |
| |
| case KM_TAG_PURPOSE & KEYMASTER_TAG_TYPE_MASK: |
| purposes = Asn1Utils.getIntegersFromAsn1Set(value); |
| break; |
| case KM_TAG_ALGORITHM & KEYMASTER_TAG_TYPE_MASK: |
| algorithm = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_KEY_SIZE & KEYMASTER_TAG_TYPE_MASK: |
| keySize = Asn1Utils.getIntegerFromAsn1(value); |
| Log.i("Attestation", "Found KEY SIZE, value: " + keySize); |
| break; |
| case KM_TAG_DIGEST & KEYMASTER_TAG_TYPE_MASK: |
| digests = Asn1Utils.getIntegersFromAsn1Set(value); |
| break; |
| case KM_TAG_PADDING & KEYMASTER_TAG_TYPE_MASK: |
| paddingModes = Asn1Utils.getIntegersFromAsn1Set(value); |
| break; |
| case KM_TAG_RSA_PUBLIC_EXPONENT & KEYMASTER_TAG_TYPE_MASK: |
| rsaPublicExponent = Asn1Utils.getLongFromAsn1(value); |
| break; |
| case KM_TAG_RSA_OAEP_MGF_DIGEST & KEYMASTER_TAG_TYPE_MASK: |
| mRsaOaepMgfDigests = Asn1Utils.getIntegersFromAsn1Set(value); |
| break; |
| case KM_TAG_NO_AUTH_REQUIRED & KEYMASTER_TAG_TYPE_MASK: |
| noAuthRequired = true; |
| break; |
| case KM_TAG_CREATION_DATETIME & KEYMASTER_TAG_TYPE_MASK: |
| creationDateTime = Asn1Utils.getDateFromAsn1(value); |
| break; |
| case KM_TAG_ORIGIN & KEYMASTER_TAG_TYPE_MASK: |
| origin = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_OS_VERSION & KEYMASTER_TAG_TYPE_MASK: |
| osVersion = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_OS_PATCHLEVEL & KEYMASTER_TAG_TYPE_MASK: |
| osPatchLevel = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_VENDOR_PATCHLEVEL & KEYMASTER_TAG_TYPE_MASK: |
| vendorPatchLevel = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_BOOT_PATCHLEVEL & KEYMASTER_TAG_TYPE_MASK: |
| bootPatchLevel = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_ACTIVE_DATETIME & KEYMASTER_TAG_TYPE_MASK: |
| activeDateTime = Asn1Utils.getDateFromAsn1(value); |
| break; |
| case KM_TAG_ORIGINATION_EXPIRE_DATETIME & KEYMASTER_TAG_TYPE_MASK: |
| originationExpireDateTime = Asn1Utils.getDateFromAsn1(value); |
| break; |
| case KM_TAG_USAGE_EXPIRE_DATETIME & KEYMASTER_TAG_TYPE_MASK: |
| usageExpireDateTime = Asn1Utils.getDateFromAsn1(value); |
| break; |
| case KM_TAG_ROLLBACK_RESISTANT & KEYMASTER_TAG_TYPE_MASK: |
| rollbackResistant = true; |
| break; |
| case KM_TAG_ROLLBACK_RESISTANCE & KEYMASTER_TAG_TYPE_MASK: |
| rollbackResistance = true; |
| break; |
| case KM_TAG_AUTH_TIMEOUT & KEYMASTER_TAG_TYPE_MASK: |
| authTimeout = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_ALLOW_WHILE_ON_BODY & KEYMASTER_TAG_TYPE_MASK: |
| allowWhileOnBody = true; |
| break; |
| case KM_TAG_EC_CURVE & KEYMASTER_TAG_TYPE_MASK: |
| ecCurve = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_USER_AUTH_TYPE & KEYMASTER_TAG_TYPE_MASK: |
| userAuthType = Asn1Utils.getIntegerFromAsn1(value); |
| break; |
| case KM_TAG_ROOT_OF_TRUST & KEYMASTER_TAG_TYPE_MASK: |
| rootOfTrust = new RootOfTrust(value, attestationVersion, strictParsing); |
| break; |
| case KM_TAG_ATTESTATION_APPLICATION_ID & KEYMASTER_TAG_TYPE_MASK: |
| attestationApplicationId = new AttestationApplicationId(Asn1Utils |
| .getAsn1EncodableFromBytes(Asn1Utils.getByteArrayFromAsn1(value))); |
| break; |
| case KM_TAG_ATTESTATION_ID_BRAND & KEYMASTER_TAG_TYPE_MASK: |
| brand = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ATTESTATION_ID_DEVICE & KEYMASTER_TAG_TYPE_MASK: |
| device = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ATTESTATION_ID_PRODUCT & KEYMASTER_TAG_TYPE_MASK: |
| product = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ATTESTATION_ID_SERIAL & KEYMASTER_TAG_TYPE_MASK: |
| serialNumber = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ATTESTATION_ID_IMEI & KEYMASTER_TAG_TYPE_MASK: |
| imei = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ATTESTATION_ID_MEID & KEYMASTER_TAG_TYPE_MASK: |
| meid = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ATTESTATION_ID_MANUFACTURER & KEYMASTER_TAG_TYPE_MASK: |
| manufacturer = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ATTESTATION_ID_MODEL & KEYMASTER_TAG_TYPE_MASK: |
| model = getStringFromAsn1Value(value); |
| break; |
| case KM_TAG_ALL_APPLICATIONS & KEYMASTER_TAG_TYPE_MASK: |
| allApplications = true; |
| break; |
| case KM_TAG_TRUSTED_USER_PRESENCE_REQUIRED & KEYMASTER_TAG_TYPE_MASK: |
| userPresenceRequired = true; |
| break; |
| case KM_TAG_TRUSTED_CONFIRMATION_REQUIRED & KEYMASTER_TAG_TYPE_MASK: |
| confirmationRequired = true; |
| break; |
| case KM_TAG_ATTESTATION_ID_SECOND_IMEI & KEYMASTER_TAG_TYPE_MASK: |
| mSecondImei = getStringFromAsn1Value(value); |
| break; |
| } |
| } |
| |
| } |
| |
| public AuthorizationList(co.nstant.in.cbor.model.Map submodMap) |
| throws CertificateParsingException { |
| for (DataItem key : submodMap.getKeys()) { |
| int keyInt = ((Number) key).getValue().intValue(); |
| switch (keyInt) { |
| default: |
| throw new CertificateParsingException("Unknown EAT tag: " + key); |
| |
| case EatClaim.SECURITY_LEVEL: |
| securityLevel = eatSecurityLevelToKeymasterSecurityLevel( |
| CborUtils.getInt(submodMap, key)); |
| break; |
| case EatClaim.PURPOSE: |
| purposes = CborUtils.getIntSet(submodMap, key); |
| break; |
| case EatClaim.ALGORITHM: |
| algorithm = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.KEY_SIZE: |
| keySize = CborUtils.getInt(submodMap, key); |
| Log.i("Attestation", "Found KEY SIZE, value: " + keySize); |
| break; |
| case EatClaim.DIGEST: |
| digests = CborUtils.getIntSet(submodMap, key); |
| break; |
| case EatClaim.PADDING: |
| paddingModes = CborUtils.getIntSet(submodMap, key); |
| break; |
| case EatClaim.RSA_PUBLIC_EXPONENT: |
| rsaPublicExponent = CborUtils.getLong(submodMap, key); |
| break; |
| case EatClaim.RSA_OAEP_MGF_DIGEST: |
| mRsaOaepMgfDigests = CborUtils.getIntSet(submodMap, key); |
| break; |
| case EatClaim.NO_AUTH_REQUIRED: |
| noAuthRequired = true; |
| break; |
| case EatClaim.IAT: |
| creationDateTime = CborUtils.getDate(submodMap, key); |
| break; |
| case EatClaim.ORIGIN: |
| origin = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.OS_VERSION: |
| osVersion = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.OS_PATCHLEVEL: |
| osPatchLevel = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.VENDOR_PATCHLEVEL: |
| vendorPatchLevel = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.BOOT_PATCHLEVEL: |
| bootPatchLevel = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.ACTIVE_DATETIME: |
| activeDateTime = CborUtils.getDate(submodMap, key); |
| break; |
| case EatClaim.ORIGINATION_EXPIRE_DATETIME: |
| originationExpireDateTime = CborUtils.getDate(submodMap, key); |
| break; |
| case EatClaim.USAGE_EXPIRE_DATETIME: |
| usageExpireDateTime = CborUtils.getDate(submodMap, key); |
| break; |
| case EatClaim.ROLLBACK_RESISTANT: |
| rollbackResistant = true; |
| break; |
| case EatClaim.ROLLBACK_RESISTANCE: |
| rollbackResistance = true; |
| break; |
| case EatClaim.AUTH_TIMEOUT: |
| authTimeout = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.ALLOW_WHILE_ON_BODY: |
| allowWhileOnBody = true; |
| break; |
| case EatClaim.EC_CURVE: |
| ecCurve = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.USER_AUTH_TYPE: |
| userAuthType = CborUtils.getInt(submodMap, key); |
| break; |
| case EatClaim.ATTESTATION_APPLICATION_ID: |
| // TODO: The attestation application ID is currently still encoded as an ASN.1 |
| // structure. Parse a CBOR structure when it's available instead. |
| attestationApplicationId = new AttestationApplicationId( |
| Asn1Utils.getAsn1EncodableFromBytes(CborUtils.getBytes(submodMap, key))); |
| break; |
| case EatClaim.ATTESTATION_ID_BRAND: |
| brand = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.ATTESTATION_ID_DEVICE: |
| device = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.ATTESTATION_ID_PRODUCT: |
| product = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.ATTESTATION_ID_SERIAL: |
| serialNumber = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.UEID: |
| // TODO: Parse depending on encoding chosen in attestation_record.cpp. |
| imei = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.ATTESTATION_ID_MEID: |
| meid = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.ATTESTATION_ID_MANUFACTURER: |
| manufacturer = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.ATTESTATION_ID_MODEL: |
| model = CborUtils.getString(submodMap, key); |
| break; |
| case EatClaim.USER_PRESENCE_REQUIRED: |
| userPresenceRequired = CborUtils.getBoolean(submodMap, key); |
| break; |
| case EatClaim.TRUSTED_CONFIRMATION_REQUIRED: |
| confirmationRequired = true; |
| break; |
| } |
| } |
| } |
| |
| public static String algorithmToString(int algorithm) { |
| switch (algorithm) { |
| case KM_ALGORITHM_RSA: |
| return "RSA"; |
| case KM_ALGORITHM_EC: |
| return "ECDSA"; |
| default: |
| return "Unknown"; |
| } |
| } |
| |
| public static String paddingModesToString(final Set<Integer> paddingModes) { |
| return joinStrings(transform(paddingModes, forMap(paddingMap, "Unknown"))); |
| } |
| |
| public static String paddingModeToString(int paddingMode) { |
| return forMap(paddingMap, "Unknown").apply(paddingMode); |
| } |
| |
| public static String digestsToString(Set<Integer> digests) { |
| return joinStrings(transform(digests, forMap(digestMap, "Unknown"))); |
| } |
| |
| public static String digestToString(int digest) { |
| return forMap(digestMap, "Unknown").apply(digest); |
| } |
| |
| public static String purposesToString(Set<Integer> purposes) { |
| return joinStrings(transform(purposes, forMap(purposeMap, "Unknown"))); |
| } |
| |
| public static String userAuthTypeToString(int userAuthType) { |
| List<String> types = Lists.newArrayList(); |
| if ((userAuthType & HW_AUTH_FINGERPRINT) != 0) |
| types.add("Fingerprint"); |
| if ((userAuthType & HW_AUTH_PASSWORD) != 0) |
| types.add("Password"); |
| return joinStrings(types); |
| } |
| |
| public static String originToString(int origin) { |
| switch (origin) { |
| case KM_ORIGIN_GENERATED: |
| return "Generated"; |
| case KM_ORIGIN_IMPORTED: |
| return "Imported"; |
| case KM_ORIGIN_UNKNOWN: |
| return "Unknown (KM0)"; |
| default: |
| return "Unknown"; |
| } |
| } |
| |
| private static String joinStrings(Collection<String> collection) { |
| return new StringBuilder() |
| .append("[") |
| .append(Joiner.on(", ").join(collection)) |
| .append("]") |
| .toString(); |
| } |
| |
| private static String formatDate(Date date) { |
| return DateFormat.getDateTimeInstance().format(date); |
| } |
| |
| private static ASN1TaggedObject parseAsn1TaggedObject(ASN1SequenceParser parser) |
| throws CertificateParsingException { |
| ASN1Encodable asn1Encodable = parseAsn1Encodable(parser); |
| if (asn1Encodable == null || asn1Encodable instanceof ASN1TaggedObject) { |
| return (ASN1TaggedObject) asn1Encodable; |
| } |
| throw new CertificateParsingException( |
| "Expected tagged object, found " + asn1Encodable.getClass().getName()); |
| } |
| |
| private static ASN1Encodable parseAsn1Encodable(ASN1SequenceParser parser) |
| throws CertificateParsingException { |
| try { |
| return parser.readObject(); |
| } catch (IOException e) { |
| throw new CertificateParsingException("Failed to parse ASN1 sequence", e); |
| } |
| } |
| |
| public Integer getSecurityLevel() { |
| return securityLevel; |
| } |
| |
| public Set<Integer> getPurposes() { |
| return purposes; |
| } |
| |
| public Integer getAlgorithm() { |
| return algorithm; |
| } |
| |
| public Integer getKeySize() { |
| return keySize; |
| } |
| |
| public Set<Integer> getDigests() { |
| return digests; |
| } |
| |
| public Set<Integer> getPaddingModes() { |
| return paddingModes; |
| } |
| |
| public Set<String> getPaddingModesAsStrings() throws CertificateParsingException { |
| if (paddingModes == null) { |
| return ImmutableSet.of(); |
| } |
| |
| ImmutableSet.Builder<String> builder = ImmutableSet.builder(); |
| for (int paddingMode : paddingModes) { |
| switch (paddingMode) { |
| case KM_PAD_NONE: |
| builder.add(KeyProperties.ENCRYPTION_PADDING_NONE); |
| break; |
| case KM_PAD_RSA_OAEP: |
| builder.add(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP); |
| break; |
| case KM_PAD_RSA_PKCS1_1_5_ENCRYPT: |
| builder.add(KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1); |
| break; |
| case KM_PAD_RSA_PKCS1_1_5_SIGN: |
| builder.add(KeyProperties.SIGNATURE_PADDING_RSA_PKCS1); |
| break; |
| case KM_PAD_RSA_PSS: |
| builder.add(KeyProperties.SIGNATURE_PADDING_RSA_PSS); |
| break; |
| default: |
| throw new CertificateParsingException("Invalid padding mode " + paddingMode); |
| } |
| } |
| return builder.build(); |
| } |
| |
| public Integer getEcCurve() { |
| return ecCurve; |
| } |
| |
| public String ecCurveAsString() { |
| if (ecCurve == null) |
| return "NULL"; |
| |
| switch (ecCurve) { |
| case KM_EC_CURVE_P224: |
| return "secp224r1"; |
| case KM_EC_CURVE_P256: |
| return "secp256r1"; |
| case KM_EC_CURVE_P384: |
| return "secp384r1"; |
| case KM_EC_CURVE_P521: |
| return "secp521r1"; |
| case KM_EC_CURVE_25519: |
| return "CURVE_25519"; |
| default: |
| return "unknown"; |
| } |
| } |
| |
| public Long getRsaPublicExponent() { |
| return rsaPublicExponent; |
| } |
| |
| public Set<Integer> getRsaOaepMgfDigests() { |
| return mRsaOaepMgfDigests; |
| } |
| |
| public Date getActiveDateTime() { |
| return activeDateTime; |
| } |
| |
| public Date getOriginationExpireDateTime() { |
| return originationExpireDateTime; |
| } |
| |
| public Date getUsageExpireDateTime() { |
| return usageExpireDateTime; |
| } |
| |
| public boolean isNoAuthRequired() { |
| return noAuthRequired; |
| } |
| |
| public Integer getUserAuthType() { |
| return userAuthType; |
| } |
| |
| public Integer getAuthTimeout() { |
| return authTimeout; |
| } |
| |
| public boolean isAllowWhileOnBody() { |
| return allowWhileOnBody; |
| } |
| |
| public boolean isAllApplications() { |
| return allApplications; |
| } |
| |
| public byte[] getApplicationId() { |
| return applicationId; |
| } |
| |
| public Date getCreationDateTime() { |
| return creationDateTime; |
| } |
| |
| public Integer getOrigin() { |
| return origin; |
| } |
| |
| public boolean isRollbackResistant() { |
| return rollbackResistant; |
| } |
| |
| public boolean isRollbackResistance() { |
| return rollbackResistance; |
| } |
| |
| public RootOfTrust getRootOfTrust() { |
| return rootOfTrust; |
| } |
| |
| public Integer getOsVersion() { |
| return osVersion; |
| } |
| |
| public Integer getOsPatchLevel() { |
| return osPatchLevel; |
| } |
| |
| public Integer getVendorPatchLevel() { |
| return vendorPatchLevel; |
| } |
| |
| public Integer getBootPatchLevel() { |
| return bootPatchLevel; |
| } |
| |
| public AttestationApplicationId getAttestationApplicationId() { |
| return attestationApplicationId; |
| } |
| |
| public String getBrand() { |
| return brand; |
| } |
| |
| public String getDevice() { |
| return device; |
| } |
| |
| public String getSerialNumber() { |
| return serialNumber; |
| }; |
| |
| public String getImei() { |
| return imei; |
| }; |
| |
| public String getMeid() { |
| return meid; |
| }; |
| |
| public String getProduct() { |
| return product; |
| }; |
| |
| public String getManufacturer() { |
| return manufacturer; |
| }; |
| |
| public String getModel() { |
| return model; |
| }; |
| |
| public boolean isUserPresenceRequired() { |
| return userPresenceRequired; |
| } |
| |
| public boolean isConfirmationRequired() { |
| return confirmationRequired; |
| } |
| |
| public String getSecondImei() { |
| return mSecondImei; |
| }; |
| |
| static int eatSecurityLevelToKeymasterSecurityLevel(int eatSecurityLevel) { |
| switch(eatSecurityLevel) { |
| case EatClaim.SECURITY_LEVEL_UNRESTRICTED: |
| return Attestation.KM_SECURITY_LEVEL_SOFTWARE; |
| case EatClaim.SECURITY_LEVEL_SECURE_RESTRICTED: |
| return Attestation.KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT; |
| case EatClaim.SECURITY_LEVEL_HARDWARE: |
| return Attestation.KM_SECURITY_LEVEL_STRONG_BOX; |
| default: |
| throw new RuntimeException("Invalid EAT security level: " + eatSecurityLevel); |
| } |
| } |
| |
| private String getStringFromAsn1Value(ASN1Primitive value) throws CertificateParsingException { |
| try { |
| return Asn1Utils.getStringFromAsn1OctetStreamAssumingUTF8(value); |
| } catch (UnsupportedEncodingException e) { |
| throw new CertificateParsingException("Error parsing ASN.1 value", e); |
| } |
| } |
| |
| @Override |
| public String toString() { |
| StringBuilder s = new StringBuilder(); |
| |
| if (algorithm != null) { |
| s.append("\nAlgorithm: ").append(algorithmToString(algorithm)); |
| } |
| |
| if (keySize != null) { |
| s.append("\nKeySize: ").append(keySize); |
| } |
| |
| if (purposes != null && !purposes.isEmpty()) { |
| s.append("\nPurposes: ").append(purposesToString(purposes)); |
| } |
| |
| if (digests != null && !digests.isEmpty()) { |
| s.append("\nDigests: ").append(digestsToString(digests)); |
| } |
| |
| if (paddingModes != null && !paddingModes.isEmpty()) { |
| s.append("\nPadding modes: ").append(paddingModesToString(paddingModes)); |
| } |
| |
| if (ecCurve != null) { |
| s.append("\nEC Curve: ").append(ecCurveAsString()); |
| } |
| |
| String label = "\nRSA exponent: "; |
| if (rsaPublicExponent != null) { |
| s.append(label).append(rsaPublicExponent); |
| } |
| |
| if (mRsaOaepMgfDigests != null && !mRsaOaepMgfDigests.isEmpty()) { |
| s.append("\nRSA OAEP MGF Digests: ").append(digestsToString(mRsaOaepMgfDigests)); |
| } |
| |
| if (activeDateTime != null) { |
| s.append("\nActive: ").append(formatDate(activeDateTime)); |
| } |
| |
| if (originationExpireDateTime != null) { |
| s.append("\nOrigination expire: ").append(formatDate(originationExpireDateTime)); |
| } |
| |
| if (usageExpireDateTime != null) { |
| s.append("\nUsage expire: ").append(formatDate(usageExpireDateTime)); |
| } |
| |
| if (!noAuthRequired && userAuthType != null) { |
| s.append("\nAuth types: ").append(userAuthTypeToString(userAuthType)); |
| if (authTimeout != null) { |
| s.append("\nAuth timeout: ").append(authTimeout); |
| } |
| } |
| |
| if (applicationId != null) { |
| s.append("\nApplication ID: ").append(new String(applicationId)); |
| } |
| |
| if (creationDateTime != null) { |
| s.append("\nCreated: ").append(formatDate(creationDateTime)); |
| } |
| |
| if (origin != null) { |
| s.append("\nOrigin: ").append(originToString(origin)); |
| } |
| |
| if (rollbackResistant) { |
| s.append("\nRollback resistant: true"); |
| } |
| |
| if (rollbackResistance) { |
| s.append("\nRollback resistance: true"); |
| } |
| |
| if (rootOfTrust != null) { |
| s.append("\nRoot of Trust:\n"); |
| s.append(rootOfTrust); |
| } |
| |
| if (osVersion != null) { |
| s.append("\nOS Version: ").append(osVersion); |
| } |
| |
| if (osPatchLevel != null) { |
| s.append("\nOS Patchlevel: ").append(osPatchLevel); |
| } |
| |
| if (vendorPatchLevel != null) { |
| s.append("\nVendor Patchlevel: ").append(vendorPatchLevel); |
| } |
| |
| if (bootPatchLevel != null) { |
| s.append("\nBoot Patchlevel: ").append(bootPatchLevel); |
| } |
| |
| if (attestationApplicationId != null) { |
| s.append("\nAttestation Application Id:").append(attestationApplicationId); |
| } |
| |
| if (userPresenceRequired) { |
| s.append("\nUser presence required"); |
| } |
| |
| if (confirmationRequired) { |
| s.append("\nConfirmation required"); |
| } |
| |
| if (brand != null) { |
| s.append("\nBrand: ").append(brand); |
| } |
| if (device != null) { |
| s.append("\nDevice type: ").append(device); |
| } |
| return s.toString(); |
| } |
| } |
