| /* |
| * Copyright (C) 2009 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package android.security; |
| |
| import android.app.Activity; |
| import android.os.Binder; |
| import android.os.IBinder; |
| import android.os.Process; |
| import android.security.keymaster.ExportResult; |
| import android.security.keymaster.KeyCharacteristics; |
| import android.security.keymaster.KeymasterArguments; |
| import android.security.keymaster.KeymasterBlob; |
| import android.security.keymaster.KeymasterDefs; |
| import android.security.keymaster.OperationResult; |
| import android.test.ActivityUnitTestCase; |
| import android.test.AssertionFailedError; |
| import android.test.MoreAsserts; |
| import android.test.suitebuilder.annotation.MediumTest; |
| import com.android.org.conscrypt.NativeConstants; |
| import java.nio.charset.StandardCharsets; |
| import java.util.Arrays; |
| import java.util.HashSet; |
| import java.security.spec.RSAKeyGenParameterSpec; |
| |
| /** |
| * Junit / Instrumentation test case for KeyStore class |
| * |
| * Running the test suite: |
| * |
| * runtest keystore-unit |
| * |
| * Or this individual test case: |
| * |
| * runtest --path frameworks/base/keystore/tests/src/android/security/KeyStoreTest.java |
| */ |
| @MediumTest |
| public class KeyStoreTest extends ActivityUnitTestCase<Activity> { |
| private static final String TEST_PASSWD = "12345678"; |
| private static final String TEST_PASSWD2 = "87654321"; |
| private static final String TEST_KEYNAME = "test-key"; |
| private static final String TEST_KEYNAME1 = "test-key.1"; |
| private static final String TEST_KEYNAME2 = "test-key\02"; |
| private static final byte[] TEST_KEYVALUE = "test value".getBytes(StandardCharsets.UTF_8); |
| |
| // "Hello, World" in Chinese |
| private static final String TEST_I18N_KEY = "\u4F60\u597D, \u4E16\u754C"; |
| private static final byte[] TEST_I18N_VALUE = TEST_I18N_KEY.getBytes(StandardCharsets.UTF_8); |
| |
| // Test vector data for signatures |
| private static final int RSA_KEY_SIZE = 1024; |
| private static final byte[] TEST_DATA = new byte[RSA_KEY_SIZE / 8]; |
| static { |
| for (int i = 0; i < TEST_DATA.length; i++) { |
| TEST_DATA[i] = (byte) i; |
| } |
| } |
| |
| private KeyStore mKeyStore = null; |
| |
| public KeyStoreTest() { |
| super(Activity.class); |
| } |
| |
| private static final byte[] PRIVKEY_BYTES = hexToBytes( |
| "308204BE020100300D06092A864886F70D0101010500048204A8308204A4020100028201" + |
| "0100E0473E8AB8F2284FEB9E742FF9748FA118ED98633C92F52AEB7A2EBE0D3BE60329BE" + |
| "766AD10EB6A515D0D2CFD9BEA7930F0C306537899F7958CD3E85B01F8818524D312584A9" + |
| "4B251E3625B54141EDBFEE198808E1BB97FC7CB49B9EAAAF68E9C98D7D0EDC53BBC0FA00" + |
| "34356D6305FBBCC3C7001405386ABBC873CB0F3EF7425F3D33DF7B315AE036D2A0B66AFD" + |
| "47503B169BF36E3B5162515B715FDA83DEAF2C58AEB9ABFB3097C3CC9DD9DBE5EF296C17" + |
| "6139028E8A671E63056D45F40188D2C4133490845DE52C2534E9C6B2478C07BDAE928823" + |
| "B62D066C7770F9F63F3DBA247F530844747BE7AAA85D853B8BD244ACEC3DE3C89AB46453" + |
| "AB4D24C3AC6902030100010282010037784776A5F17698F5AC960DFB83A1B67564E648BD" + |
| "0597CF8AB8087186F2669C27A9ECBDD480F0197A80D07309E6C6A96F925331E57F8B4AC6" + |
| "F4D45EDA45A23269C09FC428C07A4E6EDF738A15DEC97FABD2F2BB47A14F20EA72FCFE4C" + |
| "36E01ADA77BD137CD8D4DA10BB162E94A4662971F175F985FA188F056CB97EE2816F43AB" + |
| "9D3747612486CDA8C16196C30818A995EC85D38467791267B3BF21F273710A6925862576" + |
| "841C5B6712C12D4BD20A2F3299ADB7C135DA5E9515ABDA76E7CAF2A3BE80551D073B78BF" + |
| "1162C48AD2B7F4743A0238EE4D252F7D5E7E6533CCAE64CCB39360075A2FD1E034EC3AE5" + |
| "CE9C408CCBF0E25E4114021687B3DD4754AE8102818100F541884BC3737B2922D4119EF4" + |
| "5E2DEE2CD4CBB75F45505A157AA5009F99C73A2DF0724AC46024306332EA898177634546" + |
| "5DC6DF1E0A6F140AFF3B7396E6A8994AC5DAA96873472FE37749D14EB3E075E629DBEB35" + |
| "83338A6F3649D0A2654A7A42FD9AB6BFA4AC4D481D390BB229B064BDC311CC1BE1B63189" + |
| "DA7C40CDECF2B102818100EA1A742DDB881CEDB7288C87E38D868DD7A409D15A43F445D5" + |
| "377A0B5731DDBFCA2DAF28A8E13CD5C0AFCEC3347D74A39E235A3CD9633F274DE2B94F92" + |
| "DF43833911D9E9F1CF58F27DE2E08FF45964C720D3EC2139DC7CAFC912953CDECB2F355A" + |
| "2E2C35A50FAD754CB3B23166424BA3B6E3112A2B898C38C5C15EDB238693390281805182" + |
| "8F1EC6FD996029901BAF1D7E337BA5F0AF27E984EAD895ACE62BD7DF4EE45A224089F2CC" + |
| "151AF3CD173FCE0474BCB04F386A2CDCC0E0036BA2419F54579262D47100BE931984A3EF" + |
| "A05BECF141574DC079B3A95C4A83E6C43F3214D6DF32D512DE198085E531E616B83FD7DD" + |
| "9D1F4E2607C3333D07C55D107D1D3893587102818100DB4FB50F50DE8EDB53FF34C80931" + |
| "88A0512867DA2CCA04897759E587C244010DAF8664D59E8083D16C164789301F67A9F078" + |
| "060D834A2ADBD367575B68A8A842C2B02A89B3F31FCCEC8A22FE395795C5C6C7422B4E5D" + |
| "74A1E9A8F30E7759B9FC2D639C1F15673E84E93A5EF1506F4315383C38D45CBD1B14048F" + |
| "4721DC82326102818100D8114593AF415FB612DBF1923710D54D07486205A76A3B431949" + |
| "68C0DFF1F11EF0F61A4A337D5FD3741BBC9640E447B8B6B6C47C3AC1204357D3B0C55BA9" + |
| "286BDA73F629296F5FA9146D8976357D3C751E75148696A40B74685C82CE30902D639D72" + |
| "4FF24D5E2E9407EE34EDED2E3B4DF65AA9BCFEB6DF28D07BA6903F165768"); |
| |
| private static final byte[] AES256_BYTES = hexToBytes( |
| "0CC175B9C0F1B6A831C399E269772661CEC520EA51EA0A47E87295FA3245A605"); |
| |
| private static byte[] hexToBytes(String s) { |
| int len = s.length(); |
| byte[] data = new byte[len / 2]; |
| for (int i = 0; i < len; i += 2) { |
| data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) + Character.digit( |
| s.charAt(i + 1), 16)); |
| } |
| return data; |
| } |
| |
| @Override |
| protected void setUp() throws Exception { |
| mKeyStore = KeyStore.getInstance(); |
| if (mKeyStore.state() != KeyStore.State.UNINITIALIZED) { |
| mKeyStore.reset(); |
| } |
| assertEquals("KeyStore should be in an uninitialized state", |
| KeyStore.State.UNINITIALIZED, mKeyStore.state()); |
| super.setUp(); |
| } |
| |
| @Override |
| protected void tearDown() throws Exception { |
| mKeyStore.reset(); |
| super.tearDown(); |
| } |
| |
| public void testState() throws Exception { |
| assertEquals(KeyStore.State.UNINITIALIZED, mKeyStore.state()); |
| } |
| |
| public void testPassword() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| assertEquals(KeyStore.State.UNLOCKED, mKeyStore.state()); |
| } |
| |
| public void testGet() throws Exception { |
| assertNull(mKeyStore.get(TEST_KEYNAME)); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertNull(mKeyStore.get(TEST_KEYNAME)); |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(Arrays.equals(TEST_KEYVALUE, mKeyStore.get(TEST_KEYNAME))); |
| } |
| |
| public void testPut() throws Exception { |
| assertNull(mKeyStore.get(TEST_KEYNAME)); |
| assertFalse(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(Arrays.equals(TEST_KEYVALUE, mKeyStore.get(TEST_KEYNAME))); |
| } |
| |
| public void testPut_grantedUid_Wifi() throws Exception { |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertFalse(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.WIFI_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.WIFI_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| } |
| |
| public void testPut_ungrantedUid_Bluetooth() throws Exception { |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| assertFalse(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.BLUETOOTH_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertFalse(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.BLUETOOTH_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| } |
| |
| public void testI18n() throws Exception { |
| assertFalse(mKeyStore.put(TEST_I18N_KEY, TEST_I18N_VALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_I18N_KEY)); |
| mKeyStore.onUserPasswordChanged(TEST_I18N_KEY); |
| assertTrue(mKeyStore.put(TEST_I18N_KEY, TEST_I18N_VALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_I18N_KEY)); |
| } |
| |
| public void testDelete() throws Exception { |
| assertFalse(mKeyStore.delete(TEST_KEYNAME)); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertFalse(mKeyStore.delete(TEST_KEYNAME)); |
| |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(Arrays.equals(TEST_KEYVALUE, mKeyStore.get(TEST_KEYNAME))); |
| assertTrue(mKeyStore.delete(TEST_KEYNAME)); |
| assertNull(mKeyStore.get(TEST_KEYNAME)); |
| } |
| |
| public void testDelete_grantedUid_Wifi() throws Exception { |
| assertFalse(mKeyStore.delete(TEST_KEYNAME, Process.WIFI_UID)); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertFalse(mKeyStore.delete(TEST_KEYNAME, Process.WIFI_UID)); |
| |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.WIFI_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertTrue(mKeyStore.delete(TEST_KEYNAME, Process.WIFI_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| } |
| |
| public void testDelete_ungrantedUid_Bluetooth() throws Exception { |
| assertFalse(mKeyStore.delete(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertFalse(mKeyStore.delete(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| |
| assertFalse(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.BLUETOOTH_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| assertFalse(mKeyStore.delete(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| } |
| |
| public void testContains() throws Exception { |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| } |
| |
| public void testContains_grantedUid_Wifi() throws Exception { |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.WIFI_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| } |
| |
| public void testContains_grantedUid_Bluetooth() throws Exception { |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| |
| assertFalse(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, Process.BLUETOOTH_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| } |
| |
| public void testList() throws Exception { |
| String[] emptyResult = mKeyStore.list(TEST_KEYNAME); |
| assertNotNull(emptyResult); |
| assertEquals(0, emptyResult.length); |
| |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| mKeyStore.put(TEST_KEYNAME1, TEST_KEYVALUE, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED); |
| mKeyStore.put(TEST_KEYNAME2, TEST_KEYVALUE, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED); |
| |
| String[] results = mKeyStore.list(TEST_KEYNAME); |
| assertEquals(new HashSet(Arrays.asList(TEST_KEYNAME1.substring(TEST_KEYNAME.length()), |
| TEST_KEYNAME2.substring(TEST_KEYNAME.length()))), |
| new HashSet(Arrays.asList(results))); |
| } |
| |
| public void testList_ungrantedUid_Bluetooth() throws Exception { |
| String[] results1 = mKeyStore.list(TEST_KEYNAME, Process.BLUETOOTH_UID); |
| assertEquals(0, results1.length); |
| |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| mKeyStore.put(TEST_KEYNAME1, TEST_KEYVALUE, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED); |
| mKeyStore.put(TEST_KEYNAME2, TEST_KEYVALUE, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED); |
| |
| String[] results2 = mKeyStore.list(TEST_KEYNAME, Process.BLUETOOTH_UID); |
| assertEquals(0, results2.length); |
| } |
| |
| public void testList_grantedUid_Wifi() throws Exception { |
| String[] results1 = mKeyStore.list(TEST_KEYNAME, Process.WIFI_UID); |
| assertNotNull(results1); |
| assertEquals(0, results1.length); |
| |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| mKeyStore.put(TEST_KEYNAME1, TEST_KEYVALUE, Process.WIFI_UID, KeyStore.FLAG_ENCRYPTED); |
| mKeyStore.put(TEST_KEYNAME2, TEST_KEYVALUE, Process.WIFI_UID, KeyStore.FLAG_ENCRYPTED); |
| |
| String[] results2 = mKeyStore.list(TEST_KEYNAME, Process.WIFI_UID); |
| assertEquals(new HashSet(Arrays.asList(TEST_KEYNAME1.substring(TEST_KEYNAME.length()), |
| TEST_KEYNAME2.substring(TEST_KEYNAME.length()))), |
| new HashSet(Arrays.asList(results2))); |
| } |
| |
| public void testList_grantedUid_Vpn() throws Exception { |
| String[] results1 = mKeyStore.list(TEST_KEYNAME, Process.VPN_UID); |
| assertNotNull(results1); |
| assertEquals(0, results1.length); |
| |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| mKeyStore.put(TEST_KEYNAME1, TEST_KEYVALUE, Process.VPN_UID, KeyStore.FLAG_ENCRYPTED); |
| mKeyStore.put(TEST_KEYNAME2, TEST_KEYVALUE, Process.VPN_UID, KeyStore.FLAG_ENCRYPTED); |
| |
| String[] results2 = mKeyStore.list(TEST_KEYNAME, Process.VPN_UID); |
| assertEquals(new HashSet(Arrays.asList(TEST_KEYNAME1.substring(TEST_KEYNAME.length()), |
| TEST_KEYNAME2.substring(TEST_KEYNAME.length()))), |
| new HashSet(Arrays.asList(results2))); |
| } |
| |
| public void testLock() throws Exception { |
| assertFalse(mKeyStore.lock()); |
| |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertEquals(KeyStore.State.UNLOCKED, mKeyStore.state()); |
| |
| assertTrue(mKeyStore.lock()); |
| assertEquals(KeyStore.State.LOCKED, mKeyStore.state()); |
| } |
| |
| public void testUnlock() throws Exception { |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertEquals(KeyStore.State.UNLOCKED, mKeyStore.state()); |
| mKeyStore.lock(); |
| |
| assertFalse(mKeyStore.unlock(TEST_PASSWD2)); |
| assertTrue(mKeyStore.unlock(TEST_PASSWD)); |
| } |
| |
| public void testIsEmpty() throws Exception { |
| assertTrue(mKeyStore.isEmpty()); |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| assertTrue(mKeyStore.isEmpty()); |
| mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED); |
| assertFalse(mKeyStore.isEmpty()); |
| mKeyStore.reset(); |
| assertTrue(mKeyStore.isEmpty()); |
| } |
| |
| public void testGenerate_NotInitialized_Fail() throws Exception { |
| assertFalse("Should fail when keystore is not initialized", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| } |
| |
| public void testGenerate_Locked_Fail() throws Exception { |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| mKeyStore.lock(); |
| assertFalse("Should fail when keystore is locked", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| } |
| |
| public void testGenerate_Success() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to generate key when unlocked", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| } |
| |
| public void testGenerate_grantedUid_Wifi_Success() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to generate key when unlocked", |
| mKeyStore.generate(TEST_KEYNAME, Process.WIFI_UID, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| } |
| |
| public void testGenerate_ungrantedUid_Bluetooth_Failure() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertFalse(mKeyStore.generate(TEST_KEYNAME, Process.BLUETOOTH_UID, |
| NativeConstants.EVP_PKEY_RSA, RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| } |
| |
| public void testImport_Success() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to import key when unlocked", mKeyStore.importKey(TEST_KEYNAME, |
| PRIVKEY_BYTES, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| } |
| |
| public void testImport_grantedUid_Wifi_Success() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to import key when unlocked", mKeyStore.importKey(TEST_KEYNAME, |
| PRIVKEY_BYTES, Process.WIFI_UID, KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| } |
| |
| public void testImport_ungrantedUid_Bluetooth_Failure() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertFalse(mKeyStore.importKey(TEST_KEYNAME, PRIVKEY_BYTES, Process.BLUETOOTH_UID, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| } |
| |
| public void testImport_Failure_BadEncoding() throws Exception { |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| |
| assertFalse("Invalid DER-encoded key should not be imported", mKeyStore.importKey( |
| TEST_KEYNAME, TEST_DATA, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| } |
| |
| public void testSign_Success() throws Exception { |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| |
| assertTrue(mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| final byte[] signature = mKeyStore.sign(TEST_KEYNAME, TEST_DATA); |
| |
| assertNotNull("Signature should not be null", signature); |
| } |
| |
| public void testVerify_Success() throws Exception { |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| |
| assertTrue(mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| final byte[] signature = mKeyStore.sign(TEST_KEYNAME, TEST_DATA); |
| |
| assertNotNull("Signature should not be null", signature); |
| |
| assertTrue("Signature should verify with same data", |
| mKeyStore.verify(TEST_KEYNAME, TEST_DATA, signature)); |
| } |
| |
| public void testSign_NotInitialized_Failure() throws Exception { |
| assertNull("Should not be able to sign without first initializing the keystore", |
| mKeyStore.sign(TEST_KEYNAME, TEST_DATA)); |
| } |
| |
| public void testSign_NotGenerated_Failure() throws Exception { |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| |
| assertNull("Should not be able to sign without first generating keys", |
| mKeyStore.sign(TEST_KEYNAME, TEST_DATA)); |
| } |
| |
| public void testGrant_Generated_Success() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to generate key for testcase", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| |
| assertTrue("Should be able to grant key to other user", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testGrant_Imported_Success() throws Exception { |
| assertTrue("Password should work for keystore", mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to import key for testcase", mKeyStore.importKey(TEST_KEYNAME, |
| PRIVKEY_BYTES, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED)); |
| |
| assertTrue("Should be able to grant key to other user", mKeyStore.grant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testGrant_NoKey_Failure() throws Exception { |
| assertTrue("Should be able to unlock keystore for test", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertFalse("Should not be able to grant without first initializing the keystore", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testGrant_NotInitialized_Failure() throws Exception { |
| assertFalse("Should not be able to grant without first initializing the keystore", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testUngrant_Generated_Success() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to generate key for testcase", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| |
| assertTrue("Should be able to grant key to other user", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| |
| assertTrue("Should be able to ungrant key to other user", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testUngrant_Imported_Success() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to import key for testcase", mKeyStore.importKey(TEST_KEYNAME, |
| PRIVKEY_BYTES, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED)); |
| |
| assertTrue("Should be able to grant key to other user", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| |
| assertTrue("Should be able to ungrant key to other user", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testUngrant_NotInitialized_Failure() throws Exception { |
| assertFalse("Should fail to ungrant key when keystore not initialized", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testUngrant_NoGrant_Failure() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to generate key for testcase", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| |
| assertFalse("Should not be able to revoke not existent grant", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testUngrant_DoubleUngrant_Failure() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to generate key for testcase", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| |
| assertTrue("Should be able to grant key to other user", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| |
| assertTrue("Should be able to ungrant key to other user", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| |
| assertFalse("Should fail to ungrant key to other user second time", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testUngrant_DoubleGrantUngrant_Failure() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to generate key for testcase", |
| mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| |
| assertTrue("Should be able to grant key to other user", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| |
| assertTrue("Should be able to grant key to other user a second time", |
| mKeyStore.grant(TEST_KEYNAME, 0)); |
| |
| assertTrue("Should be able to ungrant key to other user", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| |
| assertFalse("Should fail to ungrant key to other user second time", |
| mKeyStore.ungrant(TEST_KEYNAME, 0)); |
| } |
| |
| public void testDuplicate_grantedUid_Wifi_Success() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| |
| assertTrue(mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| |
| // source doesn't exist |
| assertFalse(mKeyStore.duplicate(TEST_KEYNAME1, -1, TEST_KEYNAME1, Process.WIFI_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME1, Process.WIFI_UID)); |
| |
| // Copy from current UID to granted UID |
| assertTrue(mKeyStore.duplicate(TEST_KEYNAME, -1, TEST_KEYNAME1, Process.WIFI_UID)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME1)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME1, Process.WIFI_UID)); |
| assertFalse(mKeyStore.duplicate(TEST_KEYNAME, -1, TEST_KEYNAME1, Process.WIFI_UID)); |
| |
| // Copy from granted UID to same granted UID |
| assertTrue(mKeyStore.duplicate(TEST_KEYNAME1, Process.WIFI_UID, TEST_KEYNAME2, |
| Process.WIFI_UID)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.WIFI_UID)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME1, Process.WIFI_UID)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME2, Process.WIFI_UID)); |
| assertFalse(mKeyStore.duplicate(TEST_KEYNAME1, Process.WIFI_UID, TEST_KEYNAME2, |
| Process.WIFI_UID)); |
| |
| assertTrue(mKeyStore.duplicate(TEST_KEYNAME, -1, TEST_KEYNAME2, -1)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME1)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME2)); |
| assertFalse(mKeyStore.duplicate(TEST_KEYNAME, -1, TEST_KEYNAME2, -1)); |
| } |
| |
| public void testDuplicate_ungrantedUid_Bluetooth_Failure() throws Exception { |
| assertTrue(mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| |
| assertTrue(mKeyStore.generate(TEST_KEYNAME, KeyStore.UID_SELF, NativeConstants.EVP_PKEY_RSA, |
| RSA_KEY_SIZE, KeyStore.FLAG_ENCRYPTED, null)); |
| |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| |
| assertFalse(mKeyStore.duplicate(TEST_KEYNAME, -1, TEST_KEYNAME2, Process.BLUETOOTH_UID)); |
| assertFalse(mKeyStore.duplicate(TEST_KEYNAME, Process.BLUETOOTH_UID, TEST_KEYNAME2, |
| Process.BLUETOOTH_UID)); |
| |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME, Process.BLUETOOTH_UID)); |
| } |
| |
| /** |
| * The amount of time to allow before and after expected time for variance |
| * in timing tests. |
| */ |
| private static final long SLOP_TIME_MILLIS = 15000L; |
| |
| public void testGetmtime_Success() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to import key when unlocked", mKeyStore.importKey(TEST_KEYNAME, |
| PRIVKEY_BYTES, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED)); |
| |
| long now = System.currentTimeMillis(); |
| long actual = mKeyStore.getmtime(TEST_KEYNAME); |
| |
| long expectedAfter = now - SLOP_TIME_MILLIS; |
| long expectedBefore = now + SLOP_TIME_MILLIS; |
| |
| assertLessThan("Time should be close to current time", expectedBefore, actual); |
| assertGreaterThan("Time should be close to current time", expectedAfter, actual); |
| } |
| |
| private static void assertLessThan(String explanation, long expectedBefore, long actual) { |
| if (actual >= expectedBefore) { |
| throw new AssertionFailedError(explanation + ": actual=" + actual |
| + ", expected before: " + expectedBefore); |
| } |
| } |
| |
| private static void assertGreaterThan(String explanation, long expectedAfter, long actual) { |
| if (actual <= expectedAfter) { |
| throw new AssertionFailedError(explanation + ": actual=" + actual |
| + ", expected after: " + expectedAfter); |
| } |
| } |
| |
| public void testGetmtime_NonExist_Failure() throws Exception { |
| assertTrue("Password should work for keystore", |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD)); |
| |
| assertTrue("Should be able to import key when unlocked", mKeyStore.importKey(TEST_KEYNAME, |
| PRIVKEY_BYTES, KeyStore.UID_SELF, KeyStore.FLAG_ENCRYPTED)); |
| |
| assertEquals("-1 should be returned for non-existent key", |
| -1L, mKeyStore.getmtime(TEST_KEYNAME2)); |
| } |
| |
| private KeyCharacteristics generateRsaKey(String name) throws Exception { |
| KeymasterArguments args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_ENCRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_DECRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_RSA); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, 2048); |
| args.addUnsignedLong(KeymasterDefs.KM_TAG_RSA_PUBLIC_EXPONENT, RSAKeyGenParameterSpec.F4); |
| |
| KeyCharacteristics outCharacteristics = new KeyCharacteristics(); |
| int result = mKeyStore.generateKey(name, args, null, 0, outCharacteristics); |
| assertEquals("generateRsaKey should succeed", KeyStore.NO_ERROR, result); |
| return outCharacteristics; |
| } |
| |
| public void testGenerateKey() throws Exception { |
| generateRsaKey("test"); |
| mKeyStore.delete("test"); |
| } |
| |
| public void testGenerateRsaWithEntropy() throws Exception { |
| byte[] entropy = new byte[] {1,2,3,4,5}; |
| String name = "test"; |
| KeymasterArguments args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_ENCRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_DECRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_RSA); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, 2048); |
| args.addUnsignedLong(KeymasterDefs.KM_TAG_RSA_PUBLIC_EXPONENT, RSAKeyGenParameterSpec.F4); |
| |
| KeyCharacteristics outCharacteristics = new KeyCharacteristics(); |
| int result = mKeyStore.generateKey(name, args, entropy, 0, outCharacteristics); |
| assertEquals("generateKey should succeed", KeyStore.NO_ERROR, result); |
| } |
| |
| public void testGenerateAndDelete() throws Exception { |
| generateRsaKey("test"); |
| assertTrue("delete should succeed", mKeyStore.delete("test")); |
| } |
| |
| public void testGetKeyCharacteristicsSuccess() throws Exception { |
| mKeyStore.onUserPasswordChanged(TEST_PASSWD); |
| String name = "test"; |
| KeyCharacteristics gen = generateRsaKey(name); |
| KeyCharacteristics call = new KeyCharacteristics(); |
| int result = mKeyStore.getKeyCharacteristics(name, null, null, call); |
| assertEquals("getKeyCharacteristics should succeed", KeyStore.NO_ERROR, result); |
| mKeyStore.delete("test"); |
| } |
| |
| public void testAppId() throws Exception { |
| String name = "test"; |
| byte[] id = new byte[] {0x01, 0x02, 0x03}; |
| KeymasterArguments args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_ENCRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_DECRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_RSA); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, 2048); |
| args.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, KeymasterDefs.KM_MODE_ECB); |
| args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); |
| args.addBytes(KeymasterDefs.KM_TAG_APPLICATION_ID, id); |
| args.addUnsignedLong(KeymasterDefs.KM_TAG_RSA_PUBLIC_EXPONENT, RSAKeyGenParameterSpec.F4); |
| |
| KeyCharacteristics outCharacteristics = new KeyCharacteristics(); |
| int result = mKeyStore.generateKey(name, args, null, 0, outCharacteristics); |
| assertEquals("generateRsaKey should succeed", KeyStore.NO_ERROR, result); |
| assertEquals("getKeyCharacteristics should fail without application ID", |
| KeymasterDefs.KM_ERROR_INVALID_KEY_BLOB, |
| mKeyStore.getKeyCharacteristics(name, null, null, outCharacteristics)); |
| assertEquals("getKeyCharacteristics should succeed with application ID", |
| KeyStore.NO_ERROR, |
| mKeyStore.getKeyCharacteristics(name, new KeymasterBlob(id), null, |
| outCharacteristics)); |
| } |
| |
| |
| public void testExportRsa() throws Exception { |
| String name = "test"; |
| generateRsaKey(name); |
| ExportResult result = mKeyStore.exportKey(name, KeymasterDefs.KM_KEY_FORMAT_X509, null, |
| null); |
| assertEquals("Export success", KeyStore.NO_ERROR, result.resultCode); |
| // TODO: Verify we have an RSA public key that's well formed. |
| } |
| |
| public void testAesGcmEncryptSuccess() throws Exception { |
| String name = "test"; |
| KeymasterArguments args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_ENCRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_DECRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, 256); |
| args.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, KeymasterDefs.KM_MODE_GCM); |
| args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); |
| |
| KeyCharacteristics outCharacteristics = new KeyCharacteristics(); |
| int rc = mKeyStore.generateKey(name, args, null, 0, outCharacteristics); |
| assertEquals("Generate should succeed", KeyStore.NO_ERROR, rc); |
| |
| args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); |
| args.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, KeymasterDefs.KM_MODE_GCM); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_MAC_LENGTH, 128); |
| OperationResult result = mKeyStore.begin(name, KeymasterDefs.KM_PURPOSE_ENCRYPT, |
| true, args, null); |
| IBinder token = result.token; |
| assertEquals("Begin should succeed", KeyStore.NO_ERROR, result.resultCode); |
| result = mKeyStore.update(token, null, new byte[] {0x01, 0x02, 0x03, 0x04}); |
| assertEquals("Update should succeed", KeyStore.NO_ERROR, result.resultCode); |
| assertEquals("Finish should succeed", KeyStore.NO_ERROR, |
| mKeyStore.finish(token, null, null).resultCode); |
| // TODO: Assert that an AEAD tag was returned by finish |
| } |
| |
| public void testBadToken() throws Exception { |
| IBinder token = new Binder(); |
| OperationResult result = mKeyStore.update(token, null, new byte[] {0x01}); |
| assertEquals("Update with invalid token should fail", |
| KeymasterDefs.KM_ERROR_INVALID_OPERATION_HANDLE, result.resultCode); |
| } |
| |
| private int importAesKey(String name, byte[] key, int size, int mode) { |
| KeymasterArguments args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_ENCRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_DECRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| args.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, mode); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, size); |
| args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); |
| return mKeyStore.importKey(name, args, KeymasterDefs.KM_KEY_FORMAT_RAW, key, 0, |
| new KeyCharacteristics()); |
| } |
| private byte[] doOperation(String name, int purpose, byte[] in, KeymasterArguments beginArgs) { |
| OperationResult result = mKeyStore.begin(name, purpose, |
| true, beginArgs, null); |
| assertEquals("Begin should succeed", KeyStore.NO_ERROR, result.resultCode); |
| IBinder token = result.token; |
| result = mKeyStore.update(token, null, in); |
| assertEquals("Update should succeed", KeyStore.NO_ERROR, result.resultCode); |
| assertEquals("All data should be consumed", in.length, result.inputConsumed); |
| assertEquals("Finish should succeed", KeyStore.NO_ERROR, |
| mKeyStore.finish(token, null, null).resultCode); |
| return result.output; |
| } |
| |
| public void testImportAes() throws Exception { |
| int result = importAesKey("aes", AES256_BYTES, 256, KeymasterDefs.KM_MODE_ECB); |
| assertEquals("import should succeed", KeyStore.NO_ERROR, result); |
| mKeyStore.delete("aes"); |
| } |
| |
| public void testAes256Ecb() throws Exception { |
| byte[] key = |
| hexToBytes("603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4"); |
| String name = "aes"; |
| assertEquals(KeyStore.NO_ERROR, importAesKey(name, key, 256, KeymasterDefs.KM_MODE_ECB)); |
| byte[][] testVectors = new byte[][] { |
| hexToBytes("6bc1bee22e409f96e93d7e117393172a"), |
| hexToBytes("ae2d8a571e03ac9c9eb76fac45af8e51"), |
| hexToBytes("30c81c46a35ce411e5fbc1191a0a52ef"), |
| hexToBytes("f69f2445df4f9b17ad2b417be66c3710")}; |
| byte[][] cipherVectors = new byte[][] { |
| hexToBytes("f3eed1bdb5d2a03c064b5a7e3db181f8"), |
| hexToBytes("591ccb10d410ed26dc5ba74a31362870"), |
| hexToBytes("b6ed21b99ca6f4f9f153e7b1beafed1d"), |
| hexToBytes("23304b7a39f9f3ff067d8d8f9e24ecc7")}; |
| KeymasterArguments beginArgs = new KeymasterArguments(); |
| beginArgs.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); |
| beginArgs.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, KeymasterDefs.KM_MODE_ECB); |
| beginArgs.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| for (int i = 0; i < testVectors.length; i++) { |
| byte[] cipherText = doOperation(name, KeymasterDefs.KM_PURPOSE_ENCRYPT, testVectors[i], |
| beginArgs); |
| MoreAsserts.assertEquals(cipherVectors[i], cipherText); |
| } |
| for (int i = 0; i < testVectors.length; i++) { |
| byte[] plainText = doOperation(name, KeymasterDefs.KM_PURPOSE_DECRYPT, |
| cipherVectors[i], beginArgs); |
| MoreAsserts.assertEquals(testVectors[i], plainText); |
| } |
| } |
| |
| // This is a very implementation specific test and should be thrown out eventually, however it |
| // is nice for now to test that keystore is properly pruning operations. |
| public void testOperationPruning() throws Exception { |
| String name = "test"; |
| KeymasterArguments args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_ENCRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_DECRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, 256); |
| args.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, KeymasterDefs.KM_MODE_CTR); |
| args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); |
| |
| KeyCharacteristics outCharacteristics = new KeyCharacteristics(); |
| int rc = mKeyStore.generateKey(name, args, null, 0, outCharacteristics); |
| assertEquals("Generate should succeed", KeyStore.NO_ERROR, rc); |
| |
| args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); |
| args.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, KeymasterDefs.KM_MODE_CTR); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE); |
| OperationResult result = mKeyStore.begin(name, KeymasterDefs.KM_PURPOSE_ENCRYPT, |
| true, args, null); |
| assertEquals("Begin should succeed", KeyStore.NO_ERROR, result.resultCode); |
| IBinder first = result.token; |
| // Implementation detail: softkeymaster supports 16 concurrent operations |
| for (int i = 0; i < 16; i++) { |
| result = mKeyStore.begin(name, KeymasterDefs.KM_PURPOSE_ENCRYPT, true, args, null); |
| assertEquals("Begin should succeed", KeyStore.NO_ERROR, result.resultCode); |
| } |
| // At this point the first operation should be pruned. |
| assertEquals("Operation should be pruned", KeymasterDefs.KM_ERROR_INVALID_OPERATION_HANDLE, |
| mKeyStore.update(first, null, new byte[] {0x01}).resultCode); |
| } |
| |
| public void testAuthNeeded() throws Exception { |
| String name = "test"; |
| KeymasterArguments args = new KeymasterArguments(); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_ENCRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_DECRYPT); |
| args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); |
| args.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_PKCS7); |
| args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, 256); |
| args.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, KeymasterDefs.KM_MODE_ECB); |
| args.addEnum(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, 1); |
| |
| KeyCharacteristics outCharacteristics = new KeyCharacteristics(); |
| int rc = mKeyStore.generateKey(name, args, null, 0, outCharacteristics); |
| assertEquals("Generate should succeed", KeyStore.NO_ERROR, rc); |
| OperationResult result = mKeyStore.begin(name, KeymasterDefs.KM_PURPOSE_ENCRYPT, |
| true, args, null); |
| assertEquals("Begin should expect authorization", KeyStore.OP_AUTH_NEEDED, |
| result.resultCode); |
| IBinder token = result.token; |
| result = mKeyStore.update(token, null, new byte[] {0x01, 0x02, 0x03, 0x04}); |
| assertEquals("Update should require authorization", |
| KeymasterDefs.KM_ERROR_KEY_USER_NOT_AUTHENTICATED, result.resultCode); |
| } |
| |
| public void testPasswordRemovalEncryptedEntry() throws Exception { |
| mKeyStore.onUserPasswordChanged("test"); |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_ENCRYPTED)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertTrue(Arrays.equals(TEST_KEYVALUE, mKeyStore.get(TEST_KEYNAME))); |
| mKeyStore.onUserPasswordChanged(""); |
| // Removing the password should have deleted all entries using FLAG_ENCRYPTED |
| assertNull(mKeyStore.get(TEST_KEYNAME)); |
| assertFalse(mKeyStore.contains(TEST_KEYNAME)); |
| } |
| |
| public void testPasswordRemovalUnencryptedEntry() throws Exception { |
| mKeyStore.onUserPasswordChanged("test"); |
| assertTrue(mKeyStore.put(TEST_KEYNAME, TEST_KEYVALUE, KeyStore.UID_SELF, |
| KeyStore.FLAG_NONE)); |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertTrue(Arrays.equals(TEST_KEYVALUE, mKeyStore.get(TEST_KEYNAME))); |
| mKeyStore.onUserPasswordChanged(""); |
| // Removing the password should not delete unencrypted entries. |
| assertTrue(mKeyStore.contains(TEST_KEYNAME)); |
| assertTrue(Arrays.equals(TEST_KEYVALUE, mKeyStore.get(TEST_KEYNAME))); |
| } |
| } |
