keymaster_enforcement.cpp - platform/system/keymaster - Git at Google

 /*
  * Copyright (C) 2014 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #include <string.h>
 #include <time.h>

 #include "android_keymaster_test_utils.h"
 #include "keymaster_enforcement.h"

 namespace keymaster {

 KeymasterEnforcement::KeymasterEnforcement() {
     last_auth_time = -1;
 }

 KeymasterEnforcement::~KeymasterEnforcement() {
 }

 keymaster_error_t KeymasterEnforcement::AuthorizeOperation(const keymaster_purpose_t purpose,
                                                            const km_id_t keyid,
                                                            const AuthorizationSet& auth_set,
                                                            const uid_t uid) {
     time_t current_time;
     keymaster_error_t return_error;

     /* Pairs of tags that are incompatible and should return an error. */
     bool tag_all_users_present = false;
     bool tag_user_id_present = false;

     bool tag_user_auth_id_present = false;
     bool tag_no_auth_required_present = false;

     bool tag_all_applications_present = false;
     bool tag_application_id_present = false;

     return_error = KM_ERROR_OK;
     current_time = get_current_time();

     int auth_timeout_index = auth_set.find(KM_TAG_AUTH_TIMEOUT);
     if (auth_timeout_index < 0) {
         /* TODO: Require Authentication. Method TBD. */
     }

     if ((return_error = valid_purpose(purpose, auth_set)) != KM_ERROR_OK)
         return return_error;

     for (unsigned int i = 0; i < auth_set.size(); i++) {
         keymaster_key_param_t param = auth_set[i];

         // KM_TAG_PADDING_OLD and KM_TAG_DIGEST_OLD aren't actually members of the enum, so we can't
         // switch on them.  There's nothing to validate for them, though, so just ignore them.
         if (param.tag == KM_TAG_PADDING_OLD || param.tag == KM_TAG_DIGEST_OLD)
             continue;

         switch (param.tag) {
         case KM_TAG_ACTIVE_DATETIME:
             return_error = Active(param, current_time);
             break;
         case KM_TAG_ORIGINATION_EXPIRE_DATETIME:
             return_error = OriginationNotExpired(param, current_time, purpose);
             break;
         case KM_TAG_USAGE_EXPIRE_DATETIME:
             return_error = UsageNotExpired(param, current_time, purpose);
             break;
         case KM_TAG_MIN_SECONDS_BETWEEN_OPS:
             return_error = MinTimeBetweenOpsPassed(param, keyid, current_time);
             break;
         case KM_TAG_MAX_USES_PER_BOOT:
             return_error = NotUsedSinceBoot(keyid);
             break;
         case KM_TAG_ALL_USERS:
             tag_all_users_present = true;
             return_error = KM_ERROR_OK;
             break;
         case KM_TAG_USER_ID:
             tag_user_id_present = true;
             return_error = UserAuthenticated(param, uid);
             break;
         case KM_TAG_USER_SECURE_ID:
             // TODO(swillden): Handle this.
             break;
         case KM_TAG_AUTH_TOKEN:
             // TODO(swillden): Handle this.
             break;
         case KM_TAG_NO_AUTH_REQUIRED:
             return_error = KM_ERROR_OK;
             tag_no_auth_required_present = true;
             break;
         case KM_TAG_USER_AUTH_TYPE:
             tag_user_auth_id_present = true;
             return_error = KM_ERROR_OK;
             break;
         case KM_TAG_AUTH_TIMEOUT:
             return_error = AuthenticationIsFresh(param, current_time);
             break;
         case KM_TAG_ALL_APPLICATIONS:
             tag_all_applications_present = true;
             break;
         case KM_TAG_APPLICATION_ID:
             tag_application_id_present = true;
             break;
         case KM_TAG_CALLER_NONCE:
             // TODO(swillden): Handle this tag.  For now it's ignored.
             break;

         /* Invalid tag is not used for access control. */
         case KM_TAG_INVALID:

         /* Tags used for cryptographic parameters. */
         case KM_TAG_PURPOSE:
         case KM_TAG_ALGORITHM:
         case KM_TAG_KEY_SIZE:
         case KM_TAG_BLOCK_MODE:
         case KM_TAG_DIGEST:
         case KM_TAG_MAC_LENGTH:
         case KM_TAG_PADDING:
         case KM_TAG_NONCE:

         /* Tags not used for operations. */
         case KM_TAG_BLOB_USAGE_REQUIREMENTS:

         /* Algorithm specific parameters not used for access control. */
         case KM_TAG_RSA_PUBLIC_EXPONENT:

         /* Informational tags. */
         case KM_TAG_APPLICATION_DATA:
         case KM_TAG_CREATION_DATETIME:
         case KM_TAG_ORIGIN:
         case KM_TAG_ROLLBACK_RESISTANT:
         case KM_TAG_ROOT_OF_TRUST:

         /* Tag to provide data to operations. */
         case KM_TAG_ASSOCIATED_DATA:
             return_error = KM_ERROR_OK;
             break;
         default:
             // TODO(swillden): remove this default case.
             return_error = KM_ERROR_UNIMPLEMENTED;
             break;
         }

         if (return_error != KM_ERROR_OK) {
             return return_error;
         }
     }

     if ((tag_all_users_present && tag_user_id_present) ||
         (tag_user_auth_id_present && tag_no_auth_required_present) ||
         (tag_all_applications_present && tag_application_id_present)) {
         return_error = KM_ERROR_INVALID_TAG;
     }

     if (return_error == KM_ERROR_OK) {
         update_key_access_time(keyid);
     }

     return return_error;
 }

 keymaster_error_t KeymasterEnforcement::Active(const keymaster_key_param_t param,
                                                const time_t current_time) {
     time_t activation_time = param.date_time;
     if (difftime(current_time, activation_time) < 0) {
         return KM_ERROR_KEY_NOT_YET_VALID;
     }

     return KM_ERROR_OK;
 }

 keymaster_error_t KeymasterEnforcement::is_time_expired(const keymaster_key_param_t param,
                                                         const time_t current_time) {
     time_t expire_time = param.date_time;
     if (difftime(current_time, expire_time) > 0) {
         return KM_ERROR_KEY_EXPIRED;
     }
     return KM_ERROR_OK;
 }

 keymaster_error_t KeymasterEnforcement::UsageNotExpired(const keymaster_key_param_t param,
                                                         const time_t current_time,
                                                         const keymaster_purpose_t purpose) {
     switch (purpose) {
     case KM_PURPOSE_VERIFY:
     case KM_PURPOSE_DECRYPT:
         break;
     case KM_PURPOSE_SIGN:
     case KM_PURPOSE_ENCRYPT:
         return KM_ERROR_OK;
     }

     return is_time_expired(param, current_time);
 }

 keymaster_error_t KeymasterEnforcement::OriginationNotExpired(const keymaster_key_param_t param,
                                                               const time_t current_time,
                                                               const keymaster_purpose_t purpose) {
     switch (purpose) {
     case KM_PURPOSE_SIGN:
     case KM_PURPOSE_ENCRYPT:
         break;
     case KM_PURPOSE_DECRYPT:
     case KM_PURPOSE_VERIFY:
         return KM_ERROR_OK;
     }
     return is_time_expired(param, current_time);
 }

 keymaster_error_t KeymasterEnforcement::MinTimeBetweenOpsPassed(const keymaster_key_param_t param,
                                                                 const km_id_t keyid,
                                                                 const time_t current_time) {
     uint32_t min_time_between = param.integer;

     if (difftime(current_time, get_last_access_time(keyid)) < min_time_between) {
         return KM_ERROR_TOO_MANY_OPERATIONS;
     }
     return KM_ERROR_OK;
 }

 keymaster_error_t KeymasterEnforcement::NotUsedSinceBoot(const km_id_t keyid) {
     if (get_last_access_time(keyid) > -1) {
         return KM_ERROR_TOO_MANY_OPERATIONS;
     }
     return KM_ERROR_OK;
 }

 keymaster_error_t KeymasterEnforcement::UserAuthenticated(const keymaster_key_param_t param,
                                                           const uid_t uid) {
     uint32_t valid_user_id = param.integer;
     uint32_t user_id_to_test = get_user_id_from_uid(uid);

     if (valid_user_id == user_id_to_test) {
         return KM_ERROR_OK;
     } else {
         return KM_ERROR_INVALID_USER_ID;
     }
 }

 keymaster_error_t KeymasterEnforcement::AuthenticationIsFresh(const keymaster_key_param_t param,
                                                               const time_t current_time) const {
     time_t last_auth_time = get_last_auth_time();
     time_t required_time = param.integer;
     if (difftime(current_time, last_auth_time) > required_time) {
         return KM_ERROR_OK;
     } else {
         return KM_ERROR_KEY_USER_NOT_AUTHENTICATED;
     }
 }

 void KeymasterEnforcement::update_key_access_time(const km_id_t keyid) {
     accessTimeMap.update_key_access_time(keyid, get_current_time());
 }

 time_t KeymasterEnforcement::get_current_time() const {
     return time(NULL);
 }

 time_t KeymasterEnforcement::get_last_access_time(km_id_t keyid) {
     return accessTimeMap.last_key_access_time(keyid);
 }

 uint32_t KeymasterEnforcement::get_user_id_from_uid(uid_t uid) {
     uint32_t userId = uid / MULTIUSER_APP_PER_USER_RANGE;
     return userId;
 }

 time_t KeymasterEnforcement::get_last_auth_time() const {
     return last_auth_time;
 }

 void KeymasterEnforcement::UpdateUserAuthenticationTime() {
     last_auth_time = get_current_time();
 }

 bool KeymasterEnforcement::supported_purpose(const keymaster_purpose_t purpose) {
     switch (purpose) {
     case KM_PURPOSE_ENCRYPT:
     case KM_PURPOSE_DECRYPT:
     case KM_PURPOSE_SIGN:
     case KM_PURPOSE_VERIFY:
         return true;
         break;
     }
     return false;
 }

 bool KeymasterEnforcement::supported_purposes(const AuthorizationSet& auth_set) {
     int purpose_index;
     keymaster_purpose_t test_purpose;

     purpose_index = auth_set.find(KM_TAG_PURPOSE);
     for (; purpose_index >= 0; purpose_index = auth_set.find(KM_TAG_PURPOSE, purpose_index)) {
         test_purpose = static_cast<keymaster_purpose_t>(auth_set[purpose_index].enumerated);
         if (!supported_purpose(test_purpose)) {
             return false;
         }
     }

     return true;
 }

 keymaster_error_t KeymasterEnforcement::valid_purpose(const keymaster_purpose_t purpose,
                                                       const AuthorizationSet& auth_set) {
     if (!supported_purpose(purpose) || !supported_purposes(auth_set)) {
         return KM_ERROR_UNSUPPORTED_PURPOSE;
     }

     keymaster_purpose_t test_purpose;
     for (int purpose_index = auth_set.find(KM_TAG_PURPOSE); purpose_index >= 0;
          purpose_index = auth_set.find(KM_TAG_PURPOSE, purpose_index)) {
         test_purpose = static_cast<keymaster_purpose_t>(auth_set[purpose_index].enumerated);
         if (test_purpose == purpose) {
             return KM_ERROR_OK;
         }
     }

     return KM_ERROR_INCOMPATIBLE_PURPOSE;
 }

 KeymasterEnforcement::AccessTimeMap::AccessTimeMap() {
 }

 List<access_time_struct>::iterator KeymasterEnforcement::AccessTimeMap::find(uint32_t key_index) {
     List<access_time_struct>::iterator posn;

     posn = last_access_list.begin();
     for (; (*posn).keyid != key_index && posn != last_access_list.end(); posn++) {
     }
     return posn;
 }

 void KeymasterEnforcement::AccessTimeMap::update_key_access_time(uint32_t key_index,
                                                                  time_t current_time) {
     List<access_time_struct>::iterator posn;

     posn = find(key_index);
     if (posn != last_access_list.end()) {
         (*posn).access_time = current_time;
     } else {
         access_time_struct ac;
         ac.keyid = key_index;
         ac.access_time = current_time;
         last_access_list.push_front(ac);
     }
 }

 time_t KeymasterEnforcement::AccessTimeMap::last_key_access_time(uint32_t key_index) {
     List<access_time_struct>::iterator posn;

     posn = find(key_index);
     if (posn != last_access_list.end()) {
         return (*posn).access_time;
     }
     return -1;
 }

 }; /* namespace keymaster */
	/*
	* Copyright (C) 2014 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include <string.h>
	#include <time.h>

	#include "android_keymaster_test_utils.h"
	#include "keymaster_enforcement.h"

	namespace keymaster {

	KeymasterEnforcement::KeymasterEnforcement() {
	last_auth_time = -1;
	}

	KeymasterEnforcement::~KeymasterEnforcement() {
	}

	keymaster_error_t KeymasterEnforcement::AuthorizeOperation(const keymaster_purpose_t purpose,
	const km_id_t keyid,
	const AuthorizationSet& auth_set,
	const uid_t uid) {
	time_t current_time;
	keymaster_error_t return_error;

	/* Pairs of tags that are incompatible and should return an error. */
	bool tag_all_users_present = false;
	bool tag_user_id_present = false;

	bool tag_user_auth_id_present = false;
	bool tag_no_auth_required_present = false;

	bool tag_all_applications_present = false;
	bool tag_application_id_present = false;

	return_error = KM_ERROR_OK;
	current_time = get_current_time();

	int auth_timeout_index = auth_set.find(KM_TAG_AUTH_TIMEOUT);
	if (auth_timeout_index < 0) {
	/* TODO: Require Authentication. Method TBD. */
	}

	if ((return_error = valid_purpose(purpose, auth_set)) != KM_ERROR_OK)
	return return_error;

	for (unsigned int i = 0; i < auth_set.size(); i++) {
	keymaster_key_param_t param = auth_set[i];

	// KM_TAG_PADDING_OLD and KM_TAG_DIGEST_OLD aren't actually members of the enum, so we can't
	// switch on them. There's nothing to validate for them, though, so just ignore them.
	if (param.tag == KM_TAG_PADDING_OLD \|\| param.tag == KM_TAG_DIGEST_OLD)
	continue;

	switch (param.tag) {
	case KM_TAG_ACTIVE_DATETIME:
	return_error = Active(param, current_time);
	break;
	case KM_TAG_ORIGINATION_EXPIRE_DATETIME:
	return_error = OriginationNotExpired(param, current_time, purpose);
	break;
	case KM_TAG_USAGE_EXPIRE_DATETIME:
	return_error = UsageNotExpired(param, current_time, purpose);
	break;
	case KM_TAG_MIN_SECONDS_BETWEEN_OPS:
	return_error = MinTimeBetweenOpsPassed(param, keyid, current_time);
	break;
	case KM_TAG_MAX_USES_PER_BOOT:
	return_error = NotUsedSinceBoot(keyid);
	break;
	case KM_TAG_ALL_USERS:
	tag_all_users_present = true;
	return_error = KM_ERROR_OK;
	break;
	case KM_TAG_USER_ID:
	tag_user_id_present = true;
	return_error = UserAuthenticated(param, uid);
	break;
	case KM_TAG_USER_SECURE_ID:
	// TODO(swillden): Handle this.
	break;
	case KM_TAG_AUTH_TOKEN:
	// TODO(swillden): Handle this.
	break;
	case KM_TAG_NO_AUTH_REQUIRED:
	return_error = KM_ERROR_OK;
	tag_no_auth_required_present = true;
	break;
	case KM_TAG_USER_AUTH_TYPE:
	tag_user_auth_id_present = true;
	return_error = KM_ERROR_OK;
	break;
	case KM_TAG_AUTH_TIMEOUT:
	return_error = AuthenticationIsFresh(param, current_time);
	break;
	case KM_TAG_ALL_APPLICATIONS:
	tag_all_applications_present = true;
	break;
	case KM_TAG_APPLICATION_ID:
	tag_application_id_present = true;
	break;
	case KM_TAG_CALLER_NONCE:
	// TODO(swillden): Handle this tag. For now it's ignored.
	break;

	/* Invalid tag is not used for access control. */
	case KM_TAG_INVALID:

	/* Tags used for cryptographic parameters. */
	case KM_TAG_PURPOSE:
	case KM_TAG_ALGORITHM:
	case KM_TAG_KEY_SIZE:
	case KM_TAG_BLOCK_MODE:
	case KM_TAG_DIGEST:
	case KM_TAG_MAC_LENGTH:
	case KM_TAG_PADDING:
	case KM_TAG_NONCE:

	/* Tags not used for operations. */
	case KM_TAG_BLOB_USAGE_REQUIREMENTS:

	/* Algorithm specific parameters not used for access control. */
	case KM_TAG_RSA_PUBLIC_EXPONENT:

	/* Informational tags. */
	case KM_TAG_APPLICATION_DATA:
	case KM_TAG_CREATION_DATETIME:
	case KM_TAG_ORIGIN:
	case KM_TAG_ROLLBACK_RESISTANT:
	case KM_TAG_ROOT_OF_TRUST:

	/* Tag to provide data to operations. */
	case KM_TAG_ASSOCIATED_DATA:
	return_error = KM_ERROR_OK;
	break;
	default:
	// TODO(swillden): remove this default case.
	return_error = KM_ERROR_UNIMPLEMENTED;
	break;
	}

	if (return_error != KM_ERROR_OK) {
	return return_error;
	}
	}

	if ((tag_all_users_present && tag_user_id_present) \|\|
	(tag_user_auth_id_present && tag_no_auth_required_present) \|\|
	(tag_all_applications_present && tag_application_id_present)) {
	return_error = KM_ERROR_INVALID_TAG;
	}

	if (return_error == KM_ERROR_OK) {
	update_key_access_time(keyid);
	}

	return return_error;
	}

	keymaster_error_t KeymasterEnforcement::Active(const keymaster_key_param_t param,
	const time_t current_time) {
	time_t activation_time = param.date_time;
	if (difftime(current_time, activation_time) < 0) {
	return KM_ERROR_KEY_NOT_YET_VALID;
	}

	return KM_ERROR_OK;
	}

	keymaster_error_t KeymasterEnforcement::is_time_expired(const keymaster_key_param_t param,
	const time_t current_time) {
	time_t expire_time = param.date_time;
	if (difftime(current_time, expire_time) > 0) {
	return KM_ERROR_KEY_EXPIRED;
	}
	return KM_ERROR_OK;
	}

	keymaster_error_t KeymasterEnforcement::UsageNotExpired(const keymaster_key_param_t param,
	const time_t current_time,
	const keymaster_purpose_t purpose) {
	switch (purpose) {
	case KM_PURPOSE_VERIFY:
	case KM_PURPOSE_DECRYPT:
	break;
	case KM_PURPOSE_SIGN:
	case KM_PURPOSE_ENCRYPT:
	return KM_ERROR_OK;
	}

	return is_time_expired(param, current_time);
	}

	keymaster_error_t KeymasterEnforcement::OriginationNotExpired(const keymaster_key_param_t param,
	const time_t current_time,
	const keymaster_purpose_t purpose) {
	switch (purpose) {
	case KM_PURPOSE_SIGN:
	case KM_PURPOSE_ENCRYPT:
	break;
	case KM_PURPOSE_DECRYPT:
	case KM_PURPOSE_VERIFY:
	return KM_ERROR_OK;
	}
	return is_time_expired(param, current_time);
	}

	keymaster_error_t KeymasterEnforcement::MinTimeBetweenOpsPassed(const keymaster_key_param_t param,
	const km_id_t keyid,
	const time_t current_time) {
	uint32_t min_time_between = param.integer;

	if (difftime(current_time, get_last_access_time(keyid)) < min_time_between) {
	return KM_ERROR_TOO_MANY_OPERATIONS;
	}
	return KM_ERROR_OK;
	}

	keymaster_error_t KeymasterEnforcement::NotUsedSinceBoot(const km_id_t keyid) {
	if (get_last_access_time(keyid) > -1) {
	return KM_ERROR_TOO_MANY_OPERATIONS;
	}
	return KM_ERROR_OK;
	}

	keymaster_error_t KeymasterEnforcement::UserAuthenticated(const keymaster_key_param_t param,
	const uid_t uid) {
	uint32_t valid_user_id = param.integer;
	uint32_t user_id_to_test = get_user_id_from_uid(uid);

	if (valid_user_id == user_id_to_test) {
	return KM_ERROR_OK;
	} else {
	return KM_ERROR_INVALID_USER_ID;
	}
	}

	keymaster_error_t KeymasterEnforcement::AuthenticationIsFresh(const keymaster_key_param_t param,
	const time_t current_time) const {
	time_t last_auth_time = get_last_auth_time();
	time_t required_time = param.integer;
	if (difftime(current_time, last_auth_time) > required_time) {
	return KM_ERROR_OK;
	} else {
	return KM_ERROR_KEY_USER_NOT_AUTHENTICATED;
	}
	}

	void KeymasterEnforcement::update_key_access_time(const km_id_t keyid) {
	accessTimeMap.update_key_access_time(keyid, get_current_time());
	}

	time_t KeymasterEnforcement::get_current_time() const {
	return time(NULL);
	}

	time_t KeymasterEnforcement::get_last_access_time(km_id_t keyid) {
	return accessTimeMap.last_key_access_time(keyid);
	}

	uint32_t KeymasterEnforcement::get_user_id_from_uid(uid_t uid) {
	uint32_t userId = uid / MULTIUSER_APP_PER_USER_RANGE;
	return userId;
	}

	time_t KeymasterEnforcement::get_last_auth_time() const {
	return last_auth_time;
	}

	void KeymasterEnforcement::UpdateUserAuthenticationTime() {
	last_auth_time = get_current_time();
	}

	bool KeymasterEnforcement::supported_purpose(const keymaster_purpose_t purpose) {
	switch (purpose) {
	case KM_PURPOSE_ENCRYPT:
	case KM_PURPOSE_DECRYPT:
	case KM_PURPOSE_SIGN:
	case KM_PURPOSE_VERIFY:
	return true;
	break;
	}
	return false;
	}

	bool KeymasterEnforcement::supported_purposes(const AuthorizationSet& auth_set) {
	int purpose_index;
	keymaster_purpose_t test_purpose;

	purpose_index = auth_set.find(KM_TAG_PURPOSE);
	for (; purpose_index >= 0; purpose_index = auth_set.find(KM_TAG_PURPOSE, purpose_index)) {
	test_purpose = static_cast<keymaster_purpose_t>(auth_set[purpose_index].enumerated);
	if (!supported_purpose(test_purpose)) {
	return false;
	}
	}

	return true;
	}

	keymaster_error_t KeymasterEnforcement::valid_purpose(const keymaster_purpose_t purpose,
	const AuthorizationSet& auth_set) {
	if (!supported_purpose(purpose) \|\| !supported_purposes(auth_set)) {
	return KM_ERROR_UNSUPPORTED_PURPOSE;
	}

	keymaster_purpose_t test_purpose;
	for (int purpose_index = auth_set.find(KM_TAG_PURPOSE); purpose_index >= 0;
	purpose_index = auth_set.find(KM_TAG_PURPOSE, purpose_index)) {
	test_purpose = static_cast<keymaster_purpose_t>(auth_set[purpose_index].enumerated);
	if (test_purpose == purpose) {
	return KM_ERROR_OK;
	}
	}

	return KM_ERROR_INCOMPATIBLE_PURPOSE;
	}

	KeymasterEnforcement::AccessTimeMap::AccessTimeMap() {
	}

	List<access_time_struct>::iterator KeymasterEnforcement::AccessTimeMap::find(uint32_t key_index) {
	List<access_time_struct>::iterator posn;

	posn = last_access_list.begin();
	for (; (*posn).keyid != key_index && posn != last_access_list.end(); posn++) {
	}
	return posn;
	}

	void KeymasterEnforcement::AccessTimeMap::update_key_access_time(uint32_t key_index,
	time_t current_time) {
	List<access_time_struct>::iterator posn;

	posn = find(key_index);
	if (posn != last_access_list.end()) {
	(*posn).access_time = current_time;
	} else {
	access_time_struct ac;
	ac.keyid = key_index;
	ac.access_time = current_time;
	last_access_list.push_front(ac);
	}
	}

	time_t KeymasterEnforcement::AccessTimeMap::last_key_access_time(uint32_t key_index) {
	List<access_time_struct>::iterator posn;

	posn = find(key_index);
	if (posn != last_access_list.end()) {
	return (*posn).access_time;
	}
	return -1;
	}

	}; /* namespace keymaster */