Google Git
Sign in
android / platform / system / keymaster / e30b8536b0d94874a2c0a9cc53df48a41ddf043b
commite30b8536b0d94874a2c0a9cc53df48a41ddf043b[log] [tgz]
authorShawn Willden <swillden@google.com>Wed Sep 20 19:51:12 2017 -0600
committerShawn Willden <swillden@google.com>Wed Sep 20 19:51:12 2017 -0600
tree18f947e7cbdbaeebfc7faf50b2774ba08570160e
parent7786f5cda66bab63dfe49eba81c2ed485d3c67dd [diff]
Fix handling of auth-per-op keys and software digesting

When keystore is using a keymaster1 hardware device that does not
implement all digest algorithms (as allowed by the KM1 spec), keystore
does digesting in software and uses the underlying keymaster1 hardware
to perform the core cryptographic operation.

When auth-per-operation keys (i.e. fingerprint-bound keys) are used, a
keymaster operation is created and associated with an "operation
handle" (64-bit integer).  This handle is embedded in the authentication
token generated by the fingerprint matcher, which is what "unlocks" the
key for that one operation.

When those two situations are combined, the SoftKeymasterDevice which
wraps the hardware was caching the keymaster-generated operation handle
for use in completing the operation, but generating its own operation
handle which it returned to keystore.  So the software layer's operation
handle got embedded in the auth token and when that auth token was
presented to the hardware, the hardware refuse to accept it, since it
did not contain the hardware's operation handle.

The fix is to have the software wrapper use the underlying hardware's
operation handle.

Bug: 65286954
Test: Manually tested with app linked on above bug
Change-Id: I320c5d03911942e873680ba0d7ea91044920e936
7 files changed
tree: 18f947e7cbdbaeebfc7faf50b2774ba08570160e
  1. include/
  2. .clang-format
  3. .gitignore
  4. ae.h
  5. aes_key.cpp
  6. aes_key.h
  7. aes_operation.cpp
  8. aes_operation.h
  9. Android.bp
  10. Android.mk
  11. android_keymaster.cpp
  12. android_keymaster_messages.cpp
  13. android_keymaster_messages_test.cpp
  14. android_keymaster_test.cpp
  15. android_keymaster_test_utils.cpp
  16. android_keymaster_test_utils.h
  17. android_keymaster_utils.cpp
  18. asymmetric_key.cpp
  19. asymmetric_key.h
  20. asymmetric_key_factory.cpp
  21. attestation_record.cpp
  22. attestation_record.h
  23. attestation_record_test.cpp
  24. auth_encrypted_key_blob.cpp
  25. auth_encrypted_key_blob.h
  26. authorization_set.cpp
  27. authorization_set_test.cpp
  28. ec_key.cpp
  29. ec_key.h
  30. ec_key_factory.cpp
  31. ec_keymaster0_key.cpp
  32. ec_keymaster0_key.h
  33. ec_keymaster1_key.cpp
  34. ec_keymaster1_key.h
  35. ec_privkey_pk8.der
  36. ecdsa_keymaster1_operation.cpp
  37. ecdsa_keymaster1_operation.h
  38. ecdsa_operation.cpp
  39. ecdsa_operation.h
  40. ecies_kem.cpp
  41. ecies_kem.h
  42. ecies_kem_test.cpp
  43. gtest_main.cpp
  44. hkdf.cpp
  45. hkdf.h
  46. hkdf_test.cpp
  47. hmac.cpp
  48. hmac.h
  49. hmac_key.cpp
  50. hmac_key.h
  51. hmac_operation.cpp
  52. hmac_operation.h
  53. hmac_test.cpp
  54. integrity_assured_key_blob.cpp
  55. integrity_assured_key_blob.h
  56. iso18033kdf.cpp
  57. iso18033kdf.h
  58. kdf.cpp
  59. kdf.h
  60. kdf1.h
  61. kdf1_test.cpp
  62. kdf2.h
  63. kdf2_test.cpp
  64. kdf_test.cpp
  65. kem.h
  66. key.cpp
  67. key.h
  68. key_blob_test.cpp
  69. key_exchange.h
  70. keymaster0_engine.cpp
  71. keymaster0_engine.h
  72. keymaster1_engine.cpp
  73. keymaster1_engine.h
  74. keymaster_configuration.cpp
  75. keymaster_configuration_test.cpp
  76. keymaster_enforcement.cpp
  77. keymaster_enforcement_test.cpp
  78. keymaster_stl.cpp
  79. keymaster_tags.cpp
  80. km0_sw_rsa_512.blob
  81. km1_sw_ecdsa_256.blob
  82. km1_sw_rsa_512.blob
  83. km1_sw_rsa_512_unversioned.blob
  84. List.h
  85. logger.cpp
  86. Makefile
  87. MODULE_LICENSE_APACHE2
  88. nist_curve_key_exchange.cpp
  89. nist_curve_key_exchange.h
  90. nist_curve_key_exchange_test.cpp
  91. NOTICE
  92. ocb.c
  93. ocb_utils.cpp
  94. ocb_utils.h
  95. openssl_err.cpp
  96. openssl_err.h
  97. openssl_utils.cpp
  98. openssl_utils.h
  99. operation.cpp
  100. operation.h
  101. operation_table.cpp
  102. operation_table.h
  103. OWNERS
  104. rsa_key.cpp
  105. rsa_key.h
  106. rsa_key_factory.cpp
  107. rsa_keymaster0_key.cpp
  108. rsa_keymaster0_key.h
  109. rsa_keymaster1_key.cpp
  110. rsa_keymaster1_key.h
  111. rsa_keymaster1_operation.cpp
  112. rsa_keymaster1_operation.h
  113. rsa_operation.cpp
  114. rsa_operation.h
  115. rsa_privkey_pk8.der
  116. serializable.cpp
  117. soft_keymaster_context.cpp
  118. soft_keymaster_device.cpp
  119. soft_keymaster_logger.cpp
  120. sw_rsa_attest_root.key.pem
  121. symmetric_key.cpp
  122. symmetric_key.h
  123. valgrind.supp