Snap for 5434517 from a8dca9ec4437a09360612f11d65aa4f53cb0098f to qt-release
Change-Id: Ia8d8699b585cd41dbeba081018954913e03612d8
diff --git a/android_keymaster/keymaster_enforcement.cpp b/android_keymaster/keymaster_enforcement.cpp
index e8bc2b2..bc42511 100644
--- a/android_keymaster/keymaster_enforcement.cpp
+++ b/android_keymaster/keymaster_enforcement.cpp
@@ -147,22 +147,30 @@
const AuthorizationSet& operation_params,
keymaster_operation_handle_t op_handle) {
int auth_type_index = -1;
+ int trusted_confirmation_index = -1;
for (size_t pos = 0; pos < auth_set.size(); ++pos) {
switch (auth_set[pos].tag) {
- case KM_TAG_NO_AUTH_REQUIRED:
- case KM_TAG_AUTH_TIMEOUT:
- // If no auth is required or if auth is timeout-based, we have nothing to check.
- return KM_ERROR_OK;
-
case KM_TAG_USER_AUTH_TYPE:
auth_type_index = pos;
break;
+ case KM_TAG_TRUSTED_CONFIRMATION_REQUIRED:
+ trusted_confirmation_index = pos;
+ break;
+ case KM_TAG_NO_AUTH_REQUIRED:
+ case KM_TAG_AUTH_TIMEOUT:
+ // If no auth is required or if auth is timeout-based, we have nothing to check.
default:
break;
}
}
+ // TODO verify trusted confirmation mac once we have a shared secret established
+ // For now, since we do not have such a service, any token offered here must be invalid.
+ if (trusted_confirmation_index != -1) {
+ return KM_ERROR_NO_USER_CONFIRMATION;
+ }
+
// Note that at this point we should be able to assume that authentication is required, because
// authentication is required if KM_TAG_NO_AUTH_REQUIRED is absent. However, there are legacy
// keys which have no authentication-related tags, so we assume that absence is equivalent to
@@ -345,6 +353,7 @@
case KM_TAG_UNIQUE_ID:
case KM_TAG_RESET_SINCE_ID_ROTATION:
case KM_TAG_ALLOW_WHILE_ON_BODY:
+ case KM_TAG_TRUSTED_CONFIRMATION_REQUIRED:
break;
/* TODO(bcyoung): This is currently handled in keystore, but may move to keymaster in the
diff --git a/android_keymaster/keymaster_tags.cpp b/android_keymaster/keymaster_tags.cpp
index 7ee3728..b26d0ee 100644
--- a/android_keymaster/keymaster_tags.cpp
+++ b/android_keymaster/keymaster_tags.cpp
@@ -109,6 +109,8 @@
return "KM_TAG_RESET_SINCE_ID_ROTATION";
case KM_TAG_ALLOW_WHILE_ON_BODY:
return "KM_TAG_ALLOW_WHILE_ON_BODY";
+ case KM_TAG_TRUSTED_CONFIRMATION_REQUIRED:
+ return "KM_TAG_TRUSTED_CONFIRMATION_REQUIRED";
case KM_TAG_UNLOCKED_DEVICE_REQUIRED:
return "KM_TAG_UNLOCKED_DEVICE_REQUIRED";
case KM_TAG_ATTESTATION_CHALLENGE:
@@ -181,6 +183,7 @@
DEFINE_KEYMASTER_TAG(KM_BYTES, TAG_ATTESTATION_ID_MANUFACTURER);
DEFINE_KEYMASTER_TAG(KM_BYTES, TAG_ATTESTATION_ID_MODEL);
DEFINE_KEYMASTER_TAG(KM_BOOL, TAG_UNLOCKED_DEVICE_REQUIRED);
+DEFINE_KEYMASTER_TAG(KM_BOOL, TAG_TRUSTED_CONFIRMATION_REQUIRED);
// DEFINE_KEYMASTER_ENUM_TAG is used to create TypedEnumTag instances for each enum keymaster tag.
diff --git a/include/keymaster/attestation_record.h b/include/keymaster/attestation_record.h
index 6c97c4b..905252d 100644
--- a/include/keymaster/attestation_record.h
+++ b/include/keymaster/attestation_record.h
@@ -71,6 +71,7 @@
ASN1_INTEGER* user_auth_type;
ASN1_INTEGER* auth_timeout;
ASN1_NULL* allow_while_on_body;
+ ASN1_NULL* trusted_confirmation_required;
ASN1_NULL* unlocked_device_required;
ASN1_NULL* all_applications;
ASN1_OCTET_STRING* application_id;
diff --git a/include/keymaster/keymaster_tags.h b/include/keymaster/keymaster_tags.h
index ac614fe..daa7b19 100644
--- a/include/keymaster/keymaster_tags.h
+++ b/include/keymaster/keymaster_tags.h
@@ -154,6 +154,7 @@
DECLARE_KEYMASTER_TAG(KM_UINT, TAG_AUTH_TIMEOUT);
DECLARE_KEYMASTER_TAG(KM_BOOL, TAG_ALLOW_WHILE_ON_BODY);
DECLARE_KEYMASTER_TAG(KM_BOOL, TAG_UNLOCKED_DEVICE_REQUIRED);
+DECLARE_KEYMASTER_TAG(KM_BOOL, TAG_TRUSTED_CONFIRMATION_REQUIRED);
DECLARE_KEYMASTER_TAG(KM_BOOL, TAG_ALL_APPLICATIONS);
DECLARE_KEYMASTER_TAG(KM_BYTES, TAG_APPLICATION_ID);
DECLARE_KEYMASTER_TAG(KM_BYTES, TAG_APPLICATION_DATA);
diff --git a/include/keymaster/km_openssl/ecdsa_operation.h b/include/keymaster/km_openssl/ecdsa_operation.h
index 6050784..4be0d2e 100644
--- a/include/keymaster/km_openssl/ecdsa_operation.h
+++ b/include/keymaster/km_openssl/ecdsa_operation.h
@@ -84,20 +84,20 @@
private:
KeyType registry_key() const override { return KeyType(KM_ALGORITHM_EC, purpose()); }
OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) override;
+ keymaster_error_t* error) const override;
const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
virtual keymaster_purpose_t purpose() const = 0;
virtual Operation* InstantiateOperation(AuthorizationSet&& hw_enforced,
AuthorizationSet&& sw_enforced,
- keymaster_digest_t digest, EVP_PKEY* key) = 0;
+ keymaster_digest_t digest, EVP_PKEY* key) const = 0;
};
class EcdsaSignOperationFactory : public EcdsaOperationFactory {
private:
keymaster_purpose_t purpose() const override { return KM_PURPOSE_SIGN; }
Operation* InstantiateOperation(AuthorizationSet&& hw_enforced, AuthorizationSet&& sw_enforced,
- keymaster_digest_t digest, EVP_PKEY* key) override {
+ keymaster_digest_t digest, EVP_PKEY* key) const override {
return new (std::nothrow)
EcdsaSignOperation(move(hw_enforced), move(sw_enforced), digest, key);
}
@@ -107,7 +107,7 @@
public:
keymaster_purpose_t purpose() const override { return KM_PURPOSE_VERIFY; }
Operation* InstantiateOperation(AuthorizationSet&& hw_enforced, AuthorizationSet&& sw_enforced,
- keymaster_digest_t digest, EVP_PKEY* key) override {
+ keymaster_digest_t digest, EVP_PKEY* key) const override {
return new (std::nothrow)
EcdsaVerifyOperation(move(hw_enforced), move(sw_enforced), digest, key);
}
diff --git a/include/keymaster/km_openssl/rsa_operation.h b/include/keymaster/km_openssl/rsa_operation.h
index 578a3d2..dd14b57 100644
--- a/include/keymaster/km_openssl/rsa_operation.h
+++ b/include/keymaster/km_openssl/rsa_operation.h
@@ -188,7 +188,7 @@
virtual keymaster_purpose_t purpose() const = 0;
OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) override {
+ keymaster_error_t* error) const override {
return OperationPtr(CreateRsaOperation(move(key), begin_params, error));
}
const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
@@ -196,13 +196,14 @@
protected:
static EVP_PKEY* GetRsaKey(Key&& key, keymaster_error_t* error);
virtual RsaOperation* CreateRsaOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error);
+ keymaster_error_t* error) const;
private:
virtual RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
AuthorizationSet&& sw_enforced,
keymaster_digest_t digest,
- keymaster_padding_t padding, EVP_PKEY* key) = 0;
+ keymaster_padding_t padding,
+ EVP_PKEY* key) const = 0;
};
/**
@@ -220,7 +221,7 @@
class RsaCryptingOperationFactory : public RsaOperationFactory {
public:
RsaOperation* CreateRsaOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) override;
+ keymaster_error_t* error) const override;
const keymaster_padding_t* SupportedPaddingModes(size_t* padding_mode_count) const override;
};
@@ -232,7 +233,7 @@
keymaster_purpose_t purpose() const override { return KM_PURPOSE_SIGN; }
RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
- keymaster_padding_t padding, EVP_PKEY* key) override {
+ keymaster_padding_t padding, EVP_PKEY* key) const override {
return new (std::nothrow)
RsaSignOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
}
@@ -245,7 +246,7 @@
keymaster_purpose_t purpose() const override { return KM_PURPOSE_VERIFY; }
RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
- keymaster_padding_t padding, EVP_PKEY* key) override {
+ keymaster_padding_t padding, EVP_PKEY* key) const override {
return new (std::nothrow)
RsaVerifyOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
}
@@ -258,7 +259,7 @@
keymaster_purpose_t purpose() const override { return KM_PURPOSE_ENCRYPT; }
RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
- keymaster_padding_t padding, EVP_PKEY* key) override {
+ keymaster_padding_t padding, EVP_PKEY* key) const override {
return new (std::nothrow)
RsaEncryptOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
}
@@ -271,7 +272,7 @@
keymaster_purpose_t purpose() const override { return KM_PURPOSE_DECRYPT; }
RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
- keymaster_padding_t padding, EVP_PKEY* key) override {
+ keymaster_padding_t padding, EVP_PKEY* key) const override {
return new (std::nothrow)
RsaDecryptOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
}
diff --git a/include/keymaster/operation.h b/include/keymaster/operation.h
index 682aadf..f643e6b 100644
--- a/include/keymaster/operation.h
+++ b/include/keymaster/operation.h
@@ -53,7 +53,7 @@
// Factory methods
virtual OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) = 0;
+ keymaster_error_t* error) const = 0;
// Informational methods. The returned arrays reference static memory and must not be
// deallocated or modified.
diff --git a/km_openssl/attestation_record.cpp b/km_openssl/attestation_record.cpp
index 2c94bbf..279088d 100644
--- a/km_openssl/attestation_record.cpp
+++ b/km_openssl/attestation_record.cpp
@@ -229,6 +229,9 @@
case KM_TAG_CALLER_NONCE:
bool_ptr = &record->caller_nonce;
break;
+ case KM_TAG_TRUSTED_CONFIRMATION_REQUIRED:
+ bool_ptr = &record->trusted_confirmation_required;
+ break;
/* Byte arrays*/
case KM_TAG_APPLICATION_ID:
@@ -707,6 +710,13 @@
record->attestation_id_model->length))
return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+ // Trusted confirmation required
+ if (record->trusted_confirmation_required) {
+ if (!auth_list->push_back(TAG_NO_AUTH_REQUIRED)) {
+ return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+ }
+ }
+
return KM_ERROR_OK;
}
diff --git a/km_openssl/block_cipher_operation.cpp b/km_openssl/block_cipher_operation.cpp
index 20bd2a6..91440ea 100644
--- a/km_openssl/block_cipher_operation.cpp
+++ b/km_openssl/block_cipher_operation.cpp
@@ -78,7 +78,7 @@
OperationPtr BlockCipherOperationFactory::CreateOperation(Key&& key,
const AuthorizationSet& begin_params,
- keymaster_error_t* error) {
+ keymaster_error_t* error) const {
*error = KM_ERROR_OK;
keymaster_block_mode_t block_mode;
if (!begin_params.GetTagValue(TAG_BLOCK_MODE, &block_mode)) {
diff --git a/km_openssl/block_cipher_operation.h b/km_openssl/block_cipher_operation.h
index 1da94eb..92f510e 100644
--- a/km_openssl/block_cipher_operation.h
+++ b/km_openssl/block_cipher_operation.h
@@ -52,7 +52,7 @@
}
OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) override;
+ keymaster_error_t* error) const override;
const keymaster_block_mode_t* SupportedBlockModes(size_t* block_mode_count) const override {
return GetCipherDescription().SupportedBlockModes(block_mode_count);
diff --git a/km_openssl/ecdsa_operation.cpp b/km_openssl/ecdsa_operation.cpp
index 59ce624..cd9f1ce 100644
--- a/km_openssl/ecdsa_operation.cpp
+++ b/km_openssl/ecdsa_operation.cpp
@@ -29,7 +29,7 @@
KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512};
OperationPtr EcdsaOperationFactory::CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) {
+ keymaster_error_t* error) const {
const EcKey& ecdsa_key = static_cast<EcKey&>(key);
UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKEY_new());
diff --git a/km_openssl/hmac_operation.cpp b/km_openssl/hmac_operation.cpp
index 30edf36..46941dc 100644
--- a/km_openssl/hmac_operation.cpp
+++ b/km_openssl/hmac_operation.cpp
@@ -35,7 +35,7 @@
namespace keymaster {
OperationPtr HmacOperationFactory::CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) {
+ keymaster_error_t* error) const {
uint32_t min_mac_length_bits;
if (!key.authorizations().GetTagValue(TAG_MIN_MAC_LENGTH, &min_mac_length_bits)) {
LOG_E("HMAC key must have KM_TAG_MIN_MAC_LENGTH", 0);
diff --git a/km_openssl/hmac_operation.h b/km_openssl/hmac_operation.h
index e67af93..3485f70 100644
--- a/km_openssl/hmac_operation.h
+++ b/km_openssl/hmac_operation.h
@@ -56,7 +56,7 @@
virtual KeyType registry_key() const { return KeyType(KM_ALGORITHM_HMAC, purpose()); }
virtual OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error);
+ keymaster_error_t* error) const;
virtual const keymaster_digest_t* SupportedDigests(size_t* digest_count) const;
diff --git a/km_openssl/rsa_operation.cpp b/km_openssl/rsa_operation.cpp
index b8d1443..d2ceeb5 100644
--- a/km_openssl/rsa_operation.cpp
+++ b/km_openssl/rsa_operation.cpp
@@ -61,7 +61,7 @@
RsaOperation* RsaOperationFactory::CreateRsaOperation(Key&& key,
const AuthorizationSet& begin_params,
- keymaster_error_t* error) {
+ keymaster_error_t* error) const {
keymaster_padding_t padding;
if (!GetAndValidatePadding(begin_params, key, &padding, error)) return nullptr;
@@ -90,7 +90,7 @@
RsaOperation* RsaCryptingOperationFactory::CreateRsaOperation(Key&& key,
const AuthorizationSet& begin_params,
- keymaster_error_t* error) {
+ keymaster_error_t* error) const {
UniquePtr<RsaOperation> op(
RsaOperationFactory::CreateRsaOperation(move(key), begin_params, error));
if (op.get()) {
diff --git a/legacy_support/ecdsa_keymaster1_operation.cpp b/legacy_support/ecdsa_keymaster1_operation.cpp
index e3d2ace..f3cc4a2 100644
--- a/legacy_support/ecdsa_keymaster1_operation.cpp
+++ b/legacy_support/ecdsa_keymaster1_operation.cpp
@@ -97,7 +97,7 @@
OperationPtr EcdsaKeymaster1OperationFactory::CreateOperation(Key&& key,
const AuthorizationSet& begin_params,
- keymaster_error_t* error) {
+ keymaster_error_t* error) const {
keymaster_digest_t digest;
if (!GetAndValidateDigest(begin_params, key, &digest, error)) return nullptr;
diff --git a/legacy_support/ecdsa_keymaster1_operation.h b/legacy_support/ecdsa_keymaster1_operation.h
index a24cc2b..5867a55 100644
--- a/legacy_support/ecdsa_keymaster1_operation.h
+++ b/legacy_support/ecdsa_keymaster1_operation.h
@@ -108,7 +108,7 @@
KeyType registry_key() const override { return KeyType(KM_ALGORITHM_EC, purpose_); }
OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) override;
+ keymaster_error_t* error) const override;
const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
const keymaster_padding_t* SupportedPaddingModes(size_t* padding_mode_count) const override;
diff --git a/legacy_support/keymaster_passthrough_operation.h b/legacy_support/keymaster_passthrough_operation.h
index 29c0372..aadcc73 100644
--- a/legacy_support/keymaster_passthrough_operation.h
+++ b/legacy_support/keymaster_passthrough_operation.h
@@ -102,7 +102,7 @@
// Factory methods
OperationPtr CreateOperation(Key&& key, const AuthorizationSet& /*begin_params*/,
- keymaster_error_t* error) override {
+ keymaster_error_t* error) const override {
if (!error) return nullptr;
*error = KM_ERROR_OK;
OperationPtr op(new (std::nothrow) KeymasterPassthroughOperation<KeymasterDeviceType>(
diff --git a/legacy_support/rsa_keymaster1_operation.cpp b/legacy_support/rsa_keymaster1_operation.cpp
index dd2c094..c313206 100644
--- a/legacy_support/rsa_keymaster1_operation.cpp
+++ b/legacy_support/rsa_keymaster1_operation.cpp
@@ -118,7 +118,7 @@
OperationPtr RsaKeymaster1OperationFactory::CreateOperation(Key&& key,
const AuthorizationSet& begin_params,
- keymaster_error_t* error) {
+ keymaster_error_t* error) const {
keymaster_digest_t digest;
if (!GetAndValidateDigest(begin_params, key, &digest, error)) return nullptr;
diff --git a/legacy_support/rsa_keymaster1_operation.h b/legacy_support/rsa_keymaster1_operation.h
index c0219ea..04d82c9 100644
--- a/legacy_support/rsa_keymaster1_operation.h
+++ b/legacy_support/rsa_keymaster1_operation.h
@@ -108,7 +108,7 @@
KeyType registry_key() const override { return KeyType(KM_ALGORITHM_RSA, purpose_); }
OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
- keymaster_error_t* error) override;
+ keymaster_error_t* error) const override;
const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
const keymaster_padding_t* SupportedPaddingModes(size_t* padding_mode_count) const override;
