Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 22:04:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "Improve unique attestation docs & tests"

Browse Source
This commit is contained in:
Treehugger Robot
2021-06-07 11:22:48 +00:00
committed by Gerrit Code Review
parent b49e67dca7 90747ad701
commit 0872e42bec
2 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
View File

@@ -831,14 +831,24 @@ enum Tag {
/**
* DEVICE_UNIQUE_ATTESTATION is an argument to IKeyMintDevice::attested key generation/import
* operations. It indicates that attestation using a device-unique key is requested, rather
* than a batch key. When a device-unique key is used, only the attestation certificate is
* returned; no additional chained certificates are provided. It's up to the caller to
* recognize the device-unique signing key. Only SecurityLevel::STRONGBOX IKeyMintDevices may
* support device-unique attestations. SecurityLevel::TRUSTED_ENVIRONMENT IKeyMintDevices must
* return ErrorCode::INVALID_ARGUMENT if they receive DEVICE_UNIQUE_ATTESTATION.
* than a batch key. When a device-unique key is used, the returned chain should contain two
* certificates:
* * The attestation certificate, containing the attestation extension, as described in
KeyCreationResult.aidl.
* * A self-signed root certificate, signed by the device-unique key.
* No additional chained certificates are provided. Only SecurityLevel::STRONGBOX
* IKeyMintDevices may support device-unique attestations. SecurityLevel::TRUSTED_ENVIRONMENT
* IKeyMintDevices must return ErrorCode::INVALID_ARGUMENT if they receive
* DEVICE_UNIQUE_ATTESTATION.
* SecurityLevel::STRONGBOX IKeyMintDevices need not support DEVICE_UNIQUE_ATTESTATION, and
* return ErrorCode::CANNOT_ATTEST_IDS if they do not support it.
*
* The caller needs to obtain the device-unique keys out-of-band and compare them against the
* key used to sign the self-signed root certificate.
* To ease this process, the IKeyMintDevice implementation should include, both in the subject
* and issuer fields of the self-signed root, the unique identifier of the device. Using the
* unique identifier will make it straightforward for the caller to link a device to its key.
*
* IKeyMintDevice implementations that support device-unique attestation MUST add the
* DEVICE_UNIQUE_ATTESTATION tag to device-unique attestations.
*/

5
security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp
View File

@@ -42,8 +42,11 @@ class DeviceUniqueAttestationTest : public KeyMintAidlTestBase {
EXPECT_TRUE(crypto_params.Contains(TAG_KEY_SIZE, key_size)) << "Key size missing";
// The device-unique attestation chain should contain exactly two certificates:
// * The leaf with the attestation extension.
// * A self-signed root, signed using the device-unique key.
ASSERT_EQ(cert_chain_.size(), 2);
EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_));
ASSERT_GT(cert_chain_.size(), 0);
AuthorizationSet sw_enforced = SwEnforcedAuthorizations(key_characteristics);
EXPECT_TRUE(verify_attestation_record("challenge", "foo", sw_enforced, hw_enforced,