diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml index 514d8b8af8..8a7804f3f3 100644 --- a/compatibility_matrices/compatibility_matrix.current.xml +++ b/compatibility_matrices/compatibility_matrix.current.xml @@ -332,6 +332,14 @@ strongbox + + android.hardware.security.dice + 1 + + IDiceDevice + default + + android.hardware.security.keymint 1-2 diff --git a/security/dice/aidl/Android.bp b/security/dice/aidl/Android.bp new file mode 100644 index 0000000000..af9dd33c3b --- /dev/null +++ b/security/dice/aidl/Android.bp @@ -0,0 +1,47 @@ +// Copyright 2021, The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package { + // See: http://go/android-license-faq + // A large-scale-change added 'default_applicable_licenses' to import + // all of the 'license_kinds' from "hardware_interfaces_license" + // to get the below license kinds: + // SPDX-license-identifier-Apache-2.0 + default_applicable_licenses: ["hardware_interfaces_license"], +} + +aidl_interface { + name: "android.hardware.security.dice", + vendor_available: true, + srcs: [ + "android/hardware/security/dice/*.aidl", + ], + stability: "vintf", + backend: { + java: { + enabled: false, + platform_apis: false, + }, + ndk: { + vndk: { + enabled: true, + }, + apps_enabled: false, + }, + rust: { + enabled: true, + }, + }, + // versions: ["1"], +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Bcc.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Bcc.aidl new file mode 100644 index 0000000000..5af73583aa --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Bcc.aidl @@ -0,0 +1,39 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +/* @hide */ +@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability +parcelable Bcc { + byte[] data; +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/BccHandover.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/BccHandover.aidl new file mode 100644 index 0000000000..ab50c369a7 --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/BccHandover.aidl @@ -0,0 +1,41 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +/* @hide */ +@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability +parcelable BccHandover { + byte[] cdiAttest; + byte[] cdiSeal; + android.hardware.security.dice.Bcc bcc; +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Config.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Config.aidl new file mode 100644 index 0000000000..78dd2f886c --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Config.aidl @@ -0,0 +1,39 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +/* @hide */ +@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability +parcelable Config { + byte[] desc; +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/IDiceDevice.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/IDiceDevice.aidl new file mode 100644 index 0000000000..383f4d1f26 --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/IDiceDevice.aidl @@ -0,0 +1,42 @@ +/* + * Copyright (C) 2021 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +/* @hide */ +@SensitiveData @VintfStability +interface IDiceDevice { + android.hardware.security.dice.Signature sign(in android.hardware.security.dice.InputValues[] id, in byte[] payload); + android.hardware.security.dice.Bcc getAttestationChain(in android.hardware.security.dice.InputValues[] inputValues); + android.hardware.security.dice.BccHandover derive(in android.hardware.security.dice.InputValues[] inputValues); + void demote(in android.hardware.security.dice.InputValues[] inputValues); +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/InputValues.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/InputValues.aidl new file mode 100644 index 0000000000..79583fbb98 --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/InputValues.aidl @@ -0,0 +1,44 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +/* @hide */ +@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability +parcelable InputValues { + byte[] codeHash; + android.hardware.security.dice.Config config; + byte[] authorityHash; + @nullable byte[] authorityDescriptor; + android.hardware.security.dice.Mode mode = android.hardware.security.dice.Mode.NOT_INITIALIZED; + byte[] hidden; +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Mode.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Mode.aidl new file mode 100644 index 0000000000..295c32ec0c --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Mode.aidl @@ -0,0 +1,42 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +/* @hide */ +@Backing(type="int") @VintfStability +enum Mode { + NOT_INITIALIZED = 0, + NORMAL = 1, + DEBUG = 2, + RECOVERY = 3, +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/ResponseCode.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/ResponseCode.aidl new file mode 100644 index 0000000000..c13afa6d95 --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/ResponseCode.aidl @@ -0,0 +1,41 @@ +/* + * Copyright 2020, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +@Backing(type="int") @VintfStability +enum ResponseCode { + PERMISSION_DENIED = 1, + SYSTEM_ERROR = 2, + NOT_IMPLEMENTED = 3, + DEMOTION_FAILED = 4, +} diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Signature.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Signature.aidl new file mode 100644 index 0000000000..294170d11f --- /dev/null +++ b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Signature.aidl @@ -0,0 +1,39 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/////////////////////////////////////////////////////////////////////////////// +// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. // +/////////////////////////////////////////////////////////////////////////////// + +// This file is a snapshot of an AIDL file. Do not edit it manually. There are +// two cases: +// 1). this is a frozen version file - do not edit this in any case. +// 2). this is a 'current' file. If you make a backwards compatible change to +// the interface (from the latest frozen version), the build system will +// prompt you to update this file with `m -update-api`. +// +// You must not make a backward incompatible change to any AIDL file built +// with the aidl_interface module type with versions property set. The module +// type is used to build AIDL files in a way that they can be used across +// independently updatable components of the system. If a device is shipped +// with such a backward incompatible change, it has a high risk of breaking +// later when a module using the interface is updated, e.g., Mainline modules. + +package android.hardware.security.dice; +/* @hide */ +@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability +parcelable Signature { + byte[] data; +} diff --git a/security/dice/aidl/android/hardware/security/dice/Bcc.aidl b/security/dice/aidl/android/hardware/security/dice/Bcc.aidl new file mode 100644 index 0000000000..983915e618 --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/Bcc.aidl @@ -0,0 +1,36 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +/** + * A DICE certificate chain following the Boot Certificate Chain (BCC) specification. + * @hide + */ +@VintfStability +@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true) +parcelable Bcc { + /** + * The DICE certificate chain CBOR encoded following the BCC specification. The CDDL + * specification for BCC can be found here [1]. + * + * @see + * BCC CDDL specification + * + */ + byte[] data; +} diff --git a/security/dice/aidl/android/hardware/security/dice/BccHandover.aidl b/security/dice/aidl/android/hardware/security/dice/BccHandover.aidl new file mode 100644 index 0000000000..d522cef7a4 --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/BccHandover.aidl @@ -0,0 +1,46 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +import android.hardware.security.dice.Bcc; + +/** + * Represents one set of DICE artifacts. + * + * @hide + */ +@VintfStability +@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true) +parcelable BccHandover { + /** + * CDI_attest. Must a exactly 32 bytes of data. + */ + byte[] cdiAttest; + /** + * CDI_seal. Must a exactly 32 bytes of data. + */ + byte[] cdiSeal; + /** + * CBOR encoded BCC. + * + * @see + * BCC CDDL specification + * + */ + Bcc bcc; +} diff --git a/security/dice/aidl/android/hardware/security/dice/Config.aidl b/security/dice/aidl/android/hardware/security/dice/Config.aidl new file mode 100644 index 0000000000..6decfc562d --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/Config.aidl @@ -0,0 +1,38 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +/** + * DICE config descriptor as described in at + * + * input-values + * + * @hide + */ +@VintfStability +@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true) +parcelable Config { + /** + * A free form descriptor. This should follow the BCC Configuration Descriptor. + * @see + * BccPayload field -4670548 + * + */ + byte[] desc; +} diff --git a/security/dice/aidl/android/hardware/security/dice/IDiceDevice.aidl b/security/dice/aidl/android/hardware/security/dice/IDiceDevice.aidl new file mode 100644 index 0000000000..709aede7ef --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/IDiceDevice.aidl @@ -0,0 +1,100 @@ +/* + * Copyright (C) 2021 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +import android.hardware.security.dice.Bcc; +import android.hardware.security.dice.BccHandover; +import android.hardware.security.dice.InputValues; +import android.hardware.security.dice.Signature; + +/** + * IDiceDevice specifies an interface that allows access to the Android instance's DICE artifacts. + * + *

Features

+ * + * The dice device provides access to the component's CDI_SEAL and CDI_ATTEST secrets as well + * as to its attestation certificate chain. The "component" is the Android instance running this + * HAL service and the secrets and attestation chain must include all boot stage components, + * the kernel, and the verified boot information (VBA). + * + * Implementations provide the following operations: + *
  • sign - Signing a payload with a key derived from CDI_ATTEST. + *
  • getAttestationChain - Retrieve the component's attestation certificate chain. + *
  • derive - Retrieve the component's DICE artifacts. + * + * @see + * Open-dice Specification + * + * @see + * Boot Certificate Chain (BCC) CDDL specification + * + * @hide + */ +@SensitiveData +@VintfStability +interface IDiceDevice { + /** + * Uses the a key derived from the component's, or a child's given by inputValues, + * attestation secret to sign the payload using RFC 8032 Pure Ed25519 and returns the + * signature. The payload is limited to 1024 bytes. + * + * @see RFC 8032 + */ + Signature sign(in InputValues[] id, in byte[] payload); + + /** + * Returns the attestation chain of the component if inputValues is empty or the + * chain to the given child of the component identified by the inputValues vector. + * + * ## Error as service specific exception: + * ResponseCode::PERMISSION_DENIED if the caller is not sufficiently privileged. + */ + Bcc getAttestationChain(in InputValues[] inputValues); + + /** + * This function allows a client to become a resident node. A resident node is a node that + * manages its own dice secrets as opposed to using them by proxy, i.e., by calling sign + * and getAttestationChain. Called with empty inputValues vectors, an + * implementation returns the component's DICE secrets. If the inputValues vector + * is given the appropriate derivations are performed starting from the component's level. + * + * ## Error as service specific exception: + * ResponseCode::PERMISSION_DENIED if the implementation does not allow resident nodes + * at the client's level. + */ + BccHandover derive(in InputValues[] inputValues); + + /** + * This demotes the implementation of this interface. + * When called, the implementation performs appropriate derivation steps using + * inputValues, traversing the vector in ascending order. Then it replaces its + * stored DICE artifacts with the newly derived ones. + * + * IMPORTANT: When the function returns, all remnants of the previous DICE artifacts must + * have been purged from memory. + * + * This operation is not reversible until the next reboot. Further demotion is always + * possible. + * + * ## Error as service specific exception: + * ResponseCode::DEMOTION_FAILED if the implementation failed to demote itself + * or was unable to purge previous DICE artifacts from memory. + */ + void demote(in InputValues[] inputValues); +} diff --git a/security/dice/aidl/android/hardware/security/dice/InputValues.aidl b/security/dice/aidl/android/hardware/security/dice/InputValues.aidl new file mode 100644 index 0000000000..e44ef22365 --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/InputValues.aidl @@ -0,0 +1,58 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +import android.hardware.security.dice.Config; +import android.hardware.security.dice.Mode; + +/** + * DICE input values for certificate and CDI generation. + * + * @see + * Open-dice input-values + * + * @hide + */ +@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true) +@VintfStability +parcelable InputValues { + /** + * The target code hash. Must be exactly 64 bytes. + */ + byte[] codeHash; + /** + * The configuration data. + */ + Config config; + /** + * The authority hash. Must be exactly 64 bytes. Must be all zero if unused. + */ + byte[] authorityHash; + /** + * Optional free form authorityDescriptor. + */ + @nullable byte[] authorityDescriptor; + /** + * The mode of operation. Normal, Debug, Maintenance, or not initialized. + */ + Mode mode = Mode.NOT_INITIALIZED; + /** + * Optional hidden values. Must be exactly 64 bytes. Must be all zero if unused. + */ + byte[] hidden; +} diff --git a/security/dice/aidl/android/hardware/security/dice/Mode.aidl b/security/dice/aidl/android/hardware/security/dice/Mode.aidl new file mode 100644 index 0000000000..3b3bfdcfd9 --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/Mode.aidl @@ -0,0 +1,38 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +/** + * DICE mode values as defined at + * + * @see + * open-dice mode-value-details + * + * @hide + */ +@Backing(type="int") +@VintfStability +enum Mode { + NOT_INITIALIZED = 0, + NORMAL = 1, + DEBUG = 2, + /** + * The recovery mode is also referred to as "maintenance" mode. + */ + RECOVERY = 3, +} diff --git a/security/dice/aidl/android/hardware/security/dice/ResponseCode.aidl b/security/dice/aidl/android/hardware/security/dice/ResponseCode.aidl new file mode 100644 index 0000000000..3e77cf7d2c --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/ResponseCode.aidl @@ -0,0 +1,43 @@ +/* + * Copyright 2020, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +@Backing(type="int") +/** + * These response codes are used as service specific exception codes by + * IDiceDevice. + * @hide + */ +@VintfStability +enum ResponseCode { + /** + * The caller has insufficient privilege to access the DICE API. + */ + PERMISSION_DENIED = 1, + /** + * An unexpected error occurred, likely with IO or IPC. + */ + SYSTEM_ERROR = 2, + /** + * Returned if the called function is not implemented. + */ + NOT_IMPLEMENTED = 3, + /** + * An attempt to demote the implementation failed. + */ + DEMOTION_FAILED = 4, +} diff --git a/security/dice/aidl/android/hardware/security/dice/Signature.aidl b/security/dice/aidl/android/hardware/security/dice/Signature.aidl new file mode 100644 index 0000000000..ea3594f83a --- /dev/null +++ b/security/dice/aidl/android/hardware/security/dice/Signature.aidl @@ -0,0 +1,32 @@ +/* + * Copyright 2021, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.hardware.security.dice; + +/** + * This parcelable represents a Signature. It is used as return value of IDiceNode::sign. + * + * @hide + */ +@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true) +@VintfStability +parcelable Signature { + /** + * The RFC 8032 PureEd25519 signature. + * @see RFC 8032 + */ + byte[] data; +}