Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-02 20:24:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't pass ATTEST_KEY for symmetric key generation

Browse Source 
Bug: 379228013
Bug: 380375179
Test: VtsAidlKeyMintTargetTest
Change-Id: I6b87a8997a3b9cf0f45f362ca91707546cc953d1
This commit is contained in:
David Drysdale
2024-11-26 09:40:38 +00:00
parent 5a36dba491
commit 6d825fb225
1 changed files with 20 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
View File

@@ -83,6 +83,16 @@ const uint32_t kInvalidPatchlevel = 99998877;
// additional overhead, for the digest algorithmIdentifier required by PKCS#1.
const size_t kPkcs1UndigestedSignaturePaddingOverhead = 11;
// Determine whether the key description is for an asymmetric key.
bool is_asymmetric(const AuthorizationSet& key_desc) {
auto algorithm = key_desc.GetTagValue(TAG_ALGORITHM);
if (algorithm && (algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
return true;
} else {
return false;
}
}
size_t count_tag_invalid_entries(const std::vector<KeyParameter>& authorizations) {
return std::count_if(authorizations.begin(), authorizations.end(),
[](const KeyParameter& e) -> bool { return e.tag == Tag::INVALID; });
@@ -418,11 +428,14 @@ ErrorCode KeyMintAidlTestBase::GenerateKey(const AuthorizationSet& key_desc,
vector<Certificate> attest_cert_chain;
// If an attestation is requested, but the system is RKP-only, we need to supply an explicit
// attestation key. Else the result is a key without an attestation.
// If the RKP-only value is undeterminable (i.e., when running on GSI), generate and use the
// attest key anyways. In the case that using an attest key is not supported
// (shouldSkipAttestKeyTest), assume the device has factory keys (so not RKP-only).
// - If the RKP-only value is undeterminable (i.e., when running on GSI), generate and use the
// `ATTEST_KEY` anyways.
// - In the case that using an `ATTEST_KEY` is not supported
// (shouldSkipAttestKeyTest), assume the device has factory keys (so not RKP-only).
// - If the key being generated is a symmetric key (from test cases that check that the
// attestation parameters are correctly ignored), don't try to use an `ATTEST_KEY`.
if (isRkpOnly().value_or(true) && key_desc.Contains(TAG_ATTESTATION_CHALLENGE) &&
!shouldSkipAttestKeyTest()) {
!shouldSkipAttestKeyTest() && is_asymmetric(key_desc)) {
AuthorizationSet attest_key_desc =
AuthorizationSetBuilder().EcdsaKey(EcCurve::P_256).AttestKey().SetDefaultValidity();
attest_key.emplace();
@@ -462,10 +475,7 @@ ErrorCode KeyMintAidlTestBase::GenerateKey(const AuthorizationSet& key_desc,
*key_characteristics = std::move(creationResult.keyCharacteristics);
*cert_chain = std::move(creationResult.certificateChain);
auto algorithm = key_desc.GetTagValue(TAG_ALGORITHM);
EXPECT_TRUE(algorithm);
if (algorithm &&
(algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
if (is_asymmetric(key_desc)) {
EXPECT_GE(cert_chain->size(), 1);
if (key_desc.Contains(TAG_ATTESTATION_CHALLENGE)) {
if (attest_key) {
@@ -506,10 +516,7 @@ ErrorCode KeyMintAidlTestBase::ImportKey(const AuthorizationSet& key_desc, KeyFo
*key_characteristics = std::move(creationResult.keyCharacteristics);
cert_chain_ = std::move(creationResult.certificateChain);
auto algorithm = key_desc.GetTagValue(TAG_ALGORITHM);
EXPECT_TRUE(algorithm);
if (algorithm &&
(algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
if (is_asymmetric(key_desc)) {
EXPECT_GE(cert_chain_.size(), 1);
if (key_desc.Contains(TAG_ATTESTATION_CHALLENGE)) EXPECT_GT(cert_chain_.size(), 1);
} else {
@@ -554,10 +561,7 @@ ErrorCode KeyMintAidlTestBase::ImportWrappedKey(string wrapped_key, string wrapp
for (auto& entry : key_characteristics_) {
allAuths.push_back(AuthorizationSet(entry.authorizations));
}
auto algorithm = allAuths.GetTagValue(TAG_ALGORITHM);
EXPECT_TRUE(algorithm);
if (algorithm &&
(algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
if (is_asymmetric(allAuths)) {
EXPECT_GE(cert_chain_.size(), 1);
} else {
// For symmetric keys there should be no certificates.