From 97e02689d9eb84e2bf66062d37ac16cdfb36de91 Mon Sep 17 00:00:00 2001 From: "Brian C. Young" Date: Mon, 4 Dec 2017 16:37:46 -0800 Subject: [PATCH] Restore "Add "Unlocked device required" parameter to keys" Add a keymaster parameter for keys that should be inaccessible when the device screen is locked. "Locked" here is a state where the device can be used or accessed without any further trust factor such as a PIN, password, fingerprint, or trusted face or voice. This parameter is added to the Java keystore interface for key creation and import, as well as enums specified by and for the native keystore process. This reverts commit 95b60a0f41ac639d243b7984f6018136c62e0562. Test: CTS tests in I8a5affd1eaed176756175158e3057e44934fffed Bug: 67752510 Change-Id: I2893c23ab173ff5c39085d56b555e54770900cbc --- .../functional/keymaster_hidl_hal_test.cpp | 22 +++++++++++++++ keymaster/4.0/support/Keymaster3.cpp | 9 ++++-- .../include/keymasterV4_0/keymaster_tags.h | 28 +++++++++++-------- keymaster/4.0/types.hal | 7 ++++- 4 files changed, 51 insertions(+), 15 deletions(-) diff --git a/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp index 3a181a96b7..fbe5237ade 100644 --- a/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp +++ b/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp @@ -2917,6 +2917,28 @@ TEST_F(EncryptionOperationsTest, AesEcbRoundTripSuccess) { EXPECT_EQ(message, plaintext); } +/* + * EncryptionOperationsTest.AesEcbWithUserId + * + * Verifies that AES ECB mode works when Tag::USER_ID is specified. + */ +TEST_F(EncryptionOperationsTest, AesEcbWithUserId) { + string key = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; + ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder() + .Authorization(TAG_NO_AUTH_REQUIRED) + .Authorization(TAG_USER_ID, 0) + .AesEncryptionKey(key.size() * 8) + .EcbMode() + .Padding(PaddingMode::PKCS7), + KeyFormat::RAW, key)); + + string message = "Hello World!"; + auto params = AuthorizationSetBuilder().BlockMode(BlockMode::ECB).Padding(PaddingMode::PKCS7); + string ciphertext = EncryptMessage(message, params); + string plaintext = DecryptMessage(ciphertext, params); + EXPECT_EQ(message, plaintext); +} + /* * EncryptionOperationsTest.AesEcbRoundTripSuccess * diff --git a/keymaster/4.0/support/Keymaster3.cpp b/keymaster/4.0/support/Keymaster3.cpp index b2cdbd9263..84b3ee1f60 100644 --- a/keymaster/4.0/support/Keymaster3.cpp +++ b/keymaster/4.0/support/Keymaster3.cpp @@ -61,9 +61,12 @@ KeyParameter convert(const V3_0::KeyParameter& param) { } hidl_vec convert(const hidl_vec& params) { - hidl_vec converted(params.size()); - for (size_t i = 0; i < params.size(); ++i) { - converted[i] = convert(params[i]); + std::vector converted; + converted.reserve(params.size()); + for (const auto& param : params) { + // Qualcomm's Keymaster3 implementation behaves oddly if Tag::USER_ID is provided. Filter it + // out. Revert this change when b/73286437 is fixed. + if (param.tag != Tag::USER_ID) converted.push_back(convert(param)); } return converted; } diff --git a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h index 9d6501b862..ce213bc127 100644 --- a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h +++ b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h @@ -142,24 +142,28 @@ DECLARE_TYPED_TAG(ROOT_OF_TRUST); DECLARE_TYPED_TAG(RSA_PUBLIC_EXPONENT); DECLARE_TYPED_TAG(TRUSTED_CONFIRMATION_REQUIRED); DECLARE_TYPED_TAG(UNIQUE_ID); +DECLARE_TYPED_TAG(UNLOCKED_DEVICE_REQUIRED); DECLARE_TYPED_TAG(USAGE_EXPIRE_DATETIME); DECLARE_TYPED_TAG(USER_AUTH_TYPE); +DECLARE_TYPED_TAG(USER_ID); DECLARE_TYPED_TAG(USER_SECURE_ID); template struct MetaList {}; -using all_tags_t = MetaList< - TAG_INVALID_t, TAG_KEY_SIZE_t, TAG_MAC_LENGTH_t, TAG_CALLER_NONCE_t, TAG_MIN_MAC_LENGTH_t, - TAG_RSA_PUBLIC_EXPONENT_t, TAG_INCLUDE_UNIQUE_ID_t, TAG_ACTIVE_DATETIME_t, - TAG_ORIGINATION_EXPIRE_DATETIME_t, TAG_USAGE_EXPIRE_DATETIME_t, TAG_MIN_SECONDS_BETWEEN_OPS_t, - TAG_MAX_USES_PER_BOOT_t, TAG_USER_SECURE_ID_t, TAG_NO_AUTH_REQUIRED_t, TAG_AUTH_TIMEOUT_t, - TAG_ALLOW_WHILE_ON_BODY_t, TAG_APPLICATION_ID_t, TAG_APPLICATION_DATA_t, - TAG_CREATION_DATETIME_t, TAG_ROLLBACK_RESISTANCE_t, TAG_ROOT_OF_TRUST_t, TAG_ASSOCIATED_DATA_t, - TAG_NONCE_t, TAG_BOOTLOADER_ONLY_t, TAG_OS_VERSION_t, TAG_OS_PATCHLEVEL_t, TAG_UNIQUE_ID_t, - TAG_ATTESTATION_CHALLENGE_t, TAG_ATTESTATION_APPLICATION_ID_t, TAG_RESET_SINCE_ID_ROTATION_t, - TAG_PURPOSE_t, TAG_ALGORITHM_t, TAG_BLOCK_MODE_t, TAG_DIGEST_t, TAG_PADDING_t, - TAG_BLOB_USAGE_REQUIREMENTS_t, TAG_ORIGIN_t, TAG_USER_AUTH_TYPE_t, TAG_EC_CURVE_t>; +using all_tags_t = + MetaList; template struct TypedTag2ValueType; @@ -343,6 +347,7 @@ inline bool operator==(const KeyParameter& a, const KeyParameter& b) { case Tag::BOOTLOADER_ONLY: case Tag::NO_AUTH_REQUIRED: case Tag::ALLOW_WHILE_ON_BODY: + case Tag::UNLOCKED_DEVICE_REQUIRED: case Tag::ROLLBACK_RESISTANCE: case Tag::RESET_SINCE_ID_ROTATION: case Tag::TRUSTED_CONFIRMATION_REQUIRED: @@ -357,6 +362,7 @@ inline bool operator==(const KeyParameter& a, const KeyParameter& b) { case Tag::OS_VERSION: case Tag::OS_PATCHLEVEL: case Tag::MAC_LENGTH: + case Tag::USER_ID: case Tag::AUTH_TIMEOUT: case Tag::VENDOR_PATCHLEVEL: case Tag::BOOT_PATCHLEVEL: diff --git a/keymaster/4.0/types.hal b/keymaster/4.0/types.hal index 91ec9bf576..47fd1ed00e 100644 --- a/keymaster/4.0/types.hal +++ b/keymaster/4.0/types.hal @@ -118,7 +118,8 @@ enum Tag : uint32_t { * boot. */ /* User authentication */ - // 500-501 reserved + // 500 reserved + USER_ID = TagType:UINT | 501, /* Android ID of authorized user or authenticator(s), */ USER_SECURE_ID = TagType:ULONG_REP | 502, /* Secure ID of authorized user or authenticator(s). * Disallowed if NO_AUTH_REQUIRED is present. */ NO_AUTH_REQUIRED = TagType:BOOL | 503, /* If key is usable without authentication. */ @@ -191,6 +192,9 @@ enum Tag : uint32_t { * match the data described in the token, keymaster must return NO_USER_CONFIRMATION. */ TRUSTED_CONFIRMATION_REQUIRED = TagType:BOOL | 508, + UNLOCKED_DEVICE_REQUIRED = TagType:BOOL | 509, /* Require the device screen to be unlocked if + * the key is used. */ + /* Application access control */ APPLICATION_ID = TagType:BYTES | 601, /* Byte string identifying the authorized application. */ @@ -471,6 +475,7 @@ enum ErrorCode : int32_t { PROOF_OF_PRESENCE_REQUIRED = -69, CONCURRENT_PROOF_OF_PRESENCE_REQUESTED = -70, NO_USER_CONFIRMATION = -71, + DEVICE_LOCKED = -72, UNIMPLEMENTED = -100, VERSION_MISMATCH = -101,