Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 16:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "KeyMint: clarify EC_CURVE on import" into main

Browse Source
This commit is contained in:
David Drysdale
2023-09-18 15:00:57 +00:00
committed by Gerrit Code Review
parent 607f7e7ff7 9b8d75eacb
commit a2d3f2499c
2 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
View File

@@ -379,6 +379,12 @@ interface IKeyMintDevice {
* validate it against the key material. In the event of a mismatch, importKey must return
* ErrorCode::IMPORT_PARAMETER_MISMATCH.
*
* o Tag::EC_CURVE is not necessary in the input parameters for import of EC keys. If not
* provided the IKeyMintDevice must deduce the value from the provided key material and add
* the tag and value to the key characteristics. If Tag::EC_CURVE is provided, the
* IKeyMintDevice must validate it against the key material. In the event of a mismatch,
* importKey must return ErrorCode::IMPORT_PARAMETER_MISMATCH.
*
* o Tag::RSA_PUBLIC_EXPONENT (for RSA keys only) is not necessary in the input parameters. If
* not provided, the IKeyMintDevice must deduce the value from the provided key material and
* add the tag and value to the key characteristics. If Tag::RSA_PUBLIC_EXPONENT is provided,

36
security/keymint/aidl/vts/functional/KeyMintTest.cpp
View File

@@ -4147,6 +4147,42 @@ TEST_P(ImportKeyTest, EcdsaSuccess) {
LocalVerifyMessage(message, signature, params);
}
/*
* ImportKeyTest.EcdsaSuccessCurveNotSpecified
*
* Verifies that importing and using an ECDSA P-256 key pair works correctly
* when the EC_CURVE is not explicitly specified.
*/
TEST_P(ImportKeyTest, EcdsaSuccessCurveNotSpecified) {
if (AidlVersion() < 4) {
/*
* The KeyMint spec before V4 was not clear as to whether EC_CURVE was optional on import of
* EC keys. However, this was not checked at the time so we can only be strict about
* checking this for implementations of KeyMint version 4 and above.
*/
GTEST_SKIP() << "Skipping EC_CURVE on import only strict since KeyMint v4";
}
ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
.Authorization(TAG_NO_AUTH_REQUIRED)
.Authorization(TAG_ALGORITHM, Algorithm::EC)
.SigningKey()
.Digest(Digest::SHA_2_256)
.SetDefaultValidity(),
KeyFormat::PKCS8, ec_256_key));
CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
CheckCryptoParam(TAG_DIGEST, Digest::SHA_2_256);
CheckCryptoParam(TAG_EC_CURVE, EcCurve::P_256);
CheckOrigin();
string message(32, 'a');
auto params = AuthorizationSetBuilder().Digest(Digest::SHA_2_256);
string signature = SignMessage(message, params);
LocalVerifyMessage(message, signature, params);
}
/*
* ImportKeyTest.EcdsaP256RFC5915Success
*