From bcb2f7347564c03c739061c5f7bc91de9d5e3b9e Mon Sep 17 00:00:00 2001 From: David Drysdale Date: Mon, 21 Mar 2022 17:10:35 +0000 Subject: [PATCH] KeyMint HAL: clarify ATTEST_KEY is like SIGN Bug: 221280929 Test: None, comment change only (already assumed by VTS tests) Change-Id: Ifc077c6ce1a89164b0d7c70c6e3353d941eee670 --- .../security/keymint/KeyCreationResult.aidl | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl index 16bbc5c569..a4cfb8bf63 100644 --- a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl +++ b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl @@ -78,15 +78,16 @@ parcelable KeyCreationResult { * provided, otherwise ATTESTATION_APPLICATION_ID_MISSING will be returned. * * 3. Asymmetric key non-attestation with signing key. If Tag::ATTESTATION_CHALLENGE is not - * provided and the generated/imported key has KeyPurpose::SIGN, then the returned - * certificate chain must contain only a single self-signed certificate with no attestation - * extension. Tag::ATTESTATION_APPLICATION_ID will be ignored if provided. + * provided and the generated/imported key has KeyPurpose::SIGN or KeyPurpose::ATTEST_KEY, + * then the returned certificate chain must contain only a single self-signed certificate + * with no attestation extension. Tag::ATTESTATION_APPLICATION_ID will be ignored if + * provided. * * 4. Asymmetric key non-attestation with non-signing key. If TAG::ATTESTATION_CHALLENGE is - * not provided and the generated/imported key does not have KeyPurpose::SIGN, then the - * returned certificate chain must contain only a single certificate with an empty signature - * and no attestation extension. Tag::ATTESTATION_APPLICATION_ID will be ignored if - * provided. + * not provided and the generated/imported key does not have KeyPurpose::SIGN nor + * KeyPurpose::ATTEST_KEY, then the returned certificate chain must contain only a single + * certificate with an empty signature and no attestation extension. + * Tag::ATTESTATION_APPLICATION_ID will be ignored if provided. * * 5. Symmetric key. If the generated/imported key is symmetric, the certificate chain must * return empty, any Tag::ATTESTATION_CHALLENGE or Tag::ATTESTATION_APPLICATION_ID inputs,