Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 16:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "Deprecate CSR v1 and v2 in IRPC v3" am: 74a699c4d8

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2510195

Change-Id: Ib64d493c0528a79799862fd44e5bbb931c2e12fc
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Andrew Scull
2023-03-29 14:41:42 +00:00
committed by Automerger Merge Worker
parent 015b828def 74a699c4d8
commit eb06c44f4f
3 changed files with 20 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
security/rkp/CHANGELOG.md
View File

@@ -31,7 +31,7 @@ This document provides an exact description of which changes have occurred in th
* IRemotelyProvisionedComponent * IRemotelyProvisionedComponent
* The need for an EEK has been removed. There is no longer an encrypted portion of the CSR. * The need for an EEK has been removed. There is no longer an encrypted portion of the CSR.
* Keys for new CSR format must be generated with test mode set to false, effectively removing test * Keys for new CSR format must be generated with test mode set to false, effectively removing test
mode in the new CSR flow. Old behavior is kept unchanged for backwards compatibility. mode in the new CSR flow.
* The schema for the CSR itself has been significantly simplified, please see * The schema for the CSR itself has been significantly simplified, please see
IRemotelyProvisionedComponent.aidl for more details. Notably, IRemotelyProvisionedComponent.aidl for more details. Notably,
* the chain of signing, MACing, and encryption operations has been replaced with a single * the chain of signing, MACing, and encryption operations has been replaced with a single

6
security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
View File

@@ -144,9 +144,9 @@ interface IRemotelyProvisionedComponent {
byte[] generateEcdsaP256KeyPair(in boolean testMode, out MacedPublicKey macedPublicKey); byte[] generateEcdsaP256KeyPair(in boolean testMode, out MacedPublicKey macedPublicKey);
/** /**
* This method can be removed in version 3 of the HAL. The header is kept around for * This method has been deprecated since version 3 of the HAL. The header is kept around for
* backwards compatibility purposes. From v3, this method is allowed to raise a * backwards compatibility purposes. From v3, this method must raise a ServiceSpecificException
* ServiceSpecificException with an error code of STATUS_REMOVED. * with an error code of STATUS_REMOVED.
* *
* For v1 and v2 implementations: * For v1 and v2 implementations:
* generateCertificateRequest creates a certificate request to be sent to the provisioning * generateCertificateRequest creates a certificate request to be sent to the provisioning

26
security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
View File

@@ -408,16 +408,8 @@ class CertificateRequestTest : public CertificateRequestTestBase {
ASSERT_FALSE(HasFatalFailure()); ASSERT_FALSE(HasFatalFailure());
if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) { if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
bytevec keysToSignMac; GTEST_SKIP() << "This test case only applies to RKP v1 and v2. "
DeviceInfo deviceInfo; << "RKP version discovered: " << rpcHardwareInfo.versionNumber;
ProtectedData protectedData;
auto status = provisionable_->generateCertificateRequest(
false, {}, {}, {}, &deviceInfo, &protectedData, &keysToSignMac);
if (!status.isOk() && (status.getServiceSpecificError() ==
BnRemotelyProvisionedComponent::STATUS_REMOVED)) {
GTEST_SKIP() << "This test case applies to RKP v3+ only if "
<< "generateCertificateRequest() is implemented.";
}
} }
} }
}; };
@@ -798,6 +790,20 @@ TEST_P(CertificateRequestV2Test, NonEmptyRequest_testKeyInProdCert) {
BnRemotelyProvisionedComponent::STATUS_TEST_KEY_IN_PRODUCTION_REQUEST); BnRemotelyProvisionedComponent::STATUS_TEST_KEY_IN_PRODUCTION_REQUEST);
} }
/**
* Call generateCertificateRequest(). Make sure it's removed.
*/
TEST_P(CertificateRequestV2Test, CertificateRequestV1Removed) {
bytevec keysToSignMac;
DeviceInfo deviceInfo;
ProtectedData protectedData;
auto status = provisionable_->generateCertificateRequest(
true /* testMode */, {} /* keysToSign */, {} /* EEK chain */, challenge_, &deviceInfo,
&protectedData, &keysToSignMac);
ASSERT_FALSE(status.isOk()) << status.getMessage();
EXPECT_EQ(status.getServiceSpecificError(), BnRemotelyProvisionedComponent::STATUS_REMOVED);
}
void parse_root_of_trust(const vector<uint8_t>& attestation_cert, void parse_root_of_trust(const vector<uint8_t>& attestation_cert,
vector<uint8_t>* verified_boot_key, VerifiedBoot* verified_boot_state, vector<uint8_t>* verified_boot_key, VerifiedBoot* verified_boot_state,
bool* device_locked, vector<uint8_t>* verified_boot_hash) { bool* device_locked, vector<uint8_t>* verified_boot_hash) {