Detect if there is an IRemotelyProvisionedComponent for strongbox, and
if so run the associated keymint tests. Else, allow strongbox to skip
the test as it's not required to implement the IRPC HAL.
Bug: 271948302
Test: VtsAidlKeyMintTargetTest
Change-Id: Ibf98e594e725d6ad14c0ff189ab9fbcc25b51f80
Ensure that v3 HALs have exactly the expected number of entries present
when returning DeviceInfo inside of the Certificate Signing Request. Do
not allow for additional or fewer entries.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I8ea628335d5eed35ca2b65e22980e13fc9806738
Some of the DeviceInfo must match existing tags in KeyMint, but this
was not documented.
Test: n/a
Change-Id: I7733e2a4b0c08b0b89ece41390c0ce0711459d82
Since comments are stripped from the stable AIDL snapshots, the CDDL
describing the DeviceInfo contents is lost for the older versions. Add
the comments from older DeviceInfo versions as a reference for
maintainers of older HAL implementations.
Test: n/a
Change-Id: I7dd3d285b3d8422a6df4228ad0cf5797e78609c1
When we split the rkp interface, we only added one hash to rkp v2, but
on Android S devices, this interface was in keymint v2, and so it used
the keymint v2 hash.
In order for that old implementation to be recognized, we need to add the hash in specifically.
Note: v1 was missed in b/264549860, but this was v2.
Fixes: 271513408
Test: vts_treble_vintf_vendor_test
Change-Id: I58c7c41633000df933261a147edd3477afd09a36
The support level for strongbox is different from the tee
implementation. Additionally, we were incorrectly checking the keymint
aidl version. KeyMint 1.0 supported ATTEST_KEY, so it's unclear why we
were ever checking for KeyMint 2.0.
Test: VtsAidlKeyMintTargetTest
Bug: 263844771
Change-Id: I750367902fec90204d71c1e158404b2421f9ad87
The DICE chain in the ProtectedData objects are evaluated against the
specification from v1 and v2 of the HAL whereas the chain in
AuthenticatedMessage objects are evaluated against the specification
from v3.
There are only small differences with v3 aligning to the standards where
there was previously more leniency.
Fix: 262599829
Test: TH
Change-Id: Ied14362b5530485eb6c2302a0ae0f21da9cdb33f
The server-provided challenge is almost always smaller than 32 bytes,
so we cannot enforce that as a minimum. I fixed up the CDDL a while
back, but missed one mention of the 32 byte minimum in the description.
Test: n/a (it's a comment)
Bug: 272392463
Change-Id: Ia5994e2b7cf107ab131c6b028bee7881d0e657ac
Put the test arm that just involves checking a property
first, so that tests which involve a round trip to the Package
Manager are only executed when they're needed.
Test: VtsAidlKeyMintTargetTest
Bug: 271026714
Change-Id: I4caad6243a3b9d511a32717fd95f58864b857eeb
In 32-bit builds a `long` may be 32 bits, but the `long` values on an
AIDL interface are 64 bits. Therefore need to use `int64_t` for the
corresponding C++ type, not `long`.
Bug: 271056044
Test: VtsAidlKeyMintTargetTest --gtest_filter="*AuthTest*" (32-b)
Change-Id: I19f5a1d825dfcc45087534bbd4239a13cdfec3f7
to not to hold the CRL Distribution Points extension in it.
Bug: 260332189
Test: atest VtsAidlKeyMintTargetTest
Change-Id: I7b191b4351984ce82db0e9440027ddbfc14b1c3a
hardware/interfaces/security/keymint/aidl/vts/performance/KeyMintBenchmark.cpp:79:26: error: reference to stack memory associated with local variable 'message' returned [-Werror,-Wreturn-stack-address]
return std::move(message);
^~~~~~~
Test: presubmit
Change-Id: I4298b4a25ccb809a7ae180bb218e673a7f1aa623
This cl removes the unused service android.hardware.security.dice
together with all its usages (all of them are tests), because the
service is incomplete and not used anywhere for now and in the
near future.
The cl also removes dice from the compat matrix.
This helps us reduce some maintainance burden for the Rust dice
wrapper libraries such as libdiced_open_dice[_nostd],
libdiced_sample_inputs, libdiced_utils and their tests.
Test: atest diced_utils_test diced_sample_inputs_test \
diced_open_dice_cbor_test \
libdiced_open_dice_nostd.integration_test \
libdiced_open_dice.integration_test diced_open_dice_cbor_test
Test: m pvmfw_img microdroid_manager
Bug: 267575445
Bug: 270511529
Change-Id: I3d2497d2e8d3f88c49cae9ae80a6b4f7b652cc4a
The test exempted KeyMint on the affected chips from having to implement
ATTEST_KEY if they have StrongBox in all Android releases from Android S
onwards, but the waiver was given only for Android S and T. This CL
changes the test to reinstate the requirement after Android T.
Test: VtsAidlKeyMintTargetTest
Change-Id: I8481ae31de34aae220af7e7188632edcc2d391f0
Add tests that directly exercise Gatekeeper to get auth tokens for use
with auth-bound keys.
Test: VtsAidlKeyMintTargetTest
Change-Id: Ie668674d81ca487e8bbc18fdd9f36610bcab4c8c
1. Using second IMEI as attestation id without using first IMEI.
Test should generate a key using second IMEI as attestation id
without using first IMEI as attestation id. Test should validate
second IMEI in attesation record.
2. Using first IMEI as well as second IMEI as attestation ids.
Test should generate a key using first IMEI and second IMEI as
attestation ids. Test should validate first IMEI and second IMEI
in attestation record.
Test: atest -c VtsAidlKeyMintTargetTest
Bug: 263197083, 264979486
Change-Id: I61c3f32e15a8d478a838d14e7db9917a33682267
The code needed to be adpated because the public fields the code
accessed previously now become private. We need to access them
via the trait now.
This cl also deletes unused dependence libdiced_open_dice_cbor in
the dice service and tests targets.
Bug: 267575445
Test: m android.hardware.security.dice-service.non-secure-software
Test: atest VtsAidlDiceTargetTest VtsAidlDiceDemoteTargetTest
Change-Id: I16e18226c0bce8a90ed764ba598e90e7c1c854ab
The PartyInfo for a P-256 public key is encoded as (x||y) not
(0x04||x||y).
Test: VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: Iae5dc624228d4e1e538e230968443925ec8b55fc
When we split the rkp interface, we only added one hash to rkp v1, but
on Android S devices, this interface was in keymint v1, and so it used
the keymint v1 hash.
In order for that old implementation to be recognized, we need to add the keymint v1 hash into rkp v1.
The hash added here is copied from this file:
hardware/interfaces/security/keymint/aidl/aidl_api/android.hardware.security.keymint/1/.hash
Bug: 264549860
Change-Id: I3fce46b3e9bd09d79fa8e2f203b4eb9ebb517c15
Test: vts_treble_vintf_vendor_test
This is part of the project of merging the two existing dice
wrapper libraries into the library libdiced_open_dice to
improve maintainability.
Bug: 267575445
Test: m android.hardware.security.dice-service.non-secure-software
Test: atest VtsAidlDiceTargetTest VtsAidlDiceDemoteTargetTest
Change-Id: If9ee66a320775897342f53d58ee11405a8e70c6f
