Skip attestation key tests if the feature
FEATURE_KEYSTORE_APP_ATTEST_KEY is disabled on device,
as done in KeyMint CTS.
Bug: 244460948
Bug: 265740739
Test: VtsAidlKeyMintTargetTest
Change-Id: I8199e5c7570b10b71f127c7439b889c0b3327865
- Rename keysToCertify to keysToSign to match param name in a few
places.
- Make clearer that P-256 is allowed in EEK.
- Make clearer that EEK curve should match that specified in
RpcHardwareInfo.supportedEekCurve.
- Add note about AAD for AES-GCM encryption.
- Add note about format of public key data in KDF context.
Test: None, comments only
Change-Id: Ie775a453b4d3941b7d24396da66681ab91978d81
attestation id.
Get IMEI value from Telephony Service and use it as attestation id.
Bug: 261847629
Test: atest VtsAidlKeyMintTargetTest
Change-Id: I0212def48d761a45f514161e5576a954bf388c56
Following requests from partners, document P-384 and SHA-384 as
officially supported signing algorithms and hash functions in the DICE
chain.
Bug: 265455904
Test: n/a -- documentation-only change
Change-Id: Id7b5eaf81be17fda9278dc7ad5f2b441931c6b83
Updated the digest to SHA_2_256 in manaul key upgrade tests
so that these tests works for StrongBox as well.
Test: VtsAidlKeyMintTargetTest
Change-Id: I971f6e13272450d39537cc44c59f8ed8dbd19bf0
libcert_request_validator is now called libhwtrust so update the
references to match.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I3c73e2749996ef684da4567a3c86daf8b9c0fd09
Remove one of the DICE chain validation implementations and replace it
with a call to the libcert_request_validator library which has the most
complete validation and is planned to be the only implementation we
support.
VTS will now check both degenerate and proper DICE chain more completely
and will be consistent with other tools like `bcc_validator`. P-384 will
become a supported key type in the DICE chain.
The whole static library is included so that clients that statically
link remote_prov_utils don't need to be aware of the dependency.
Bug: 254510672
Bug: 265455904
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I067f7e8710e379a4b404ef9d2c04fe6410f73dc4
Clarify that the tag for the 2nd IMEI must denote an IMEI different to
the tag used for the first IMEI, and may be used independently of it.
Bug: 264979486
Test: N/A
Change-Id: I45a46d1052e45a965c8be391d11157cc4481545b
The current RKP server produces challenges smaller than 32 bytes.
As existing devices in the field may have some length limitations
due to this, let's not start sending larger challenges to those
devices. Instead, drop the challenge to 16 bytes to maintain compat.
There should be plenty of entropy in 16 bytes.
Test: n/a
Change-Id: I1dfd9b4b06131df907683207e4b6bfb2d1c93d65
This made it easier to run libkeymint_remote_prov_support_test.
Bug: 264302050
Test: atest libkeymint_remote_prov_support_test
Change-Id: Ided4e9bb442274ea7711d283bc947c35f34ebc35
To help with error reporting on the RKP servers in the future it
will be helpful to be able to address CSRs by serial number when
possible.
Bug: 264302050
Test: libkeymint_remote_prov_support_test and sent JSON to server
Change-Id: I2808441c200d0679e618580abc464cd3c71c220e
This updates the test: supportsValidCurve, for IRPC implementations
that supports only V3+.
Bug: 239476788
Test: atest VtsRemotelyProvisionedComponentTests with IRPC V3
implementation
Change-Id: Ic0f1223b30e31dc537155e19e800b3001ce0fc01
- STATUS_TEST_KEY_IN_PRODUCTION_REQUEST is still required for V3
- PubKeyEcdhP256 & PubKeyX25519 are unused in V3
- SignedDataSigStruct and DiceChainEntryInput should be an cbor array
when being the input of PureEd25519/ECDSA
Bug: 243454124
Test: VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: Ice400bb15413eac164f2630cc2fbb66e6d3624b1
It's not enough to verify that the system is running KeyMint 2+. We
also need to verify that the vendor partition has RKP support.
Since VSR 13+ requires KeyMint 2+, change the test assumption so that
we don't run the test against systems that may have shipped with an
older VSR chipset (which won't support RKP).
Bug: 263844771
Test: VtsAidlKeyMintTargetTest (on old and new device)
Change-Id: Iac15f69db1152851f5a92d3929cb258b1b1a6b02
If the base set up fails, the RKP version number might not be valid so
we shouldn't try to work out whether the test should be skipped based on
the version.
Assert that there weren't any fatal errors from the base set up rather
than reporting that the test should be skipped as that can be a bit
confusing.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: Icaf946ef4cf6b31dcfe7187131538b9eb3892798
Alternet device properties used for attestation on AOSP and GSI builds.
Attestation ids were different in AOSP/GSI builds than provisioned ids
in keymint. Hence additional properties used to make these ids identical
to provisioned ids.
Bug: 110779648
Bug: 259376922
Test: atest VtsAidlKeyMintTargetTest:PerInstance/NewKeyGenerationTest#EcdsaAttestationIdTags/0_android_hardware_security_keymint_IKeyMintDevice_default
Test: atest VtsAidlKeyMintTargetTest:PerInstance/NewKeyGenerationTest#EcdsaAttestationIdTags/1_android_hardware_security_keymint_IKeyMintDevice_strongbox
Test: atest CtsKeystoreTestCases:android.keystore.cts.KeyAttestationTest CtsKeystoreTestCases:DeviceOwnerKeyManagementTest
Change-Id: I4bb2e2ebba617972e29ad86ea477eb9b6f35d21a
Check the VSR API level for the device under test and ensure that the
appropriate HAL version for the IRemotelyProvisionedComponent interface
is present. E.g. a VSR 13 chipset should have IRPC v2 or newer.
Bug: 251185719
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I136cac27953d1d5acaa45510ad9efec2a75d8038
This integration was technically a requirement on keymint v2, but we
weren't enforcing it with a test. So realistically we are only able
to start enforcing the test with keymint v3.
Test: atest VtsAidlKeyMintTargetTest
Change-Id: Ia4feb8ce4b7fd1e47a5c6c9b06ddb12276a9c5ee
Now that the RKP HAL AIDL has been moved to it's own directory, we
should keep the tests with the AIDL.
Test: atest VtsAidlKeyMintTargetTest
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: Ia87d3ea0a1b9e6704f0dea8f98b0bbaa049472fe
As we've updated the KeyMint version to 3, update the default feature
version to 300. That allows external developers to tell which KeyMint
version is running on the device.
Bug: 244732345
Test: atest android.keystore.cts.DeviceOwnerKeyManagementTest
Change-Id: I9b333eeb77a62a79e8e664d40b5564767643aa3d
This add a cpp default so that the latest cpp code can be
used across the codebase. When this is changed we dont
need to bump versions across multiple files and can just
change it in this one file.
Test: Run and tested using `atest keystore2_test` for Rust test and CTS test with `atest CtsKeystoreTestCases`
Bug: 244730020
Change-Id: Ifae1c5f2403210c2dec1bc337553fbbde73ed4c8
