/* * Copyright (C) 2012 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); you * may not use this file except in compliance with the License. You may * obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or * implied. See the License for the specific language governing * permissions and limitations under the License. */ #ifndef ANDROID_HARDWARE_QCOM_KEYMASTER_H #define ANDROID_HARDWARE_QCOM_KEYMASTER_H #include #include #include __BEGIN_DECLS #ifdef _ION_HEAP_MASK_COMPATIBILITY_WA #define ION_HEAP_MASK heap_mask #else #define ION_HEAP_MASK heap_id_mask #endif /** * The id of this module */ #define QCOM_KEYSTORE_KEYMASTER "qcom_keymaster" /** * Operation result */ #define KEYMATER_SUCCESS 0 #define KEYMASTER_FAILURE -1 /** * The API level of this version of the header. The allows the implementing * module to recognize which API level of the client it is dealing with in * the case of pre-compiled binary clients. */ #define QCOM_KEYMASTER_API_VERSION KEYMASTER_MODULE_API_VERSION_0_3 #define KM_MAGIC_NUM (0x4B4D4B42) /* "KMKB" Key Master Key Blob in hex */ #define KM_KEY_SIZE_MAX (512) /* 4096 bits */ #define KM_IV_LENGTH (16) /* AES128 CBC IV */ #define KM_HMAC_LENGTH (32) /* SHA2 will be used for HMAC */ struct qcom_km_key_blob { uint32_t magic_num; uint32_t version_num; uint8_t modulus[KM_KEY_SIZE_MAX]; uint32_t modulus_size; uint8_t public_exponent[KM_KEY_SIZE_MAX]; uint32_t public_exponent_size; uint8_t iv[KM_IV_LENGTH]; uint8_t encrypted_private_exponent[KM_KEY_SIZE_MAX]; uint32_t encrypted_private_exponent_size; uint8_t hmac[KM_HMAC_LENGTH]; }; typedef struct qcom_km_key_blob qcom_km_key_blob_t; /** * Commands supported */ enum keymaster_cmd_t { /* * List the commands supportedin by the hardware. */ KEYMASTER_GENERATE_KEYPAIR = 0x00000001, KEYMASTER_IMPORT_KEYPAIR = 0x00000002, KEYMASTER_SIGN_DATA = 0x00000003, KEYMASTER_VERIFY_DATA = 0x00000004, }; /** * Command to Generate a public and private key. The key data returned * (by secure app) is in shared buffer at offset of "key_blob" and is opaque * * cmd_id : Command issue to secure app * key_type : Currently on RSA_TYPE is supported * rsa_params : Parameters needed to generate an RSA key */ struct keymaster_gen_keypair_cmd { keymaster_cmd_t cmd_id; keymaster_keypair_t key_type; keymaster_rsa_keygen_params_t rsa_params; }; typedef struct keymaster_gen_keypair_cmd keymaster_gen_keypair_cmd_t; /** * Response to Generate a public and private key. The key data returned * (by secure app) is in shared buffer at offset of "key_blob" and is opaque * * cmd_id : Command issue to secure app * key_blob : key blob data * key_blob_len : Total length of key blob information * status : Result (success 0, or failure -1) */ struct keymaster_gen_keypair_resp { keymaster_cmd_t cmd_id; qcom_km_key_blob_t key_blob; size_t key_blob_len; int32_t status; }; typedef struct keymaster_gen_keypair_resp keymaster_gen_keypair_resp_t; /** * Command to import a public and private key pair. The imported keys * will be in PKCS#8 format with DER encoding (Java standard). The key * data returned (by secure app) is in shared buffer at offset of * "key_blob" and is opaque * * cmd_id : Command issue to secure app * pkcs8_key : Pointer to pkcs8 formatted key information * pkcs8_key_len: PKCS8 formatted key length */ struct keymaster_import_keypair_cmd { keymaster_cmd_t cmd_id; uint32_t pkcs8_key; size_t pkcs8_key_len; }; typedef struct keymaster_import_keypair_cmd keymaster_import_keypair_cmd_t; /** * Response to import a public and private key. The key data returned * (by secure app) is in shared buffer at offset of "key_blob" and is opaque * * cmd_id : Command issue to secure app * key_blob : key blob data * key_blob_len : Total length of key blob information * status : Result (success 0, or failure -1) */ struct keymaster_import_keypair_resp { keymaster_cmd_t cmd_id; qcom_km_key_blob_t key_blob; size_t key_blob_len; int32_t status; }; typedef struct keymaster_import_keypair_resp keymaster_import_keypair_resp_t; /** * Command to sign data using a key info generated before. This can use either * an asymmetric key or a secret key. * The signed data is returned (by secure app) at offset of data + dlen. * * cmd_id : Command issue to secure app * sign_param : * key_blob : Key data information (in shared buffer) * data : Pointer to plain data buffer * dlen : Plain data length */ struct keymaster_sign_data_cmd { keymaster_cmd_t cmd_id; keymaster_rsa_sign_params_t sign_param; qcom_km_key_blob_t key_blob; uint32_t data; size_t dlen; }; typedef struct keymaster_sign_data_cmd keymaster_sign_data_cmd_t; /** * Response to sign data response * * cmd_id : Command issue to secure app * signed_data : signature * sig_len : Signed data length * status : Result (success 0, or failure -1) */ struct keymaster_sign_data_resp { keymaster_cmd_t cmd_id; uint8_t signed_data[KM_KEY_SIZE_MAX]; size_t sig_len; int32_t status; }; typedef struct keymaster_sign_data_resp keymaster_sign_data_resp_t; /** * Command to verify data using a key info generated before. This can use either * an asymmetric key or a secret key. * * cmd_id : Command issue to secure app * sign_param : * key_blob : Key data information (in shared buffer) * key_blob_len: Total key length * signed_data : Pointer to signed data buffer * signed_dlen : Signed data length * signature : Offset to the signature data buffer (from signed data buffer) * slen : Signature data length */ struct keymaster_verify_data_cmd { keymaster_cmd_t cmd_id; keymaster_rsa_sign_params_t sign_param; qcom_km_key_blob_t key_blob; uint32_t signed_data; size_t signed_dlen; uint32_t signature; size_t slen; }; typedef struct keymaster_verify_data_cmd keymaster_verify_data_cmd_t; /** * Response to verify data * * cmd_id : Command issue to secure app * status : Result (success 0, or failure -1) */ struct keymaster_verify_data_resp { keymaster_cmd_t cmd_id; int32_t status; }; typedef struct keymaster_verify_data_resp keymaster_verify_data_resp_t; __END_DECLS #endif // ANDROID_HARDWARE_QCOM_KEYMASTER_H