1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
|
/*
* Copyright 2020, The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#define LOG_TAG "android.hardware.security.keymint-impl"
#include <android-base/logging.h>
#include "KeyMintUtils.h"
namespace aidl::android::hardware::security::keymint::km_utils {
namespace {
using keymaster::hton;
KeyParameter kmEnumParam2Aidl(const keymaster_key_param_t& param) {
switch (param.tag) {
case KM_TAG_PURPOSE:
return KeyParameter{Tag::PURPOSE, KeyParameterValue::make<KeyParameterValue::keyPurpose>(
static_cast<KeyPurpose>(param.enumerated))};
case KM_TAG_ALGORITHM:
return KeyParameter{Tag::ALGORITHM, KeyParameterValue::make<KeyParameterValue::algorithm>(
static_cast<Algorithm>(param.enumerated))};
case KM_TAG_BLOCK_MODE:
return KeyParameter{Tag::BLOCK_MODE, KeyParameterValue::make<KeyParameterValue::blockMode>(
static_cast<BlockMode>(param.enumerated))};
case KM_TAG_DIGEST:
return KeyParameter{Tag::DIGEST, KeyParameterValue::make<KeyParameterValue::digest>(
static_cast<Digest>(param.enumerated))};
case KM_TAG_PADDING:
return KeyParameter{Tag::PADDING, KeyParameterValue::make<KeyParameterValue::paddingMode>(
static_cast<PaddingMode>(param.enumerated))};
case KM_TAG_EC_CURVE:
return KeyParameter{Tag::EC_CURVE, KeyParameterValue::make<KeyParameterValue::ecCurve>(
static_cast<EcCurve>(param.enumerated))};
case KM_TAG_USER_AUTH_TYPE:
return KeyParameter{Tag::USER_AUTH_TYPE,
KeyParameterValue::make<KeyParameterValue::hardwareAuthenticatorType>(
static_cast<HardwareAuthenticatorType>(param.enumerated))};
case KM_TAG_ORIGIN:
return KeyParameter{Tag::ORIGIN, KeyParameterValue::make<KeyParameterValue::origin>(
static_cast<KeyOrigin>(param.enumerated))};
case KM_TAG_BLOB_USAGE_REQUIREMENTS:
case KM_TAG_KDF:
default:
return KeyParameter{Tag::INVALID, false};
}
}
keymaster_key_param_t kInvalidTag{.tag = KM_TAG_INVALID, .integer = 0};
template <KeyParameterValue::Tag aidl_tag>
keymaster_key_param_t aidlEnumVal2Km(keymaster_tag_t km_tag, const KeyParameterValue& value) {
return value.getTag() == aidl_tag
? keymaster_param_enum(km_tag, static_cast<uint32_t>(value.get<aidl_tag>()))
: kInvalidTag;
}
keymaster_key_param_t aidlEnumParam2Km(const KeyParameter& param) {
auto tag = km_utils::legacy_enum_conversion(param.tag);
switch (tag) {
case KM_TAG_PURPOSE:
return aidlEnumVal2Km<KeyParameterValue::keyPurpose>(tag, param.value);
case KM_TAG_ALGORITHM:
return aidlEnumVal2Km<KeyParameterValue::algorithm>(tag, param.value);
case KM_TAG_BLOCK_MODE:
return aidlEnumVal2Km<KeyParameterValue::blockMode>(tag, param.value);
case KM_TAG_DIGEST:
case KM_TAG_RSA_OAEP_MGF_DIGEST:
return aidlEnumVal2Km<KeyParameterValue::digest>(tag, param.value);
case KM_TAG_PADDING:
return aidlEnumVal2Km<KeyParameterValue::paddingMode>(tag, param.value);
case KM_TAG_EC_CURVE:
return aidlEnumVal2Km<KeyParameterValue::ecCurve>(tag, param.value);
case KM_TAG_USER_AUTH_TYPE:
return aidlEnumVal2Km<KeyParameterValue::hardwareAuthenticatorType>(tag, param.value);
case KM_TAG_ORIGIN:
return aidlEnumVal2Km<KeyParameterValue::origin>(tag, param.value);
case KM_TAG_BLOB_USAGE_REQUIREMENTS:
case KM_TAG_KDF:
default:
CHECK(false) << "Unknown or unused enum tag: Something is broken";
return keymaster_param_enum(tag, false);
}
}
} // namespace
vector<uint8_t> authToken2AidlVec(const std::optional<HardwareAuthToken>& token) {
static_assert(1 /* version size */ + sizeof(token->challenge) + sizeof(token->userId) +
sizeof(token->authenticatorId) + sizeof(token->authenticatorType) +
sizeof(token->timestamp) + 32 /* HMAC size */
== sizeof(hw_auth_token_t),
"HardwareAuthToken content size does not match hw_auth_token_t size");
vector<uint8_t> result;
if (!token.has_value()) return result;
if (token->mac.size() != 32) return result;
result.resize(sizeof(hw_auth_token_t));
auto pos = result.begin();
*pos++ = 0; // Version byte
pos = copy_bytes_to_iterator(token->challenge, pos);
pos = copy_bytes_to_iterator(token->userId, pos);
pos = copy_bytes_to_iterator(token->authenticatorId, pos);
pos = copy_bytes_to_iterator(hton(static_cast<uint32_t>(token->authenticatorType)), pos);
pos = copy_bytes_to_iterator(hton(token->timestamp.milliSeconds), pos);
pos = std::copy(token->mac.data(), token->mac.data() + token->mac.size(), pos);
return result;
}
KeyParameter kmParam2Aidl(const keymaster_key_param_t& param) {
auto tag = legacy_enum_conversion(param.tag);
switch (typeFromTag(param.tag)) {
case KM_ENUM:
case KM_ENUM_REP:
return kmEnumParam2Aidl(param);
break;
case KM_UINT:
case KM_UINT_REP:
return KeyParameter{tag,
KeyParameterValue::make<KeyParameterValue::integer>(param.integer)};
case KM_ULONG:
case KM_ULONG_REP:
return KeyParameter{
tag, KeyParameterValue::make<KeyParameterValue::longInteger>(param.long_integer)};
break;
case KM_DATE:
return KeyParameter{tag,
KeyParameterValue::make<KeyParameterValue::dateTime>(param.date_time)};
break;
case KM_BOOL:
return KeyParameter{tag, param.boolean};
break;
case KM_BIGNUM:
case KM_BYTES:
return {tag, KeyParameterValue::make<KeyParameterValue::blob>(
std::vector(param.blob.data, param.blob.data + param.blob.data_length))};
break;
case KM_INVALID:
default:
CHECK(false) << "Unknown or unused tag type: Something is broken";
return KeyParameter{Tag::INVALID, false};
break;
}
}
vector<KeyParameter> kmParamSet2Aidl(const keymaster_key_param_set_t& set) {
vector<KeyParameter> result;
if (set.length == 0 || set.params == nullptr) return result;
result.reserve(set.length);
for (size_t i = 0; i < set.length; ++i) {
result.push_back(kmParam2Aidl(set.params[i]));
}
return result;
}
keymaster_key_param_set_t aidlKeyParams2Km(const vector<KeyParameter>& keyParams) {
keymaster_key_param_set_t set;
set.params = static_cast<keymaster_key_param_t*>(
malloc(keyParams.size() * sizeof(keymaster_key_param_t)));
set.length = keyParams.size();
for (size_t i = 0; i < keyParams.size(); ++i) {
const auto& param = keyParams[i];
auto tag = legacy_enum_conversion(param.tag);
switch (typeFromTag(tag)) {
case KM_ENUM:
case KM_ENUM_REP:
set.params[i] = aidlEnumParam2Km(param);
break;
case KM_UINT:
case KM_UINT_REP:
set.params[i] =
param.value.getTag() == KeyParameterValue::integer
? keymaster_param_int(tag, param.value.get<KeyParameterValue::integer>())
: kInvalidTag;
break;
case KM_ULONG:
case KM_ULONG_REP:
set.params[i] =
param.value.getTag() == KeyParameterValue::longInteger
? keymaster_param_long(tag, param.value.get<KeyParameterValue::longInteger>())
: kInvalidTag;
break;
case KM_DATE:
set.params[i] =
param.value.getTag() == KeyParameterValue::dateTime
? keymaster_param_date(tag, param.value.get<KeyParameterValue::dateTime>())
: kInvalidTag;
break;
case KM_BOOL:
set.params[i] = keymaster_param_bool(tag);
break;
case KM_BIGNUM:
case KM_BYTES:
if (param.value.getTag() == KeyParameterValue::blob) {
const auto& value = param.value.get<KeyParameterValue::blob>();
uint8_t* copy = static_cast<uint8_t*>(malloc(value.size()));
std::copy(value.begin(), value.end(), copy);
set.params[i] = keymaster_param_blob(tag, copy, value.size());
} else {
set.params[i] = kInvalidTag;
}
break;
case KM_INVALID:
default:
CHECK(false) << "Invalid tag: Something is broken";
set.params[i].tag = KM_TAG_INVALID;
/* just skip */
break;
}
}
return set;
}
} // namespace aidl::android::hardware::security::keymint::km_utils
|
