diff options
| author | Max Bires <jbires@google.com> | 2022-06-21 23:00:19 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2022-06-21 23:00:19 +0000 |
| commit | 027187ba9a9d2af0db67c9e93de868355e847625 (patch) | |
| tree | 427eda775c48afa86bf2219797d8a8c19fe43b0d | |
| parent | 7df9ab130b8301e8c0a2b6c8c8a9ca9299f539b5 (diff) | |
| parent | 3c2557622261a54097f8cf974fc5b8c0f256cf6f (diff) | |
| download | security-027187ba9a9d2af0db67c9e93de868355e847625.tar.gz | |
Do not use RKP for DEVICE_UNIQUE_ATTESTATION. am: 7409f7c8dd am: 3c25576222
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/security/+/19021559
Change-Id: I2cc99f76d6b861a297e838c6a3f7a54447b66b21
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | keystore2/src/attestation_key_utils.rs | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/keystore2/src/attestation_key_utils.rs b/keystore2/src/attestation_key_utils.rs index 8354ba5c..34089425 100644 --- a/keystore2/src/attestation_key_utils.rs +++ b/keystore2/src/attestation_key_utils.rs @@ -59,8 +59,11 @@ pub fn get_attest_key_info( db: &mut KeystoreDB, ) -> Result<Option<AttestationKeyInfo>> { let challenge_present = params.iter().any(|kp| kp.tag == Tag::ATTESTATION_CHALLENGE); + let is_device_unique_attestation = + params.iter().any(|kp| kp.tag == Tag::DEVICE_UNIQUE_ATTESTATION); match attest_key_descriptor { - None if challenge_present => rem_prov_state + // Do not select an RKP key if DEVICE_UNIQUE_ATTESTATION is present. + None if challenge_present && !is_device_unique_attestation => rem_prov_state .get_remotely_provisioned_attestation_key_and_certs(key, caller_uid, params, db) .context(concat!( "In get_attest_key_and_cert_chain: ", |