summaryrefslogtreecommitdiff
path: root/identity/WritableCredential.cpp
AgeCommit message (Collapse)Author
2022-12-09identity: Add support for setting minimum validity period for AuthKey.David Zeuthen
This change adds support for specifying that an AuthKey should be replaced if it's going to expire within a certain amount of time configurable by the application. This also adds a way for the application to learn about the expiration time of currently configured AuthKeys. Combined these two changes allow an application to get a perfect picture of which AuthKeys are available, when they expire, and allows the application to refresh AuthKeys well ahead of expiration dates. Also remove checking storeStaticAuthenticationDataWithExpiration() is only available on HAL version 3 and later (feature version 202101 and later). This works on any HAL version. Bug: 241912421 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: Ic8274088035c31f73ad61645ee5e0281b3460837
2021-03-31identity: Use "credstore" for LOG_TAG everywhere.David Zeuthen
Currently we're using file-specific tags which makes it hard for people looking at logcat to infer it's actually from credstore and it also complicates filtering. Just use "credstore" everywhere. Also change logging level from ERROR to INFO in the message "Registered binder service" which is logged on startup. Bug: None Test: Compiles + manual inspection via logcat Test: atest android.security.identity.cts (on goldfish) Change-Id: I336d1a4e4e10b87fd3f08a5046cf5e13f09c9cb6
2021-03-08credstore: Fix several problems with credstore.David Zeuthen
The root of the problem is that in some cases credstore would pass auth- and verification-tokens to the Identity Credential HAL without first having obtained a challenge via IIdentityCredential.createAuthChallenge(). This makes it impossible for the TA to validate the verification token for freshness. This is easily fixed by simply ensuring createAuthChallenge() is called (and the returned challenge is used in the requested verification token) whenever dealing with ACPs using user authentication. Additional issues / changes: - During Android 12 development, an use-after-free bug was introduced in Credential.cpp L120. - keystore's getTokensForCredstore() had some bugs in how to select an auth-token, in particular mixing authTokenAgeMillis (milliseconds) with time_t values (seconds) - as a result, keystore would sometimes return tokens older than what credstore requested. This wasn't actually problem because the TA would check it anyway. - we now precisely define semantics in IKeystoreService.aidl - Another potential use-after-free bug was found in Credential.cpp L767 None of the fixes for these bugs affect CTS or VTS tests. Bug: 181893400 Test: atest android.security.identity.cts on emulator Test: atest android.security.identity.cts on crosshatch (w/ Android 11 era HAL) Test: CtsVerifier's Identity Credential Authentication test crosshatch (w/ Android 11 era HAL) Change-Id: I45a3fd16eff3b6a232d8b8c88f2e3dd3619a9c03
2021-01-22Credstore changes for Android 12David Zeuthen
- Add Credential.proveOwership() - Add Credential.deleteWithChallenge() - Add Credential.updateCredential() - Add Credential.storeStaticAuthenticationDataWithExpirationDate() - Store this on disk. For entries stored without this parameter assume they never expire. - Add allowUsingExpiredKeys to Credential.selectAuthKey() and Credential.getEntries() - Unless set to true, never select an expired key - Introduce ERROR_NOT_SUPPORTED and return this if HAL does not support operation Bug: 170146643 Test: atest android.security.identity.cts Change-Id: Ic5dafc6498c9c59b82942def9d348d974f008589
2020-06-03credstore: Never pass an empty challenge.David Zeuthen
Bug: 156911917 Bug: 158107945 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: Ia274fcbaabb0c0ec7c884070eb30737dc236c064
2020-04-29credstore: Pass additional information to Identity Credential HAL.David Zeuthen
Without this extra information passed upfront it's not practical to implement a HAL which incrementally builds up cryptographically authenticated data. This information is conveyed by using two new methods on version 2 of the Identity Credential HAL. If these methods are not implemented (if a version 1 HAL is running) the invocation fails and we handle this gracefully by just ignoring the error. Bug: 154631410 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: I17d516e41e800f58daa4c11dcca0305c80740d5b
2020-02-14Port credstore to IdentityCredential AIDL.David Zeuthen
Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I338b35f57f2bb7345c3f8f0c608c7a6213a0dc6b
2020-01-31Factor keystore_attestation_id into library and also use this in credstore.David Zeuthen
This was needed because credstore needs to generate and pass the generated AttestationApplicationId to the Identity Credential HAL. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityCredentialTargetTest Test: android.hardware.identity-support-lib-test Change-Id: Id22b85ca083e23c7e1fbd3459910fba37a5db137
2020-01-16Add credstore system daemon.David Zeuthen
The credstore system daemon is sitting below the Identity Credential Framework APIs and on top of the Identity Credential HALs. Its main job is to store credential data and provide a way for applications to communicate with the secure hardware abstracted by the HAL. This daemon runs as an unprivileged user, credstore. The auth-tokens needed by credstore are supplied by keystore and this CL includes the requisite changes to keystore for this to work. Bug: 111446262 Test: CTS tests for Framework APIs Change-Id: Ieb4d59852a143482436a1c418c25ed96e25c0047
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-26 14:09:12 +0000