summaryrefslogtreecommitdiff
path: root/identity
AgeCommit message (Collapse)Author
2024-03-28Remove unnecessary "_external" suffix from libcppborShawn Willden
Test: Build Change-Id: If61f49d36ea954f8385012172d454cc803141a60
2024-02-13Migrate Test Targets to New Android Ownership ModelAditya Choudhary
This CL is created as a best effort to migrate test targets to the new Android ownership model. It is based on historical data from repository history and insights from git blame. Given the nature of this effort, there may be instances of incorrect attribution. If you find incorrect or unnecessary attribution in this CL, please create a new CL to fix that. For detailed guidelines and further information on the migration please refer to the link below, go/new-android-ownership-model Bug: 304529413 Test: N/A Change-Id: Ia06fe7f4d0518d03cebf52d34ca9b1434011d272
2023-10-06Restructuring of AAID using aidl_interface build system.Rajesh Nyamagoud
Making changes to use cpp backend generated by aidl_interface build system for KeyAttestationApplicationProvider. Removed custom parcelables defined for AAID. Updated the tests to use the aidl_interface generated bindings. Bug: 267452060 Test: atest android.keystore.cts.KeyAttestationTest; atest keystore_unit_tests; keystoreSignature_fuzzer; keystorePackageInfo_fuzzer; keystoreApplicationId_fuzzer; keystoreAttestationId_fuzzer Change-Id: Ibdfb8e2837538d01a04b6771b1a71c38529d1307
2023-07-06credstore: remove unused variableEric Biggers
Test: mmm system/security Change-Id: I50f80bd823c9039eaa05cc724077f297af550462
2023-06-12Adding AIDL Service fuzzer for identity servicePawan Wagh
Test: m credstore_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/credstore_service_fuzzer/credstore_service_fuzzer Test: atest android.security.identity.cts Bug: 232439428 Change-Id: I57494ad6a17e1a4a9dcb80d778edfd77a892790a
2023-05-24Remove libvintf from credstoreDevin Moore
This library is expensive and getting info from it should be delegated to service manager. Test: showmap $(pidof credstore) # before and after Bug: 280829178 Change-Id: I26524e2c519a869b4cd5bd44b16f92cc8e29f50d
2023-05-23credstore: move some libs from shared to staticDevin Moore
These libraries are only used by this process on a device and gain no benifit from being included as shared libraries. Moving them to static saves disk space, memory, and cpu cycles from the dynamic linker. With 3 reboots before and after I'm seeing average savings of 419KB of storage space from installed files, 84KB private dirty memory, 485KB PSS from libraries/binary only, and 496KB PSS from everything in showmap. go/shared-to-static for more info on how this was determined. Test: m Bug: 280829178 Change-Id: Ib22870d3c291e3063872934a1431b0827d67833c
2023-05-01Fix the overflow when converting current time to milliseconds on 32bit systemLiening.Liu
Test: Vts/Cts Bug: 279998685 Change-Id: If8df10e7bb04527e1d9d18f03439bae4ca8dc8fa
2023-03-09identity: Replace RemotelyProvisionedKey with librkp_supportTri Vo
Test: m credstore Change-Id: I0049d5ba59936943336c7a531d1b022d4d64e4a6
2023-03-03identity: Remove IRemotelyProvisionedKeyPool usageTri Vo
Test: m credstore Change-Id: I5aa0a389083b28cb51dbd47297403b955104b8a6
2023-02-13Merge "Make RKPD default"Treehugger Robot
2023-02-06Handle errors codes from rkpd getKey operationsSeth Moore
Now we'll get error codes bubbled up from rkpd (via the remote provisioning system service). Convert those errors into meaningful keystore errors so clients can act on them. Test: keystore2_tests Test: RkpdAppIntegrationTests Test: CtsKeystoreTestCases:android.keystore.cts.KeyStoreExceptionTest Bug: 264888027 Change-Id: Ib574fe4da0443f32f95f8579c4a308d36fe4b46f
2023-02-01identity: Fix "possible" overflow when converting current time to milliseconds.David Zeuthen
On ubsan targets an overflow bug caused credstore to fail when converting current time since the Epoch to milliseconds. Fix this by using __builtin_mul_overflow() which detects overflow and bail if that were to happen. The error path is not going to get hit until for another 292 million years at which time credstore may or may not be around but better safe than sorry. Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Bug: 262860870 Bug: 262910256 Bug: 264728880 Bug: 264729215 Change-Id: I5efb036f078cae9e4e03406bbdf4ce66572ad716
2023-01-31Make RKPD defaultTri Vo
Also, remove usage of "persist.device_config.remote_key_provisioning_native.enable_rkpd". Test: keystore2_test Change-Id: I3e6673f1af45adf7f7075e61523621ac9377f414
2023-01-25identity: Fix RKPD usageTri Vo
Fixes: - Revert to pre-RKPD behavior of getting an attestation key each time a credential is created. - Revert to pre-RKPD behavior of falling back to factory key. - Check RKPD feature flag each time before calling into RKPD. - Correct service name used to call into RKPD. - Add another thread to handle async responses from RKPD. - Switch to new RKPD build flag "remote_provisioning.enable_rkpd". Bug: 261214100 Test: CtsIdentityTestCases Change-Id: Idc11abb3c0e46de1a77609969e8539e9e96549d5
2022-12-20identity: Migrate to RKPD for attestation keysTri Vo
Bug: 261214100 Test: TBD Change-Id: I760ba8c23be0889e7d01ac6c1513eba348ff96b2
2022-12-09identity: Add support for setting minimum validity period for AuthKey.David Zeuthen
This change adds support for specifying that an AuthKey should be replaced if it's going to expire within a certain amount of time configurable by the application. This also adds a way for the application to learn about the expiration time of currently configured AuthKeys. Combined these two changes allow an application to get a perfect picture of which AuthKeys are available, when they expire, and allows the application to refresh AuthKeys well ahead of expiration dates. Also remove checking storeStaticAuthenticationDataWithExpiration() is only available on HAL version 3 and later (feature version 202101 and later). This works on any HAL version. Bug: 241912421 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: Ic8274088035c31f73ad61645ee5e0281b3460837
2022-12-09identity: Add support for ECDSA auth and don't require session encryption.David Zeuthen
This change uses new API in Identity Credential HAL version 5 and later to obtain the mdoc ECDSA authentication signature and pass it to the framework API. Bug: 241912421 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: I4bb8ba8c4a46a91791af9e0e48c81894d896a2d0
2022-11-09Add dependencies on newly-split RKP HALSeth Moore
Bug: 254112961 Test: vts_treble_vintf_vendor_test Merged-In: I5506757aaebdf37d42bf7ac0a68e83f2d3c12049 Change-Id: I5506757aaebdf37d42bf7ac0a68e83f2d3c12049
2022-09-08Merge "Use latest Identity AIDL API"Tri Vo
2022-09-08identity: Fix incorrect encoding P256 public keyJoseph Jang
Bug: 240359297 Change-Id: I8799f41765fe1acae2e11739806d4aedeb93976c
2022-09-07identity: Add a utility function to convert P-256 EC public key to DER formatJoseph Jang
Bug: 240359297 Test: atest --rerun-until-failure 1000 android.security.identity.cts.ReaderAuthTest#readerAuth Change-Id: I38e1085db04478c91306e0d51f66de061a034e18
2022-09-06Use latest Identity AIDL APITri Vo
Test: m Change-Id: I5cf1ad1ca8ac28ee02f875b3c3a8957b288300db
2022-07-27Merge "identity: Fix buildSessionTranscript() from a zero leading P-256 EC ↵Joseph Jang
Public Key." am: 95d55c3858 Original change: https://android-review.googlesource.com/c/platform/system/security/+/2163887 Change-Id: Idcab814ea6747b63aa675876e11e4df7be1abc91 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-07-27identity: Fix buildSessionTranscript() from a zero leading P-256 EC Public Key.Joseph Jang
Properly encode an sessiontranscript from P-256 EC Public Key, in particular ensure that the resulting sessiontranscript which includes an valid P-256 EC public key is expected. Was able to reproduce this with about 1% failures running a test. After the fix didn't get a failure in 1,000 runs. This bug is similar with AOSP patch "identity: Fix uncompressed form encoding of P-256 EC Public Key." Bug: 239857653 Test: atest --rerun-until-failure 1000 android.security.identity.cts.ReaderAuthTest#readerAuth Change-Id: Id5ce46977cf3b6ce6c43beda657cd26b24969fe5
2022-05-17Merge "Deleted clang property in Android.bp files" am: 16e71512d5 am: 2b255b4669Alix Espino
Original change: https://android-review.googlesource.com/c/platform/system/security/+/2066807 Change-Id: Ic7837ef3c0d97cdf3fa32fcc494582ecc5508a95 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-04-25Deleted clang property in Android.bp filesAlix
Deleted deprecated clang property in Android.bp files using bpmodify. Bug: 208980553 Test: treehugger Change-Id: Id79d4e319ffc7d45b508772ae0df2e43bd22bf8f
2022-03-30V3 is the latest keymaster HAL interfaceJiyong Park
Ignore-AOSP-First: part of TM API freeze Bug: 225941299 Test: m Change-Id: I56f8f46b5216a0105a918dc58ae329f8a6acafe6
2022-02-02Add support for RKP to credstoreSeth Moore
Call out to keystore and request remotely provisioned attestation keys. This reduces our dependence on factory-provisioned attestation keys. Test: CtsIdentityTestCases Bug: 194696876 Change-Id: Ief07750ef6b2a465060c64207063568b9a51af68
2022-01-25Revert^2 "Add dependency on keymint cpp lib"Seth Moore
a45b3815bde1a7834f0abd3e8d3abd298937d02a Change-Id: Ibb935a42a0f2ac2a424f5b3b970866f80997fce6
2022-01-25Revert "Add dependency on keymint cpp lib"Seth Moore
Revert "Allow default identity service to call keymint" Revert submission 1956689-add rkp to identity-default Reason for revert: Broke git-master. Will resubmit later. Reverted Changes: I96dcf3027:Add remote key provisioning to the IC HAL Id686ac33a:Add dependency on keymint cpp lib Ib368a2a00:Log to logd in the default identity service I7d2906de0:Refactor IC support for RKP Iae0f14f1c:Fix formatting of identity credential aidl I01d086a4b:Allow default identity service to call keymint Change-Id: Icdc0f41021c5f07ed349e0421179718f9db20e67
2022-01-24Add dependency on keymint cpp libSeth Moore
android.hardware.identity-V4-cpp depends on the keymint cpp lib, so we need to also link to it to satisfy all the link-time dependencies. Test: VtsHalIdentityTargetTest Bug: 194696876 Change-Id: Id686ac33a4112880b205c5c612fd8b51d2715e3b
2022-01-10identity: Add multi-document presentation support.David Zeuthen
Also fix a bug so the same AuthKey is used for several getEntries() calls on a credential. This matches the behavior in the Jetpack. Bug: 197965513 Test: New CTS tests and new screen in CtsVerifier Change-Id: I344f44b5655f0977ee650b518ce669e3c8a7b47a
2021-12-02Depend on KeyMint HAL via defaultDavid Drysdale
This allows for easier bumping of the KeyMint version level. At the moment this change should have no effect: the same dependency is used, just reached via a default rather than explicitly. However, when the KeyMint version increases in the near future, using this default should mean that no change is needed here: the default definition will change to -V2 and this will be referenced here. Test: TreeHugger Change-Id: I8cce78e7f56179db23b2de792764ea2cae2d3cb7
2021-09-30Inform Java BigInteger that the input bytes are positiveSeth Moore
The COSE spec requires exact sizes for signatures, so any leading zeros (which indicate a positive integer) are removed. This causes BigInteger to assume the input is negative if the leading byte is 0xff, and it strips that byte off. This breaks conversion from COSE -> DER signatures. Explicitly tell BigInteger the input is always positive (per the COSE spec) so that it leaves leading 0xff alone. Test: identity-credential-util-tests Fixes: 201574298 Change-Id: Ib2e587964125ea15fedd8a6e3ddb2bc422c211e3
2021-09-22Add utilities for ISO 18013-5 (mdl)Seth Moore
These are mobile driving license helpers and constants for working with the mDL application protocol. Change-Id: I51a8845fad170cd596b92103a409ca94fc98d69c Test: CtsIdentityTestCases Test: IdCredSupportTests
2021-09-22Make CBOR and COSE CTS utilities reusableSeth Moore
We need these utilities for tools, and they may prove handy for production code. Move them into system/security and flesh out the unit tests. Test: IdCredSupportTests Change-Id: I18dd909e46aec5e315adb4358dc23088d70fa899
2021-07-27Remove ndk_platform backend. Use the ndk backend.Jiyong Park
The ndk_platform backend will soon be deprecated because the ndk backend can serve the same purpose. This is to eliminate the confusion about having two variants (ndk and ndk_platform) for the same 'ndk' backend. Bug: 161456198 Test: m Change-Id: Ibeb4178f99857be75bb5f83a073a2d679058d921
2021-04-05Changing libcppbor dependencyMax Bires
This change replaces libcppbor with libcppbor_external as part of the effort to remove the partial libcppbor copy that lives in hardware/interfaces. Bug: 182445123 Test: It builds Change-Id: I9c96cdf807979ecf806c80edd3cec9c443294c22
2021-03-31identity: Use "credstore" for LOG_TAG everywhere.David Zeuthen
Currently we're using file-specific tags which makes it hard for people looking at logcat to infer it's actually from credstore and it also complicates filtering. Just use "credstore" everywhere. Also change logging level from ERROR to INFO in the message "Registered binder service" which is logged on startup. Bug: None Test: Compiles + manual inspection via logcat Test: atest android.security.identity.cts (on goldfish) Change-Id: I336d1a4e4e10b87fd3f08a5046cf5e13f09c9cb6
2021-03-31Merge changes from topic "identity-add-presubmit"David Zeuthen
* changes: keystore2: Also run CtsIdentityTestCases on presubmit. identity: add TEST_MAPPING file to run identity CTS in presubmit.
2021-03-23identity: add TEST_MAPPING file to run identity CTS in presubmit.David Zeuthen
Bug: None Test: N/A Change-Id: I97399c492fca2d3602792b149246e9e817179810
2021-03-22Fix bug where credstore is immediately exiting.Hasini Gunasinghe
This CL adds the fix for the credstore failure reported in b/183253539. Bug: 183253539 Test: CtsVerifier's Identity Credential Authentication test Test: atest android.security.identity.cts Change-Id: I396f36a58d260e3e081ef8a94aaf64431d0ad484
2021-03-19Credstore: Remove dependency to keystore1.Hasini Gunasinghe
This CL removes dependency to keystore1 from credstore. Test: yet to be tested. Change-Id: I75934d1154d955aca3ea0cd0651690f68c6a8b55
2021-03-17Keystore 2.0: Start keystore2 unconditionally.Janis Danisevskis
Bug: 170144267 Test: N/A Merged-In: Ia942a494c2af96a55d83a2495f4e5fba9eb77dff Change-Id: Ia942a494c2af96a55d83a2495f4e5fba9eb77dff
2021-03-15Fix the text of the error message, in the case of service specific errorHasini Gunasinghe
This is a followup CL to address the last code review comment at: aosp/1612458. Test: N/A. This is only a change in the text of the error. Change-Id: I5d5a040ee23ef20836633e296376c6e4bbfc0e47
2021-03-12Integrate getAuthTokensForCredStore method with credstore.Hasini Gunasinghe
Bug: 159341610 Test: CtsVerifier Change-Id: Ia2b7f1a27a05e92c7b5bb5da14caa423a70ac15b
2021-03-08credstore: Fix several problems with credstore.David Zeuthen
The root of the problem is that in some cases credstore would pass auth- and verification-tokens to the Identity Credential HAL without first having obtained a challenge via IIdentityCredential.createAuthChallenge(). This makes it impossible for the TA to validate the verification token for freshness. This is easily fixed by simply ensuring createAuthChallenge() is called (and the returned challenge is used in the requested verification token) whenever dealing with ACPs using user authentication. Additional issues / changes: - During Android 12 development, an use-after-free bug was introduced in Credential.cpp L120. - keystore's getTokensForCredstore() had some bugs in how to select an auth-token, in particular mixing authTokenAgeMillis (milliseconds) with time_t values (seconds) - as a result, keystore would sometimes return tokens older than what credstore requested. This wasn't actually problem because the TA would check it anyway. - we now precisely define semantics in IKeystoreService.aidl - Another potential use-after-free bug was found in Credential.cpp L767 None of the fixes for these bugs affect CTS or VTS tests. Bug: 181893400 Test: atest android.security.identity.cts on emulator Test: atest android.security.identity.cts on crosshatch (w/ Android 11 era HAL) Test: CtsVerifier's Identity Credential Authentication test crosshatch (w/ Android 11 era HAL) Change-Id: I45a3fd16eff3b6a232d8b8c88f2e3dd3619a9c03
2021-02-14[LSC] Add LOCAL_LICENSE_KINDS to system/securityBob Badour
Added SPDX-license-identifier-Apache-2.0 to: fsverity_init/Android.bp identity/Android.bp keystore/tests/Android.bp keystore2/Android.bp keystore2/aaid/Android.bp keystore2/aidl/Android.bp keystore2/apc_compat/Android.bp keystore2/selinux/Android.bp keystore2/src/crypto/Android.bp keystore2/src/km_compat/Android.bp ondevice-signing/Android.bp provisioner/Android.bp Added SPDX-license-identifier-Apache-2.0 SPDX-license-identifier-BSD to: Android.bp keystore/Android.bp Added SPDX-license-identifier-BSD to: keystore-engine/Android.bp Bug: 68860345 Bug: 151177513 Bug: 151953481 Test: m all Exempt-From-Owner-Approval: janitorial work Change-Id: Ic9e19695bd19c3f127dfd545df60e4c9df89af77
2021-01-27Specify version for aidl_interface explicitlyJeongik Cha
Bug: 150578172 Test: m Change-Id: I5101d318c40268af8b8965910c0ff9d621f96740
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-25 12:41:23 +0000