Skip to content

Keymint 200 rkp v3#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AvinashHedage merged 6 commits into from
Sep 21, 2022
Merged

Keymint 200 rkp v3 #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e058ecf
Merge pull request #107 from divegeek/Javacard_KeyMint_200_master
subrahmanyaman Sep 12, 2022
d08c648
1. Ignore SIGPIPE signal and receive EPIPE error code from send call.
subrahmanyaman Sep 13, 2022
5725aaf
Merge pull request #223 from subrahmanyaman/Javacard_KeyMint_200_master
mdwivedi Sep 21, 2022
fbbd0ae
Merge pull request #109 from divegeek/Javacard_KeyMint_200_master
subrahmanyaman Sep 21, 2022
73400ce
Merge branch 'Javacard_KeyMint_200_master' into keymint_200_rkp_v3
subrahmanyaman Sep 21, 2022
c7fbd06
Converted UDSCertChain to X509 certificates
subrahmanyaman Sep 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 30 additions & 34 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -153,7 +153,7 @@ public void process(APDU apdu) {
case INS_PROVISION_SECURE_BOOT_MODE_CMD:
processSecureBootCmd(apdu);
break;

default:
super.process(apdu);
break;
Expand DownExpand Up@@ -239,7 +239,8 @@ private boolean isSeFactoryProvisioningLocked() {

private boolean isSeFactoryProvisioningComplete() {
short pStatus = kmDataStore.getProvisionStatus();
short seCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN;
short seCompleteStatus = (PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR |
PROVISION_STATUS_ADDITIONAL_CERT_CHAIN);
if (seCompleteStatus == (pStatus & seCompleteStatus)) {
return true;
}
Expand DownExpand Up@@ -380,18 +381,28 @@ private static void processProvisionRkpDeviceUniqueKeyPair(APDU apdu) {
sendResponse(apdu, KMError.OK);
}

private static void processProvisionRkpAdditionalCertChain(APDU apdu) {
// Prepare the expression to decode
short headers = KMCoseHeaders.exp();
short arrInst = KMArray.instance((short) 4);
KMArray.cast(arrInst).add((short) 0, KMByteBlob.exp());
KMArray.cast(arrInst).add((short) 1, headers);
KMArray.cast(arrInst).add((short) 2, KMByteBlob.exp());
KMArray.cast(arrInst).add((short) 3, KMByteBlob.exp());
short coseSignArr = KMArray.exp(arrInst);
short map = KMMap.instance((short) 1);
KMMap.cast(map).add((short) 0, KMTextString.exp(), coseSignArr);
// receive incoming data and decode it.
private void processProvisionRkpAdditionalCertChain(APDU apdu) {
// X509 certificate chain is received as shown below:
/**
* x509CertChain = bstr .cbor UdsCerts
*
* UdsCerts = {
* * SignerName => UdsCertChain
* }
* ; SignerName is a string identifier that indicates both the signing authority as
* ; well as the format of the UdsCertChain
* SignerName = tstr
*
* UdsCertChain = [
* 2* X509Certificate ; Root -> ... -> Leaf. "Root" is the vendor self-signed
* ; cert, "Leaf" contains UDS_Public. There may also be
* ; intermediate certificates between Root and Leaf.
* ]
* ; A bstr containing a DER-encoded X.509 certificate (RSA, NIST P-curve, or edDSA)
* X509Certificate = bstr
*/
// Store the cbor encoded UdsCerts as it is in the persistent memory so cbor decoding is
// required here.
byte[] srcBuffer = apdu.getBuffer();
short recvLen = apdu.setIncomingAndReceive();
short srcOffset = apdu.getOffsetCdata();
Expand All@@ -404,27 +415,12 @@ private static void processProvisionRkpAdditionalCertChain(APDU apdu) {
index += recvLen;
recvLen = apdu.receiveBytes(srcOffset);
}
// decode
map = decoder.decode(map, buffer, bufferStartOffset, bufferLength);
arrInst = KMMap.cast(map).getKeyValue((short) 0);
// Validate Additional certificate chain.
short leafCoseKey =
validateCertChain(false, KMCose.COSE_ALG_ES256, KMCose.COSE_ALG_ES256, arrInst,
srcBuffer, null);
// Compare the DK_Pub.
short pubKeyLen = KMCoseKey.cast(leafCoseKey).getEcdsa256PublicKey(srcBuffer, (short) 0);
KMDeviceUniqueKeyPair uniqueKey = kmDataStore.getRkpDeviceUniqueKeyPair(false);
if (uniqueKey == null) {
KMException.throwIt(KMError.STATUS_FAILED);
}
short uniqueKeyLen = uniqueKey.getPublicKey(srcBuffer, pubKeyLen);
if ((pubKeyLen != uniqueKeyLen) ||
(0 != Util.arrayCompare(srcBuffer, (short) 0, srcBuffer, pubKeyLen, pubKeyLen))) {
KMException.throwIt(KMError.STATUS_FAILED);
}
kmDataStore.persistAdditionalCertChain(buffer, bufferStartOffset, bufferLength);
short byteHeaderLen = decoder.readCertificateChainHeaderLen(buffer, bufferStartOffset,
bufferLength);
kmDataStore.persistAdditionalCertChain(buffer, (short) (bufferStartOffset + byteHeaderLen),
(short) (bufferLength - byteHeaderLen));
kmDataStore.setProvisionStatus(PROVISION_STATUS_ADDITIONAL_CERT_CHAIN);
//reclaim memory
//reclaim memory
repository.reclaimMemory(bufferLength);
sendResponse(apdu, KMError.OK);
}
Expand Down
12 changes: 6 additions & 6 deletions Applet/JCardSimProvider/test/com/android/javacard/test/KMFunctionalTest.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1482,7 +1482,7 @@ public void testVerifyOemLockWithOutSeLockFailure() {
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionDeviceUniqueKeyPair(simulator, cryptoProvider, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionAdditionalCertChain(simulator, cryptoProvider, encoder, decoder)));
KMProvision.provisionAdditionalCertChain(simulator, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionSharedSecret(simulator, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
Expand All@@ -1505,7 +1505,7 @@ public void testVerifyOemUnLockAfterOemLockSuccess() {
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionDeviceUniqueKeyPair(simulator, cryptoProvider, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionAdditionalCertChain(simulator, cryptoProvider, encoder, decoder)));
KMProvision.provisionAdditionalCertChain(simulator, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionSeLocked(simulator, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
Expand DownExpand Up@@ -1552,7 +1552,7 @@ public void testVerifyOemLockWithOutOemRootKeyFailure() {
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionDeviceUniqueKeyPair(simulator, cryptoProvider, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionAdditionalCertChain(simulator, cryptoProvider, encoder, decoder)));
KMProvision.provisionAdditionalCertChain(simulator, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionSeLocked(simulator, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
Expand DownExpand Up@@ -1588,13 +1588,13 @@ public void testVerifyProvisionSeDataAfterSeLockFailure() {
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionDeviceUniqueKeyPair(simulator, cryptoProvider, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionAdditionalCertChain(simulator, cryptoProvider, encoder, decoder)));
KMProvision.provisionAdditionalCertChain(simulator, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionSeLocked(simulator, decoder)));
Assert.assertEquals(KMError.UNKNOWN_ERROR, KMTestUtils.decodeError(decoder,
KMProvision.provisionDeviceUniqueKeyPair(simulator, cryptoProvider, encoder, decoder)));
Assert.assertEquals(KMError.UNKNOWN_ERROR, KMTestUtils.decodeError(decoder,
KMProvision.provisionAdditionalCertChain(simulator, cryptoProvider, encoder, decoder)));
KMProvision.provisionAdditionalCertChain(simulator, encoder, decoder)));
cleanUp();
}

Expand All@@ -1608,7 +1608,7 @@ public void testVerifyOemProvisionAfterOemLockFailure() {
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionDeviceUniqueKeyPair(simulator, cryptoProvider, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionAdditionalCertChain(simulator, cryptoProvider, encoder, decoder)));
KMProvision.provisionAdditionalCertChain(simulator, encoder, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
KMProvision.provisionSeLocked(simulator, decoder)));
Assert.assertEquals(KMError.OK, KMTestUtils.decodeError(decoder,
Expand Down
Loading