Skip to content
This repository was archived by the owner on May 24, 2026. It is now read-only.

Critical bug fixes ported from Keymint.#127

Merged
mdwivedi merged 3 commits into from
May 13, 2022
Merged

Critical bug fixes ported from Keymint. #127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3bfe347
Merge pull request #61 from divegeek/Javacard_KM_41_AOSP_UPMERGE_0630
subrahmanyaman May 11, 2022
fad795c
Merge pull request #62 from divegeek/Javacard_KM_41_AOSP_UPMERGE_0630
subrahmanyaman May 12, 2022
f9ad6eb
Critical bug fixes ported from Keymint
subrahmanyaman May 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -115,7 +115,7 @@ public boolean isUpgradeAllowed(short version) {
upgradeAllowed = true;
}
} else if ((short) (currentMajorVersion - oldMajorVersion) == 0) {
if ((short) (currentMinorVersion - oldMinorVersion) == 1) {
if (currentMinorVersion >= oldMinorVersion) {
upgradeAllowed = true;
}
}
Expand Down
11 changes: 6 additions & 5 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -78,7 +78,8 @@ public class KMAttestationCertImpl implements KMAttestationCert {
KMType.USAGE_EXPIRE_DATETIME,
KMType.ORIGINATION_EXPIRE_DATETIME,
KMType.ACTIVE_DATETIME,
KMType.UNLOCKED_DEVICE_REQUIRED
KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.ALLOW_WHILE_ON_BODY
};

// Below are the allowed hardwareEnforced Authorization tags inside the attestation certificate's extension.
Expand All@@ -89,8 +90,8 @@ public class KMAttestationCertImpl implements KMAttestationCert {
KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT,
KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND,
KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST,
KMType.ORIGIN, KMType.AUTH_TIMEOUT, KMType.USER_AUTH_TYPE,
KMType.NO_AUTH_REQUIRED, KMType.USER_SECURE_ID,
KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED,
KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH,
KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE,
KMType.KEYSIZE, KMType.ALGORITHM, KMType.PURPOSE};
Expand DownExpand Up@@ -227,10 +228,10 @@ public KMAttestationCert notBefore(short obj, byte[] scratchpad) {
public KMAttestationCert notAfter(short usageExpiryTimeObj,
short certExpirtyTimeObj, byte[] scratchPad, short tmpVar) {
if (usageExpiryTimeObj != KMType.INVALID_VALUE) {
// compare if the expiry time is greater then 2051 then use generalized
// compare if the expiry time is greater then 2050 then use generalized
// time format else use utc time format.
usageExpiryTimeObj = KMIntegerTag.cast(usageExpiryTimeObj).getValue();
tmpVar = KMInteger.uint_64(KMUtils.firstJan2051, (short) 0);
tmpVar = KMInteger.uint_64(KMUtils.firstJan2050, (short) 0);
if (KMInteger.compare(usageExpiryTimeObj, tmpVar) >= 0) {
usageExpiryTimeObj = KMUtils.convertToDate(usageExpiryTimeObj, scratchPad,
false);
Expand Down
4 changes: 2 additions & 2 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMRsaOAEPEncoding.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -69,7 +69,7 @@ private short getDigestLength() {
return MessageDigest.LENGTH_SHA_256;
case MessageDigest.ALG_SHA_384:
return MessageDigest.LENGTH_SHA_384;
case MessageDigest.ALG_SHA3_512:
case MessageDigest.ALG_SHA_512:
return MessageDigest.LENGTH_SHA_512;
default:
CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
Expand DownExpand Up@@ -257,4 +257,4 @@ private short rsaOAEPDecode(byte[] encodedMsg, short encodedMsgOff,
KMAndroidSEProvider.TMP_ARRAY_SIZE, (byte) 0);
}
}
}
}
13 changes: 6 additions & 7 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMUtils.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,9 +39,8 @@ public class KMUtils {
0, 0, 0, 0x1D, 0x63, (byte) 0xEB, 0x0C, 0x00};//126230400000
public static final byte[] firstJan2020 = {
0, 0, 0x01, 0x6F, 0x5E, 0x66, (byte) 0xE8, 0x00}; // 1577836800000 msec
public static final byte[] firstJan2051 = {
0, 0, 0x02, 0x53, 0x26, (byte) 0x0E, (byte) 0x1C, 0x00}; // 2556144000000
// msec
public static final byte[] firstJan2050 = {
0, 0, 0x02, 0x4b, (byte) 0xCE, 0x5C, (byte)0xF0, 0x00}; //2524608000000 msec
public static final byte[] febMonthLeapMSec = {
0, 0, 0, 0, (byte) 0x95, 0x58, 0x6C, 0x00}; //2505600000
public static final byte[] febMonthMsec = {
Expand DownExpand Up@@ -78,12 +77,12 @@ public static short convertToDate(short time, byte[] scratchPad,
KMException.throwIt(KMError.INVALID_ARGUMENT);
}
if (utcFlag
&& KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051,
&& KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2050,
(short) 0, (short) 8) >= 0) {
KMException.throwIt(KMError.INVALID_ARGUMENT);
}

if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0,
if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2050, (short) 0,
(short) 8) < 0) {
Util.arrayCopyNonAtomic(firstJan2020, (short) 0, scratchPad, (short) 8,
(short) 8);
Expand All@@ -92,7 +91,7 @@ public static short convertToDate(short time, byte[] scratchPad,
(short) 8);
} else {
from2020 = false;
Util.arrayCopyNonAtomic(firstJan2051, (short) 0, scratchPad, (short) 8,
Util.arrayCopyNonAtomic(firstJan2050, (short) 0, scratchPad, (short) 8,
(short) 8);
subtract(scratchPad, (short) 0, (short) 8, (short) 16);
Util.arrayCopyNonAtomic(scratchPad, (short) 16, scratchPad, (short) 0,
Expand DownExpand Up@@ -397,7 +396,7 @@ public static short countTemporalCount(byte[] bufTime, short timeOff,
scratchPad,
(short) (offset + 8 - timeLen),
timeLen);
Util.arrayCopyNonAtomic(oneMonthMsec, (short) 0, scratchPad, (short) (offset + 8),
Util.arrayCopyNonAtomic(ThirtDaysMonthMsec, (short) 0, scratchPad, (short) (offset + 8),
(short) 8);
return divide(scratchPad, (short) 0, (short) 8, (short) 16);
}
Expand Down
11 changes: 6 additions & 5 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -196,10 +196,10 @@ public KMAttestationCert notBefore(short obj, byte[] scratchpad) {
public KMAttestationCert notAfter(short usageExpiryTimeObj,
short certExpirtyTimeObj, byte[] scratchPad, short tmpVar) {
if (usageExpiryTimeObj != KMType.INVALID_VALUE) {
// compare if the expiry time is greater then 2051 then use generalized
// compare if the expiry time is greater then 2050 then use generalized
// time format else use utc time format.
usageExpiryTimeObj = KMIntegerTag.cast(usageExpiryTimeObj).getValue();
tmpVar = KMInteger.uint_64(KMUtils.firstJan2051, (short) 0);
tmpVar = KMInteger.uint_64(KMUtils.firstJan2050, (short) 0);
if (KMInteger.compare(usageExpiryTimeObj, tmpVar) >= 0) {
usageExpiryTimeObj = KMUtils.convertToDate(usageExpiryTimeObj, scratchPad,
false);
Expand DownExpand Up@@ -449,7 +449,8 @@ private static void pushSWParams() {
short[] tagIds = {
KMType.ATTESTATION_APPLICATION_ID, KMType.CREATION_DATETIME,
KMType.USAGE_EXPIRE_DATETIME, KMType.ORIGINATION_EXPIRE_DATETIME,
KMType.ACTIVE_DATETIME, KMType.UNLOCKED_DEVICE_REQUIRED};
KMType.ACTIVE_DATETIME, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.ALLOW_WHILE_ON_BODY};
byte index = 0;
do {
pushParams(swParams, swParamsIndex, tagIds[index]);
Expand All@@ -467,8 +468,8 @@ private static void pushHWParams() {
KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT,
KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND,
KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST,
KMType.ORIGIN, KMType.AUTH_TIMEOUT, KMType.USER_AUTH_TYPE,
KMType.NO_AUTH_REQUIRED, KMType.USER_SECURE_ID,
KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED,
KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH,
KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE,
KMType.KEYSIZE, KMType.ALGORITHM, KMType.PURPOSE};
Expand Down
15 changes: 7 additions & 8 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMUtils.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,9 +39,8 @@ public class KMUtils {
0, 0, 0, 0x1D, 0x63, (byte) 0xEB, 0x0C, 0x00};//126230400000
public static final byte[] firstJan2020 = {
0, 0, 0x01, 0x6F, 0x5E, 0x66, (byte) 0xE8, 0x00}; // 1577836800000 msec
public static final byte[] firstJan2051 = {
0, 0, 0x02, 0x53, 0x26, (byte) 0x0E, (byte) 0x1C, 0x00}; // 2556144000000
// msec
public static final byte[] firstJan2050 = {
0, 0, 0x02, 0x4b, (byte) 0xCE, 0x5C, (byte)0xF0, 0x00}; //2524608000000 msec
public static final byte[] febMonthLeapMSec = {
0, 0, 0, 0, (byte) 0x95, 0x58, 0x6C, 0x00}; //2505600000
public static final byte[] febMonthMsec = {
Expand DownExpand Up@@ -76,12 +75,12 @@ public static short convertToDate(short time, byte[] scratchPad,
KMException.throwIt(KMError.INVALID_ARGUMENT);
}
if (utcFlag
&& KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051,
&& KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2050,
(short) 0, (short) 8) >= 0) {
KMException.throwIt(KMError.INVALID_ARGUMENT);
}

if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0,
if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2050, (short) 0,
(short) 8) < 0) {
Util.arrayCopyNonAtomic(firstJan2020, (short) 0, scratchPad, (short) 8,
(short) 8);
Expand All@@ -90,7 +89,7 @@ public static short convertToDate(short time, byte[] scratchPad,
(short) 8);
} else {
from2020 = false;
Util.arrayCopyNonAtomic(firstJan2051, (short) 0, scratchPad, (short) 8,
Util.arrayCopyNonAtomic(firstJan2050, (short) 0, scratchPad, (short) 8,
(short) 8);
subtract(scratchPad, (short) 0, (short) 8, (short) 16);
Util.arrayCopyNonAtomic(scratchPad, (short) 16, scratchPad, (short) 0,
Expand DownExpand Up@@ -351,7 +350,7 @@ public static void add(byte[] buf, short op1, short op2, short result) {
byte carry = 0;
short tmp;
short val1 = 0;
short val2 = 0;
short val2 = 0;
while (index >= 0) {
val1 = (short) (buf[(short) (op1 + index)] & 0x00FF);
val2 = (short) (buf[(short) (op2 + index)] & 0x00FF);
Expand DownExpand Up@@ -395,7 +394,7 @@ public static short countTemporalCount(byte[] bufTime, short timeOff,
scratchPad,
(short) (offset + 8 - timeLen),
timeLen);
Util.arrayCopyNonAtomic(oneMonthMsec, (short) 0, scratchPad, (short) (offset + 8),
Util.arrayCopyNonAtomic(ThirtDaysMonthMsec, (short) 0, scratchPad, (short) (offset + 8),
(short) 8);
return divide(scratchPad, (short) 0, (short) 8, (short) 16);
}
Expand Down
5 changes: 5 additions & 0 deletions Applet/src/com/android/javacard/keymaster/KMArray.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -114,6 +114,11 @@ public short length() {
return Util.getShort(heap, (short) (instanceTable[KM_ARRAY_OFFSET] + TLV_HEADER_SIZE + 2));
}

public short setLength(short len) {
return Util.setShort(heap,
(short) (KMType.instanceTable[KM_ARRAY_OFFSET] + TLV_HEADER_SIZE + 2), len);
}

public byte[] getBuffer() {
return heap;
}
Expand Down
4 changes: 3 additions & 1 deletion Applet/src/com/android/javacard/keymaster/KMDecoder.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -170,6 +170,7 @@ private short decodeKeyParam(short exp) {
short tagClass;
short allowedType;
short obj;
short arrPos = 0;
// For each tag in payload ...
while (index < payloadLength) {
tagFound = false;
Expand All@@ -183,7 +184,7 @@ private short decodeKeyParam(short exp) {
if (tagType == allowedType) {
// then decodeByteBlob and add that to the array.
obj = decode(tagClass);
KMArray.cast(vals).add(index, obj);
KMArray.cast(vals).add(arrPos++, obj);
tagFound = true;
break;
}
Expand All@@ -195,6 +196,7 @@ private short decodeKeyParam(short exp) {
index++;
}
}
KMArray.cast(vals).setLength(arrPos);
return KMKeyParameters.instance(vals);
}

Expand Down
2 changes: 0 additions & 2 deletions Applet/src/com/android/javacard/keymaster/KMKeyParameters.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,6 @@ public class KMKeyParameters extends KMType {

private static final short[] hwEnforcedTagArr = {
// HW Enforced
KMType.ENUM_TAG, KMType.ORIGIN,
KMType.ENUM_ARRAY_TAG, KMType.PURPOSE,
KMType.ENUM_TAG, KMType.ALGORITHM,
KMType.UINT_TAG, KMType.KEYSIZE,
Expand All@@ -54,7 +53,6 @@ public class KMKeyParameters extends KMType {
KMType.BOOL_TAG, KMType.ROLLBACK_RESISTANCE,
KMType.ENUM_TAG, KMType.USER_AUTH_TYPE,
KMType.BOOL_TAG, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.BOOL_TAG, KMType.RESET_SINCE_ID_ROTATION,
KMType.BOOL_TAG, KMType.BOOTLOADER_ONLY,
KMType.BOOL_TAG, KMType.EARLY_BOOT_ONLY,
KMType.UINT_TAG, KMType.MAX_USES_PER_BOOT,
Expand Down
Loading