Skip to content
This repository was archived by the owner on May 24, 2026. It is now read-only.

Keymaster bug fixes#131

Merged
mdwivedi merged 4 commits into from
May 19, 2022
Merged

Keymaster bug fixes #131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6894a1a
Merge pull request #63 from divegeek/Javacard_KM_41_AOSP_UPMERGE_0630
subrahmanyaman May 13, 2022
bbdb12a
Merge pull request #64 from divegeek/Javacard_KM_41_AOSP_UPMERGE_0630
subrahmanyaman May 13, 2022
b45a2f4
1. Renamed the PACKAGE_VERSION to DATA_BASE_VERSION
subrahmanyaman May 17, 2022
960ea3e
Add CREATION_DATETIME tag in generateKey, import and importWrappedKey
subrahmanyaman May 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -64,8 +64,8 @@ public void onRestore(Element element) {
packageVersion = packageVersion_;
provisionStatus = provisionStatus_;
keymasterState = element.readByte();
repository.onRestore(element, packageVersion, CURRENT_PACKAGE_VERSION);
seProvider.onRestore(element, packageVersion, CURRENT_PACKAGE_VERSION);
repository.onRestore(element, packageVersion, KM_PERSISTENT_DATA_STORAGE_VERSION);
seProvider.onRestore(element, packageVersion, KM_PERSISTENT_DATA_STORAGE_VERSION);
handleDataUpgradeToVersion2_0();
}

Expand DownExpand Up@@ -106,8 +106,8 @@ public boolean isUpgradeAllowed(short version) {
boolean upgradeAllowed = false;
short oldMajorVersion = (short) ((version >> 8) & 0x00FF);
short oldMinorVersion = (short) (version & 0x00FF);
short currentMajorVersion = (short) (CURRENT_PACKAGE_VERSION >> 8 & 0x00FF);
short currentMinorVersion = (short) (CURRENT_PACKAGE_VERSION & 0x00FF);
short currentMajorVersion = (short) (KM_PERSISTENT_DATA_STORAGE_VERSION >> 8 & 0x00FF);
short currentMinorVersion = (short) (KM_PERSISTENT_DATA_STORAGE_VERSION & 0x00FF);
// Downgrade of the Applet is not allowed.
// Upgrade is not allowed to a next version which is not immediate.
if ((short) (currentMajorVersion - oldMajorVersion) == 1) {
Expand DownExpand Up@@ -143,7 +143,7 @@ public void handleDataUpgradeToVersion2_0() {
status = (byte) (status | 0x20);
}
provisionStatus = status;
packageVersion = CURRENT_PACKAGE_VERSION;
packageVersion = KM_PERSISTENT_DATA_STORAGE_VERSION;

short certExpiryLen = 0;
short issuerLen = 0;
Expand Down
8 changes: 4 additions & 4 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,11 +75,10 @@ public class KMAttestationCertImpl implements KMAttestationCert {
private static final short[] swTagIds = {
KMType.ATTESTATION_APPLICATION_ID,
KMType.CREATION_DATETIME,

@subrahmanyamansubrahmanyamanMay 17, 2022

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not change the order.

KMType.ALLOW_WHILE_ON_BODY,
KMType.USAGE_EXPIRE_DATETIME,
KMType.ORIGINATION_EXPIRE_DATETIME,
KMType.ACTIVE_DATETIME,
KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.ALLOW_WHILE_ON_BODY
KMType.ACTIVE_DATETIME
};

// Below are the allowed hardwareEnforced Authorization tags inside the attestation certificate's extension.
Expand All@@ -90,7 +89,8 @@ public class KMAttestationCertImpl implements KMAttestationCert {
KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT,
KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND,
KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST,

@subrahmanyamansubrahmanyamanMay 17, 2022

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Double check all the attesatation record all the order in both keymint and keymaster.

KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.ORIGIN, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED,
KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH,
KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE,
Expand Down
3 changes: 0 additions & 3 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,4 @@ public class KMConfigurations {
public static final short CERT_ISSUER_MAX_SIZE = 250;
public static final short CERT_EXPIRY_MAX_SIZE = 20;
public static final short TOTAL_ATTEST_IDS_SIZE = 300;
// If the size of the attestation ids is known and lesser than 64

@subrahmanyamansubrahmanyamanMay 17, 2022

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This attest ids max size should not change between the upgrades.

// then reduce the size here. It reduces the heap memory usage.
public static final byte MAX_ATTESTATION_IDS_SIZE = 64;
}
9 changes: 5 additions & 4 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -448,9 +448,9 @@ private static void pushSWParams() {
// Below are the allowed softwareEnforced Authorization tags inside the attestation certificate's extension.
short[] tagIds = {
KMType.ATTESTATION_APPLICATION_ID, KMType.CREATION_DATETIME,
KMType.USAGE_EXPIRE_DATETIME, KMType.ORIGINATION_EXPIRE_DATETIME,
KMType.ACTIVE_DATETIME, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.ALLOW_WHILE_ON_BODY};
KMType.ALLOW_WHILE_ON_BODY, KMType.USAGE_EXPIRE_DATETIME,
KMType.ORIGINATION_EXPIRE_DATETIME, KMType.ACTIVE_DATETIME
};
byte index = 0;
do {
pushParams(swParams, swParamsIndex, tagIds[index]);
Expand All@@ -468,7 +468,8 @@ private static void pushHWParams() {
KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT,
KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND,
KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST,
KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.ORIGIN, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED,
KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH,
KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE,
Expand Down
3 changes: 0 additions & 3 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMConfigurations.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,4 @@ public class KMConfigurations {
public static final short CERT_ISSUER_MAX_SIZE = 250;
public static final short CERT_EXPIRY_MAX_SIZE = 20;
public static final short TOTAL_ATTEST_IDS_SIZE = 300;
// If the size of the attestation ids is known and lesser than 64
// then reduce the size here. It reduces the heap memory usage.
public static final byte MAX_ATTESTATION_IDS_SIZE = 64;
}
4 changes: 0 additions & 4 deletions Applet/src/com/android/javacard/keymaster/KMByteTag.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -122,10 +122,6 @@ private static boolean validateKey(short key, short byteBlob) {
case ATTESTATION_ID_MEID:
case ATTESTATION_ID_MANUFACTURER:
case ATTESTATION_ID_MODEL:
if (valueLen > KMConfigurations.MAX_ATTESTATION_IDS_SIZE) {
KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
}
break;
case ASSOCIATED_DATA:
case NONCE:
case CONFIRMATION_TOKEN:
Expand Down
9 changes: 3 additions & 6 deletions Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -46,7 +46,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
// Magic number version
public static final byte KM_MAGIC_NUMBER = (byte) 0x81;
// MSB byte is for Major version and LSB byte is for Minor version.
public static final short CURRENT_PACKAGE_VERSION = 0x0201; // 2.1
public static final short KM_PERSISTENT_DATA_STORAGE_VERSION = 0x0200; // 2.0

// "Keymaster HMAC Verification" - used for HMAC key verification.
public static final byte[] sharingCheck = {
Expand DownExpand Up@@ -201,7 +201,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
// ComputeHMAC constants
private static final short HMAC_SHARED_PARAM_MAX_SIZE = 64;
// Maximum certificate size.
private static final short MAX_CERT_SIZE = 2048;
private static final short MAX_CERT_SIZE = 3000;
// Buffer constants.
private static final short BUF_START_OFFSET = 0;
private static final short BUF_LEN_OFFSET = 2;
Expand DownExpand Up@@ -240,7 +240,7 @@ protected KMKeymasterApplet(KMSEProvider seImpl) {
if (!isUpgrading) {
keymasterState = KMKeymasterApplet.INIT_STATE;
seProvider.createMasterKey((short) (KMRepository.MASTER_KEY_SIZE * 8));
packageVersion = CURRENT_PACKAGE_VERSION;
packageVersion = KM_PERSISTENT_DATA_STORAGE_VERSION;
}
KMType.initialize();
encoder = new KMEncoder();
Expand DownExpand Up@@ -933,9 +933,6 @@ private void saveAttId() {
tmpVariables[0] = KMKeyParameters.findTag(KMType.BYTES_TAG, attTag, data[KEY_PARAMETERS]);
if (tmpVariables[0] != KMType.INVALID_VALUE) {
tmpVariables[0] = KMByteTag.cast(tmpVariables[0]).getValue();
if (KMByteBlob.cast(tmpVariables[0]).length() > KMConfigurations.MAX_ATTESTATION_IDS_SIZE) {
KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
}
repository.persistAttId(
mapToAttId(attTag),
KMByteBlob.cast(tmpVariables[0]).getBuffer(),
Expand Down
22 changes: 20 additions & 2 deletions HAL/keymaster/4.1/JavacardKeymaster4Device.cpp
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -649,16 +649,25 @@ Return<void> JavacardKeymaster4Device::importKey(const hidl_vec<KeyParameter>& k
std::vector<uint8_t> cborOutData;
ErrorCode errorCode = ErrorCode::UNKNOWN_ERROR;
KeyCharacteristics keyCharacteristics;
hidl_vec<KeyParameter> updatedParams(keyParams);
cppbor::Array subArray;
// Send earlyBootEnded if there is any pending earlybootEnded event.
handleSendEarlyBootEndedEvent();
if(!findTag(keyParams, Tag::CREATION_DATETIME) &&
!findTag(keyParams, Tag::ACTIVE_DATETIME)) {
//Add CREATION_DATETIME in HAL, as secure element is not having clock.
size_t size = keyParams.size();
updatedParams.resize(size+1);
updatedParams[size].tag = Tag::CREATION_DATETIME;
updatedParams[size].f.dateTime = java_time(time(nullptr));
}

if(keyFormat != KeyFormat::PKCS8 && keyFormat != KeyFormat::RAW) {
LOG(ERROR) << "INS_IMPORT_KEY_CMD unsupported key format " << (int32_t)keyFormat;
_hidl_cb(ErrorCode::UNSUPPORTED_KEY_FORMAT, keyBlob, keyCharacteristics);
return Void();
}
cborConverter_.addKeyparameters(array, keyParams);
cborConverter_.addKeyparameters(array, updatedParams);
array.add(static_cast<uint32_t>(keyFormat)); //javacard accepts only RAW.

array.add(std::vector<uint8_t>(keyData));
Expand DownExpand Up@@ -708,7 +717,16 @@ Return<void> JavacardKeymaster4Device::importWrappedKey(const hidl_vec<uint8_t>&
_hidl_cb(errorCode, keyBlob, keyCharacteristics);
return Void();
}
cborConverter_.addKeyparameters(array, authList);
hidl_vec<KeyParameter> updatedParams(authList);
if(!findTag(authList, Tag::CREATION_DATETIME) &&
!findTag(authList, Tag::ACTIVE_DATETIME)) {
//Add CREATION_DATETIME in HAL, as secure element is not having clock.
size_t size = authList.size();
updatedParams.resize(size+1);
updatedParams[size].tag = Tag::CREATION_DATETIME;
updatedParams[size].f.dateTime = java_time(time(nullptr));
}
cborConverter_.addKeyparameters(array, updatedParams);
array.add(static_cast<uint64_t>(keyFormat));
array.add(secureKey);
array.add(tag);
Expand Down