Skip to content
This repository was archived by the owner on May 24, 2026. It is now read-only.

Valdiate token at first#158

Merged
mdwivedi merged 2 commits into from
Jun 13, 2022
Merged

Valdiate token at first #158

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5d8efae
Merge pull request #75 from divegeek/Javacard_KM_41_AOSP_UPMERGE_0630
subrahmanyaman Jun 11, 2022
7613056
Validate token at the start itself.
subrahmanyaman Jun 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2163,6 +2163,9 @@ private void authorizeUpdateFinishOperation(KMOperationState op, byte[] scratchP
}
op.setAuthTimeoutValidated(true);
} else if (op.isAuthPerOperationReqd()) { // If Auth per operation is required
if (!validateHwToken(data[HW_TOKEN], scratchPad)) {
KMException.throwIt(KMError.KEY_USER_NOT_AUTHENTICATED);
}
tmpVariables[0] = KMHardwareAuthToken.cast(data[HW_TOKEN]).getChallenge();
if (KMInteger.compare(data[OP_HANDLE], tmpVariables[0]) != 0) {
KMException.throwIt(KMError.KEY_USER_NOT_AUTHENTICATED);
Expand DownExpand Up@@ -2226,7 +2229,7 @@ private void authorizeDeviceUnlock(byte[] scratchPad) {
KMType.BOOL_TAG, KMType.UNLOCKED_DEVICE_REQUIRED, data[HW_PARAMETERS]);

if (ptr != KMType.INVALID_VALUE && repository.getDeviceLock()) {
if (!validateHwToken(data[HW_TOKEN], scratchPad)) {
if (data[HW_TOKEN] == KMType.INVALID_VALUE) {
KMException.throwIt(KMError.DEVICE_LOCKED);
}
ptr = KMHardwareAuthToken.cast(data[HW_TOKEN]).getTimestamp();
Expand DownExpand Up@@ -2808,6 +2811,9 @@ private void authorizeAndBeginOperation(KMOperationState op, byte[] scratchPad)
authorizeDigest(op);
authorizePadding(op);
authorizeBlockModeAndMacLength(op);
if (!validateHwToken(data[HW_TOKEN], scratchPad)) {
data[HW_TOKEN] = KMType.INVALID_VALUE;
}
authorizeUserSecureIdAuthTimeout(op, scratchPad);
authorizeDeviceUnlock(scratchPad);
authorizeKeyUsageForCount(scratchPad);
Expand DownExpand Up@@ -3110,7 +3116,7 @@ private boolean isHwAuthTokenContainsMatchingSecureId(short hwAuthToken,

private boolean authTokenMatches(short userSecureIdsPtr, short authType,
byte[] scratchPad) {
if (!validateHwToken(data[HW_TOKEN], scratchPad)) {
if (data[HW_TOKEN] == KMType.INVALID_VALUE) {
return false;
}
if (!isHwAuthTokenContainsMatchingSecureId(data[HW_TOKEN], userSecureIdsPtr)) {
Expand Down