From d4c5cd099b5cd2813770fb202c7c92f9e85af67d Mon Sep 17 00:00:00 2001 From: "avinash.hedage" Date: Thu, 16 Jun 2022 07:48:10 +0000 Subject: [PATCH] applet review comments fixes --- .../javacard/keymaster/KMAndroidSEApplet.java | 28 ++--- .../javacard/seprovider/KMPoolManager.java | 42 +++----- .../javacard/keymaster/KMJCardSimApplet.java | 28 ++--- .../javacard/keymaster/KMKeymasterApplet.java | 100 +++++++++--------- .../RemotelyProvisionedComponentDevice.java | 8 +- 5 files changed, 97 insertions(+), 109 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index 848eeefd..01fbcf3a 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -105,13 +105,13 @@ public void process(APDU apdu) { case INS_PROVISION_ATTEST_IDS_CMD: processProvisionAttestIdsCmd(apdu); kmDataStore.setProvisionStatus(PROVISION_STATUS_ATTEST_IDS); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_PROVISION_PRESHARED_SECRET_CMD: processProvisionPreSharedSecretCmd(apdu); kmDataStore.setProvisionStatus(PROVISION_STATUS_PRESHARED_SECRET); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_GET_PROVISION_STATUS_CMD: @@ -132,13 +132,13 @@ public void process(APDU apdu) { case INS_SE_FACTORY_PROVISIONING_LOCK_CMD: kmDataStore.setProvisionStatus(PROVISION_STATUS_SE_LOCKED); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD: processProvisionOEMRootPublicKeyCmd(apdu); kmDataStore.setProvisionStatus(PROVISION_STATUS_OEM_PUBLIC_KEY); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_OEM_LOCK_PROVISIONING_CMD: @@ -157,13 +157,13 @@ public void process(APDU apdu) { ISOException.throwIt(ISO7816.SW_COMMAND_NOT_ALLOWED); } } catch (KMException exception) { - sendError(apdu, KMException.reason()); + sendResponse(apdu, KMException.reason()); } catch (ISOException exp) { - sendError(apdu, mapISOErrorToKMError(exp.getReason())); + sendResponse(apdu, mapISOErrorToKMError(exp.getReason())); } catch (CryptoException e) { - sendError(apdu, mapCryptoErrorToKMError(e.getReason())); + sendResponse(apdu, mapCryptoErrorToKMError(e.getReason())); } catch (Exception e) { - sendError(apdu, KMError.GENERIC_UNKNOWN_ERROR); + sendResponse(apdu, KMError.GENERIC_UNKNOWN_ERROR); } finally { repository.clean(); } @@ -253,7 +253,7 @@ private void processOEMUnlockProvisionCmd(APDU apdu) { authenticateOEM(OEM_UNLOCK_PROVISION_VERIFICATION_LABEL, apdu); kmDataStore.setProvisionLock(false); kmDataStore.unlockProvision(PROVISION_STATUS_PROVISIONING_LOCKED); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void processOEMLockProvisionCmd(APDU apdu) { @@ -261,7 +261,7 @@ private void processOEMLockProvisionCmd(APDU apdu) { // Enable the lock bit in provision status. kmDataStore.setProvisionLock(true); kmDataStore.setProvisionStatus(PROVISION_STATUS_PROVISIONING_LOCKED); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void authenticateOEM(byte[] plainMsg, APDU apdu) { @@ -366,7 +366,7 @@ private static void processProvisionRkpDeviceUniqueKeyPair(APDU apdu) { MAX_COSE_BUF_SIZE); kmDataStore.persistBootCertificateChain(scratchPad, (short) 0, len); kmDataStore.setProvisionStatus(PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private static void processProvisionRkpAdditionalCertChain(APDU apdu) { @@ -415,7 +415,7 @@ private static void processProvisionRkpAdditionalCertChain(APDU apdu) { kmDataStore.setProvisionStatus(PROVISION_STATUS_ADDITIONAL_CERT_CHAIN); //reclaim memory repository.reclaimMemory(bufferLength); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void processProvisionAttestIdsCmd(APDU apdu) { @@ -567,7 +567,7 @@ private void processSetBootParamsCmd(APDU apdu) { super.reboot(); kmDataStore.setDeviceBootStatus(KMKeymintDataStore.SET_BOOT_PARAMS_SUCCESS); seProvider.clearDeviceBooted(false); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private boolean isProvisioningComplete() { @@ -656,7 +656,7 @@ private short validateApdu(APDU apdu) { // Validate P1P2. if (P1P2 != KMKeymasterApplet.KM_HAL_VERSION) { - sendError(apdu, KMError.INVALID_P1P2); + sendResponse(apdu, KMError.INVALID_P1P2); return KMType.INVALID_VALUE; } return apduBuffer[ISO7816.OFFSET_INS]; diff --git a/Applet/AndroidSEProviderLib/src/com/android/javacard/seprovider/KMPoolManager.java b/Applet/AndroidSEProviderLib/src/com/android/javacard/seprovider/KMPoolManager.java index de9d9f37..7643e061 100644 --- a/Applet/AndroidSEProviderLib/src/com/android/javacard/seprovider/KMPoolManager.java +++ b/Applet/AndroidSEProviderLib/src/com/android/javacard/seprovider/KMPoolManager.java @@ -185,12 +185,12 @@ public static void initStatics() { private KMPoolManager() { initStatics(); - cipherPool = new Object[(short) (CIPHER_ALGS.length * 4)]; - // Extra 4 algorithms are used to support TRUSTED_CONFIRMATION_REQUIRED feature. - signerPool = new Object[(short) ((SIG_ALGS.length * 4) + 4)]; - keyAgreementPool = new Object[(short) (KEY_AGREE_ALGS.length * 4)]; + cipherPool = new Object[(short) (CIPHER_ALGS.length * MAX_OPERATION_INSTANCES)]; + // Extra 4 algorithms are used to support TRUSTED_CONFIRMATION_REQUIRED feature. + signerPool = new Object[(short) ((SIG_ALGS.length * MAX_OPERATION_INSTANCES) + MAX_OPERATION_INSTANCES)]; + keyAgreementPool = new Object[(short) (KEY_AGREE_ALGS.length * MAX_OPERATION_INSTANCES)]; - keysPool = new Object[(short) ((KEY_ALGS.length * 4) + 4)]; + keysPool = new Object[(short) ((KEY_ALGS.length * MAX_OPERATION_INSTANCES) + MAX_OPERATION_INSTANCES)]; operationPool = new Object[MAX_OPERATION_INSTANCES]; hmacSignOperationPool = new Object[MAX_OPERATION_INSTANCES]; /* Initialize pools */ @@ -213,58 +213,46 @@ private void initializeRKpObjects() { } private void initializeKeysPool() { - short index = 0; - while (index < KEY_ALGS.length) { + for(short index = 0; index < KEY_ALGS.length; index++) { keysPool[index] = createKeyObjectInstance(KEY_ALGS[index]); - index++; } } private void initializeOperationPool() { - short index = 0; - while (index < MAX_OPERATION_INSTANCES) { + for(short index = 0; index < MAX_OPERATION_INSTANCES; index++) { operationPool[index] = new KMOperationImpl(); - index++; } } private void initializeHmacSignOperationPool() { - short index = 0; - while (index < MAX_OPERATION_INSTANCES) { + for(short index = 0; index < MAX_OPERATION_INSTANCES; index++) { hmacSignOperationPool[index] = new KMOperationImpl(); - index++; } } // Create a signature instance of each algorithm once. - private void initializeSignerPool() { - short index = 0; - while (index < SIG_ALGS.length) { + private void initializeSignerPool() { + short index; + for(index = 0; index < SIG_ALGS.length; index++) { signerPool[index] = getSignatureInstance(SIG_ALGS[index]); - index++; } + // Allocate extra 4 HMAC signer instances required for trusted confirmation - short len = (short) (index + 4); - while (index < len) { + for(short len = (short) (index + 4); index < len; index++) { signerPool[index] = getSignatureInstance(Signature.ALG_HMAC_SHA_256); - index++; } } //Create a cipher instance of each algorithm once. private void initializeCipherPool() { - short index = 0; - while (index < CIPHER_ALGS.length) { + for(short index = 0; index < CIPHER_ALGS.length; index++) { cipherPool[index] = getCipherInstance(CIPHER_ALGS[index]); - index++; } } private void initializeKeyAgreementPool() { - short index = 0; - while (index < KEY_AGREE_ALGS.length) { + for(short index = 0; index < KEY_AGREE_ALGS.length; index++) { keyAgreementPool[index] = getKeyAgreementInstance(KEY_AGREE_ALGS[index]); - index++; } } diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index 2b8e55fe..bbfb6a04 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -93,13 +93,13 @@ public void process(APDU apdu) { case INS_PROVISION_ATTEST_IDS_CMD: processProvisionAttestIdsCmd(apdu); kmDataStore.setProvisionStatus(PROVISION_STATUS_ATTEST_IDS); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_PROVISION_PRESHARED_SECRET_CMD: processProvisionPreSharedSecretCmd(apdu); kmDataStore.setProvisionStatus(PROVISION_STATUS_PRESHARED_SECRET); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_GET_PROVISION_STATUS_CMD: @@ -120,13 +120,13 @@ public void process(APDU apdu) { case INS_SE_FACTORY_PROVISIONING_LOCK_CMD: kmDataStore.setProvisionStatus(PROVISION_STATUS_SE_LOCKED); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD: processProvisionOEMRootPublicKeyCmd(apdu); kmDataStore.setProvisionStatus(PROVISION_STATUS_OEM_PUBLIC_KEY); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); break; case INS_OEM_LOCK_PROVISIONING_CMD: @@ -145,13 +145,13 @@ public void process(APDU apdu) { ISOException.throwIt(ISO7816.SW_COMMAND_NOT_ALLOWED); } } catch (KMException exception) { - sendError(apdu, KMException.reason()); + sendResponse(apdu, KMException.reason()); } catch (ISOException exp) { - sendError(apdu, mapISOErrorToKMError(exp.getReason())); + sendResponse(apdu, mapISOErrorToKMError(exp.getReason())); } catch (CryptoException e) { - sendError(apdu, mapCryptoErrorToKMError(e.getReason())); + sendResponse(apdu, mapCryptoErrorToKMError(e.getReason())); } catch (Exception e) { - sendError(apdu, KMError.GENERIC_UNKNOWN_ERROR); + sendResponse(apdu, KMError.GENERIC_UNKNOWN_ERROR); } finally { repository.clean(); } @@ -241,7 +241,7 @@ private void processOEMUnlockProvisionCmd(APDU apdu) { authenticateOEM(OEM_UNLOCK_PROVISION_VERIFICATION_LABEL, apdu); kmDataStore.setProvisionLock(false); kmDataStore.unlockProvision(PROVISION_STATUS_PROVISIONING_LOCKED); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void processOEMLockProvisionCmd(APDU apdu) { @@ -249,7 +249,7 @@ private void processOEMLockProvisionCmd(APDU apdu) { // Enable the lock bit in provision status. kmDataStore.setProvisionLock(true); kmDataStore.setProvisionStatus(PROVISION_STATUS_PROVISIONING_LOCKED); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void authenticateOEM(byte[] plainMsg, APDU apdu) { @@ -354,7 +354,7 @@ private static void processProvisionRkpDeviceUniqueKeyPair(APDU apdu) { MAX_COSE_BUF_SIZE); kmDataStore.persistBootCertificateChain(scratchPad, (short) 0, len); kmDataStore.setProvisionStatus(PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private static void processProvisionRkpAdditionalCertChain(APDU apdu) { @@ -403,7 +403,7 @@ private static void processProvisionRkpAdditionalCertChain(APDU apdu) { kmDataStore.setProvisionStatus(PROVISION_STATUS_ADDITIONAL_CERT_CHAIN); //reclaim memory repository.reclaimMemory(bufferLength); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void processProvisionAttestIdsCmd(APDU apdu) { @@ -555,7 +555,7 @@ private void processSetBootParamsCmd(APDU apdu) { super.reboot(); kmDataStore.setDeviceBootStatus(KMKeymintDataStore.SET_BOOT_PARAMS_SUCCESS); seProvider.clearDeviceBooted(false); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private boolean isProvisioningComplete() { @@ -588,7 +588,7 @@ private short validateApdu(APDU apdu) { // Validate P1P2. if (P1P2 != KMKeymasterApplet.KM_HAL_VERSION) { - sendError(apdu, KMError.INVALID_P1P2); + sendResponse(apdu, KMError.INVALID_P1P2); return KMType.INVALID_VALUE; } return apduBuffer[ISO7816.OFFSET_INS]; diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index ed51caa0..e10e8220 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -446,7 +446,7 @@ protected short mapCryptoErrorToKMError(short reason) { @Override public void process(APDU apdu) { try { - resetData(); + resetTransientBuffers(); repository.onProcess(); // If this is select applet apdu which is selecting this applet then return if (apdu.isISOInterindustryCLA()) { @@ -462,7 +462,7 @@ public void process(APDU apdu) { switch (apduIns) { case INS_INIT_STRONGBOX_CMD: processInitStrongBoxCmd(apdu); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); return; case INS_GENERATE_KEY_CMD: processGenerateKey(apdu); @@ -546,19 +546,19 @@ public void process(APDU apdu) { } catch (KMException exception) { freeOperations(); resetWrappingKey(); - sendError(apdu, KMException.reason()); + sendResponse(apdu, KMException.reason()); } catch (ISOException exp) { freeOperations(); resetWrappingKey(); - sendError(apdu, mapISOErrorToKMError(exp.getReason())); + sendResponse(apdu, mapISOErrorToKMError(exp.getReason())); } catch (CryptoException e) { freeOperations(); resetWrappingKey(); - sendError(apdu, mapCryptoErrorToKMError(e.getReason())); + sendResponse(apdu, mapCryptoErrorToKMError(e.getReason())); } catch (Exception e) { freeOperations(); resetWrappingKey(); - sendError(apdu, KMError.GENERIC_UNKNOWN_ERROR); + sendResponse(apdu, KMError.GENERIC_UNKNOWN_ERROR); } finally { repository.clean(); } @@ -603,7 +603,7 @@ private void freeOperations() { private void processEarlyBootEndedCmd(APDU apdu) { kmDataStore.setEarlyBootEndedStatus(true); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private short deviceLockedCmd(APDU apdu){ @@ -626,13 +626,13 @@ private void processDeviceLockedCmd(APDU apdu) { short verTime = KMVerificationToken.cast(verToken).getTimestamp(); short lastDeviceLockedTime = kmDataStore.getDeviceTimeStamp(); if (KMInteger.compare(verTime, lastDeviceLockedTime) > 0) { - Util.arrayFillNonAtomic(scratchPad, (short) 0, (short) 8, (byte) 0); - KMInteger.cast(verTime).getValue(scratchPad, (short) 0, (short) 8); + Util.arrayFillNonAtomic(scratchPad, (short) 0, KMInteger.UINT_64, (byte) 0); + KMInteger.cast(verTime).getValue(scratchPad, (short) 0, KMInteger.UINT_64); kmDataStore.setDeviceLock(true); kmDataStore.setDeviceLockPasswordOnly(passwordOnly == 0x01); - kmDataStore.setDeviceLockTimestamp(scratchPad, (short) 0, (short) 8); + kmDataStore.setDeviceLockTimestamp(scratchPad, (short) 0, KMInteger.UINT_64); } - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void resetWrappingKey(){ @@ -658,7 +658,7 @@ private short getWrappingKey(){ return KMByteBlob.instance(wrappingKey,(short)1,WRAPPING_KEY_SIZE); } - protected void resetData() { + protected void resetTransientBuffers() { short index = 0; while (index < data.length) { data[index] = KMType.INVALID_VALUE; @@ -781,7 +781,7 @@ private void processGetHwInfoCmd(APDU apdu) { JavacardKeymintDevice, (short) 0, (short) JavacardKeymintDevice.length)); resp.add((short) 4, KMByteBlob.instance(Google, (short) 0, (short) Google.length)); resp.add((short)5, KMInteger.uint_8((byte)1)); - // send buffer to master + // send buffer to host sendOutgoing(apdu, respPtr); } @@ -793,7 +793,7 @@ private short addRngEntropyCmd(APDU apdu){ } private void processAddRngEntropyCmd(APDU apdu) { - // Receive the incoming request fully from the master. + // Receive the incoming request fully from the host. short cmd = addRngEntropyCmd(apdu); // Process KMByteBlob blob = KMByteBlob.cast(KMArray.cast(cmd).get((short) 0)); @@ -802,7 +802,7 @@ private void processAddRngEntropyCmd(APDU apdu) { KMException.throwIt(KMError.INVALID_INPUT_LENGTH); } seProvider.addRngEntropy(blob.getBuffer(), blob.getStartOff(), blob.length()); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private short getKeyCharacteristicsCmd(APDU apdu){ @@ -814,7 +814,7 @@ private short getKeyCharacteristicsCmd(APDU apdu){ } private void processGetKeyCharacteristicsCmd(APDU apdu) { - // Receive the incoming request fully from the master. + // Receive the incoming request fully from the host. short cmd = getKeyCharacteristicsCmd(apdu); // Re-purpose the apdu buffer as scratch pad. byte[] scratchPad = apdu.getBuffer(); @@ -861,7 +861,7 @@ private void processGetHmacSharingParamCmd(APDU apdu) { private void processDeleteAllKeysCmd(APDU apdu) { // No arguments // Send ok - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private short createKeyBlobExp(short version) { @@ -921,7 +921,7 @@ private static short createKeyBlobInstance(byte keyType) { private void processDeleteKeyCmd(APDU apdu) { // Send ok - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private short computeSharedHmacCmd(APDU apdu){ @@ -933,7 +933,7 @@ private short computeSharedHmacCmd(APDU apdu){ } private void processComputeSharedHmacCmd(APDU apdu) { - // Receive the incoming request fully from the master into buffer. + // Receive the incoming request fully from the host into buffer. short cmd = computeSharedHmacCmd(apdu); byte[] scratchPad = apdu.getBuffer(); data[HMAC_SHARING_PARAMS] = KMArray.cast(cmd).get((short) 0); @@ -1114,7 +1114,7 @@ private boolean isKeyUpgradeRequired(short keyBlob, short appId, short appData, } private void processUpgradeKeyCmd(APDU apdu) { - // Receive the incoming request fully from the master into buffer. + // Receive the incoming request fully from the host into buffer. short cmd = upgradeKeyCmd(apdu); byte[] scratchPad = apdu.getBuffer(); @@ -1166,7 +1166,7 @@ private void processUpgradeKeyCmd(APDU apdu) { } private void processExportKeyCmd(APDU apdu) { - sendError(apdu, KMError.UNIMPLEMENTED); + sendResponse(apdu, KMError.UNIMPLEMENTED); } private void processWrappingKeyBlob(short keyBlob, short wrapParams, byte[] scratchPad) { @@ -1249,7 +1249,7 @@ private short beginImportWrappedKeyCmd(APDU apdu){ } private void processBeginImportWrappedKeyCmd(APDU apdu) { - // Receive the incoming request fully from the master into buffer. + // Receive the incoming request fully from the host into buffer. short cmd = beginImportWrappedKeyCmd(apdu); byte[] scratchPad = apdu.getBuffer(); // Step -1 parse the wrapping key blob @@ -1267,7 +1267,7 @@ private void processBeginImportWrappedKeyCmd(APDU apdu) { KMException.throwIt(KMError.UNKNOWN_ERROR); } setWrappingKey(transportKey); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private short aesGCMEncrypt(short aesSecret, short input, short nonce, short authData, short authTag,byte[] scratchPad){ Util.arrayFillNonAtomic(scratchPad, (short) 0, KMByteBlob.cast(input).length(), (byte) 0); @@ -1627,11 +1627,11 @@ private static void setUniqueId(KMAttestationCert cert, short attAppId, byte[] s private void processDestroyAttIdsCmd(APDU apdu) { kmDataStore.deleteAttestationIds(); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } private void processVerifyAuthorizationCmd(APDU apdu) { - sendError(apdu, KMError.UNIMPLEMENTED); + sendResponse(apdu, KMError.UNIMPLEMENTED); } private short abortOperationCmd(APDU apdu){ @@ -1645,10 +1645,10 @@ private void processAbortOperationCmd(APDU apdu) { data[OP_HANDLE] = KMArray.cast(cmd).get((short) 0); KMOperationState op = findOperation(data[OP_HANDLE]); if (op == null) { - sendError(apdu,KMError.INVALID_OPERATION_HANDLE); + sendResponse(apdu,KMError.INVALID_OPERATION_HANDLE); }else { releaseOperation(op); - sendError(apdu, KMError.OK); + sendResponse(apdu, KMError.OK); } } @@ -2019,16 +2019,16 @@ private boolean verifyVerificationTokenMacInBigEndian(short verToken, byte[] scr // concatenate challenge - 8 bytes short ptr = KMVerificationToken.cast(verToken).getChallenge(); KMInteger.cast(ptr) - .value(scratchPad, (short) (len + (short) (8 - KMInteger.cast(ptr).length()))); - len += 8; + .value(scratchPad, (short) (len + (short) (KMInteger.UINT_64 - KMInteger.cast(ptr).length()))); + len += KMInteger.UINT_64; // concatenate timestamp -8 bytes ptr = KMVerificationToken.cast(verToken).getTimestamp(); KMInteger.cast(ptr) - .value(scratchPad, (short) (len + (short) (8 - KMInteger.cast(ptr).length()))); - len += 8; + .value(scratchPad, (short) (len + (short) (KMInteger.UINT_64 - KMInteger.cast(ptr).length()))); + len += KMInteger.UINT_64; // concatenate security level - 4 bytes scratchPad[(short) (len + 3)] = TRUSTED_ENVIRONMENT; - len += 4; + len += KMInteger.UINT_32; // hmac the data ptr = KMVerificationToken.cast(verToken).getMac(); @@ -2225,7 +2225,7 @@ private short beginOperationCmd(APDU apdu){ } private void processBeginOperationCmd(APDU apdu) { - // Receive the incoming request fully from the master into buffer. + // Receive the incoming request fully from the host into buffer. short cmd = beginOperationCmd(apdu); byte[] scratchPad = apdu.getBuffer(); short purpose = KMArray.cast(cmd).get((short) 0); @@ -2942,27 +2942,27 @@ private boolean verifyHwTokenMacInBigEndian(short hwToken, byte[] scratchPad) { // concatenate challenge - 8 bytes short ptr = KMHardwareAuthToken.cast(hwToken).getChallenge(); KMInteger.cast(ptr) - .value(scratchPad, (short) (len + (short) (8 - KMInteger.cast(ptr).length()))); - len += 8; + .value(scratchPad, (short) (len + (short) (KMInteger.UINT_64 - KMInteger.cast(ptr).length()))); + len += KMInteger.UINT_64; // concatenate user id - 8 bytes ptr = KMHardwareAuthToken.cast(hwToken).getUserId(); KMInteger.cast(ptr) - .value(scratchPad, (short) (len + (short) (8 - KMInteger.cast(ptr).length()))); - len += 8; + .value(scratchPad, (short) (len + (short) (KMInteger.UINT_64 - KMInteger.cast(ptr).length()))); + len += KMInteger.UINT_64; // concatenate authenticator id - 8 bytes ptr = KMHardwareAuthToken.cast(hwToken).getAuthenticatorId(); KMInteger.cast(ptr) - .value(scratchPad, (short) (len + (short) (8 - KMInteger.cast(ptr).length()))); - len += 8; + .value(scratchPad, (short) (len + (short) (KMInteger.UINT_64 - KMInteger.cast(ptr).length()))); + len += KMInteger.UINT_64; // concatenate authenticator type - 4 bytes ptr = KMHardwareAuthToken.cast(hwToken).getHwAuthenticatorType(); scratchPad[(short) (len + 3)] = KMEnum.cast(ptr).getVal(); - len += 4; + len += KMInteger.UINT_32; // concatenate timestamp -8 bytes ptr = KMHardwareAuthToken.cast(hwToken).getTimestamp(); KMInteger.cast(ptr) - .value(scratchPad, (short) (len + (short) (8 - KMInteger.cast(ptr).length()))); - len += 8; + .value(scratchPad, (short) (len + (short) (KMInteger.UINT_64 - KMInteger.cast(ptr).length()))); + len += KMInteger.UINT_64; ptr = KMHardwareAuthToken.cast(hwToken).getMac(); @@ -2986,24 +2986,24 @@ private boolean verifyHwTokenMacInLittleEndian(short hwToken, byte[] scratchPad) // concatenate challenge - 8 bytes short ptr = KMHardwareAuthToken.cast(hwToken).getChallenge(); KMInteger.cast(ptr).toLittleEndian(scratchPad, len); - len += 8; + len += KMInteger.UINT_64; // concatenate user id - 8 bytes ptr = KMHardwareAuthToken.cast(hwToken).getUserId(); KMInteger.cast(ptr).toLittleEndian(scratchPad, len); - len += 8; + len += KMInteger.UINT_64; // concatenate authenticator id - 8 bytes ptr = KMHardwareAuthToken.cast(hwToken).getAuthenticatorId(); KMInteger.cast(ptr).toLittleEndian(scratchPad, len); - len += 8; + len += KMInteger.UINT_64; // concatenate authenticator type - 4 bytes ptr = KMHardwareAuthToken.cast(hwToken).getHwAuthenticatorType(); scratchPad[(short) (len + 3)] = KMEnum.cast(ptr).getVal(); - len += 4; + len += KMInteger.UINT_32; // concatenate timestamp - 8 bytes ptr = KMHardwareAuthToken.cast(hwToken).getTimestamp(); KMInteger.cast(ptr) .value(scratchPad, (short) (len + (short) (8 - KMInteger.cast(ptr).length()))); - len += 8; + len += KMInteger.UINT_64; ptr = KMHardwareAuthToken.cast(hwToken).getMac(); @@ -3045,7 +3045,7 @@ private short importKeyCmd(APDU apdu){ } private void processImportKeyCmd(APDU apdu) { - // Receive the incoming request fully from the master into buffer. + // Receive the incoming request fully from the host into buffer. short cmd = importKeyCmd(apdu); byte[] scratchPad = apdu.getBuffer(); data[KEY_PARAMETERS] = KMArray.cast(cmd).get((short) 0); @@ -3504,7 +3504,7 @@ private short generateKeyCmd(APDU apdu){ } private void processGenerateKey(APDU apdu) { - // Receive the incoming request fully from the master into buffer. + // Receive the incoming request fully from the host into buffer. short cmd = generateKeyCmd(apdu); // Re-purpose the apdu buffer as scratch pad. byte[] scratchPad = apdu.getBuffer(); @@ -4276,7 +4276,7 @@ private static short deriveKey(byte[] scratchPad) { return len; } - public static void sendError(APDU apdu, short err) { + public static void sendResponse(APDU apdu, short err) { short resp = KMArray.instance((short)1); err = KMError.translate(err); short error = KMInteger.uint_16(err); diff --git a/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java b/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java index 8cd8aab1..aaca3d72 100644 --- a/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java +++ b/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java @@ -307,7 +307,7 @@ public void processBeginSendData(APDU apdu) throws Exception { createEntry(GENERATE_CSR_PHASE, BYTE_SIZE); updateState(BEGIN); // Send response. - KMKeymasterApplet.sendError(apdu, KMError.OK); + KMKeymasterApplet.sendResponse(apdu, KMError.OK); } catch (Exception e) { clearDataTable(); releaseOperation(); @@ -350,7 +350,7 @@ public void processUpdateKey(APDU apdu) throws Exception { // Update the csr state updateState(UPDATE); // Send response. - KMKeymasterApplet.sendError(apdu, KMError.OK); + KMKeymasterApplet.sendResponse(apdu, KMError.OK); } catch (Exception e) { clearDataTable(); releaseOperation(); @@ -393,7 +393,7 @@ public void processUpdateEekChain(APDU apdu) throws Exception { Util.arrayCopyNonAtomic(scratchPad, (short) 0, data, dataEntryIndex, len); // Update the state updateState(UPDATE); - KMKeymasterApplet.sendError(apdu, KMError.OK); + KMKeymasterApplet.sendResponse(apdu, KMError.OK); } catch (Exception e) { clearDataTable(); releaseOperation(); @@ -420,7 +420,7 @@ public void processUpdateChallenge(APDU apdu) throws Exception { ); // Update the state updateState(UPDATE); - KMKeymasterApplet.sendError(apdu, KMError.OK); + KMKeymasterApplet.sendResponse(apdu, KMError.OK); } catch (Exception e) { clearDataTable(); releaseOperation();