From 26eefc06766e1ff2baa717833755a26f76357448 Mon Sep 17 00:00:00 2001 From: avinashhedage Date: Fri, 29 Jul 2022 11:25:09 +0000 Subject: [PATCH 1/3] updated keymint provision instruction set to allign with keymaster instruction set --- .../javacard/keymaster/KMAndroidSEApplet.java | 20 ++++++++--------- .../javacard/keymaster/KMJCardSimApplet.java | 20 ++++++++--------- ProvisioningTool/include/constants.h | 22 ++++++++++--------- 3 files changed, 30 insertions(+), 32 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index c58cfb5c..ce374539 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -43,21 +43,19 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis // Provider specific Commands private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00; - private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1; + private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; private static final byte INS_PROVISION_PRESHARED_SECRET_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 2; - private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; - private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4; + INS_KEYMINT_PROVIDER_APDU_START + 4; private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; + private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; + private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; + private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 6; + INS_KEYMINT_PROVIDER_APDU_START + 13; private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 7; - private static final byte INS_SET_BOOT_ENDED_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 8; //unused - private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9; - private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; - private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + INS_KEYMINT_PROVIDER_APDU_START + 14; private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F; public static final byte BOOT_KEY_MAX_SIZE = 32; diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index 6dad0438..a3302a29 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -32,21 +32,19 @@ public class KMJCardSimApplet extends KMKeymasterApplet { // Provider specific Commands private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00; - private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1; + private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; private static final byte INS_PROVISION_PRESHARED_SECRET_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 2; - private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; - private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4; + INS_KEYMINT_PROVIDER_APDU_START + 4; private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; + private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; + private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; + private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 6; + INS_KEYMINT_PROVIDER_APDU_START + 13; private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 7; - private static final byte INS_SET_BOOT_ENDED_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 8; //unused - private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9; - private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; - private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + INS_KEYMINT_PROVIDER_APDU_START + 14; private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F; public static final byte BOOT_KEY_MAX_SIZE = 32; diff --git a/ProvisioningTool/include/constants.h b/ProvisioningTool/include/constants.h index 62c2efcc..89d7413a 100644 --- a/ProvisioningTool/include/constants.h +++ b/ProvisioningTool/include/constants.h @@ -101,14 +101,16 @@ constexpr char kSeFactoryProvisionLock[] = "se_factory_lock"; constexpr char kUnLockProvision[] = "unlock_provision"; // Instruction constatnts -// TODO Modify according to keymint -constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 1; -constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 2; -constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 3; -constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 4; +constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 3; +constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 4; constexpr int kBootParamsCmd = INS_BEGIN_KM_CMD + 5; -constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 6; -constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 7; -constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 9; -constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 10; -constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 11; +constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 6; +constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 7; +constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 10; +constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 11; +constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 12; +constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 13; +constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 14; + + + From 0ea596448dda636089f0965bb4e8d2e081011882 Mon Sep 17 00:00:00 2001 From: avinashhedage Date: Mon, 1 Aug 2022 07:03:46 +0000 Subject: [PATCH 2/3] updated instruction command set values --- .../javacard/keymaster/KMAndroidSEApplet.java | 2 ++ .../javacard/keymaster/KMJCardSimApplet.java | 2 ++ .../javacard/keymaster/KMKeymasterApplet.java | 23 +++++++++++-------- HAL/JavacardSecureElement.h | 20 ++++++++-------- 4 files changed, 28 insertions(+), 19 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index ce374539..647b3ed8 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -49,6 +49,8 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index a3302a29..a5669816 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -38,6 +38,8 @@ public class KMJCardSimApplet extends KMKeymasterApplet { private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index 6682788c..eab1e7ec 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -141,6 +141,10 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe // Maximum allowed buffer size for to encode the key parameters // which is used while creating mac for key paramters. public static final short MAX_KEY_PARAMS_BUF_SIZE = (short) 3072; // 3K + + // Aligned INS_INIT_STRONGBOX_CMD value with INS_SET_VERSION_PATCHLEVEL_CMD value in Keymaster instruction set + private static final byte INS_INIT_STRONGBOX_CMD = 0x08; + // Top 32 commands are reserved for provisioning. private static final byte KEYMINT_CMD_APDU_START = 0x20; @@ -169,17 +173,16 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe private static final byte INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23; //0x37 private static final byte INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24; //0x38 private static final byte INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25; //0x39 - private static final byte INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26; //0x3A // RKP - public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27; //0x3B - public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C - public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D - public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E - public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F - public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 - public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 - public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34; //0x42 - private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 35; //0x43 + public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26; //0x3A + public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27; //0x3B + public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C + public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D + public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E + public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F + public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 + public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 + private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 34; //0x42 private static final byte INS_END_KM_CMD = 0x7F; // Data Dictionary items diff --git a/HAL/JavacardSecureElement.h b/HAL/JavacardSecureElement.h index 20a3b964..c04dfe6b 100644 --- a/HAL/JavacardSecureElement.h +++ b/HAL/JavacardSecureElement.h @@ -35,6 +35,9 @@ using std::vector; enum class Instruction { // Keymaster commands + // Aligned INS_INIT_STRONGBOX_CMD value with Keymaster instruction set + INS_INIT_STRONGBOX_CMD = 0x08, + INS_GENERATE_KEY_CMD = KEYMINT_CMD_APDU_START + 1, INS_IMPORT_KEY_CMD = KEYMINT_CMD_APDU_START + 2, INS_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 3, @@ -60,16 +63,15 @@ enum class Instruction { INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23, INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24, INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25, - INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26, // RKP Commands - INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27, - INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28, - INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29, - INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30, - INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31, - INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32, - INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33, - INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34, + INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26, + INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27, + INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28, + INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29, + INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30, + INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31, + INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32, + INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33, }; class JavacardSecureElement { From c8a4898496f688e93d0b0b6669bd7c9502bc96b5 Mon Sep 17 00:00:00 2001 From: avinashhedage Date: Wed, 3 Aug 2022 09:43:12 +0000 Subject: [PATCH 3/3] Aligned keymint provision instruction commands with keymaster --- .../javacard/keymaster/KMAndroidSEApplet.java | 2 +- .../javacard/keymaster/KMJCardSimApplet.java | 2 +- .../javacard/keymaster/KMKeymasterApplet.java | 22 +++++++++---------- HAL/JavacardSecureElement.h | 20 ++++++++--------- 4 files changed, 21 insertions(+), 25 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index 647b3ed8..97b75ecc 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -49,7 +49,7 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; - //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x08 was reserved for INS_INIT_STRONGBOX_CMD //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index a5669816..84c76f5b 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -38,7 +38,7 @@ public class KMJCardSimApplet extends KMKeymasterApplet { private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; - //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x08 was reserved for INS_INIT_STRONGBOX_CMD //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index eab1e7ec..19eb1ab3 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -142,9 +142,6 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe // which is used while creating mac for key paramters. public static final short MAX_KEY_PARAMS_BUF_SIZE = (short) 3072; // 3K - // Aligned INS_INIT_STRONGBOX_CMD value with INS_SET_VERSION_PATCHLEVEL_CMD value in Keymaster instruction set - private static final byte INS_INIT_STRONGBOX_CMD = 0x08; - // Top 32 commands are reserved for provisioning. private static final byte KEYMINT_CMD_APDU_START = 0x20; @@ -173,16 +170,17 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe private static final byte INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23; //0x37 private static final byte INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24; //0x38 private static final byte INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25; //0x39 + private static final byte INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26; //0x3A // RKP - public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26; //0x3A - public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27; //0x3B - public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C - public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D - public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E - public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F - public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 - public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 - private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 34; //0x42 + public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27; //0x3B + public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C + public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D + public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E + public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F + public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 + public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 + public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34; //0x42 + private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 35; //0x43 private static final byte INS_END_KM_CMD = 0x7F; // Data Dictionary items diff --git a/HAL/JavacardSecureElement.h b/HAL/JavacardSecureElement.h index c04dfe6b..12e86931 100644 --- a/HAL/JavacardSecureElement.h +++ b/HAL/JavacardSecureElement.h @@ -35,9 +35,6 @@ using std::vector; enum class Instruction { // Keymaster commands - // Aligned INS_INIT_STRONGBOX_CMD value with Keymaster instruction set - INS_INIT_STRONGBOX_CMD = 0x08, - INS_GENERATE_KEY_CMD = KEYMINT_CMD_APDU_START + 1, INS_IMPORT_KEY_CMD = KEYMINT_CMD_APDU_START + 2, INS_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 3, @@ -63,15 +60,16 @@ enum class Instruction { INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23, INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24, INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25, + INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26, // RKP Commands - INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26, - INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27, - INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28, - INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29, - INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30, - INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31, - INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32, - INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33, + INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27, + INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28, + INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29, + INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30, + INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31, + INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32, + INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33, + INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34, }; class JavacardSecureElement {