Skip to content
This repository was archived by the owner on May 24, 2026. It is now read-only.

Keymint 100 provision#208

Merged
mdwivedi merged 3 commits into from
Aug 3, 2022
Merged

Keymint 100 provision #208

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
26eefc0
updated keymint provision instruction set to allign with keymaster in…
Jul 29, 2022
0ea5964
updated instruction command set values
Aug 1, 2022
c8a4898
Aligned keymint provision instruction commands with keymaster
Aug 3, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,21 +43,21 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis

// Provider specific Commands
private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_PROVISION_PRESHARED_SECRET_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 2;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4;
INS_KEYMINT_PROVIDER_APDU_START + 4;
private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7;
//0x08 was reserved for INS_INIT_STRONGBOX_CMD
//0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now.
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12;
private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 6;
INS_KEYMINT_PROVIDER_APDU_START + 13;
private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 7;
private static final byte INS_SET_BOOT_ENDED_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 8; //unused
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
INS_KEYMINT_PROVIDER_APDU_START + 14;

private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F;
public static final byte BOOT_KEY_MAX_SIZE = 32;
Expand Down
22 changes: 11 additions & 11 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -32,21 +32,21 @@ public class KMJCardSimApplet extends KMKeymasterApplet {

// Provider specific Commands
private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_PROVISION_PRESHARED_SECRET_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 2;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4;
INS_KEYMINT_PROVIDER_APDU_START + 4;
private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7;
//0x08 was reserved for INS_INIT_STRONGBOX_CMD
//0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now.
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12;
private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 6;
INS_KEYMINT_PROVIDER_APDU_START + 13;
private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 7;
private static final byte INS_SET_BOOT_ENDED_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 8; //unused
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
INS_KEYMINT_PROVIDER_APDU_START + 14;

private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F;
public static final byte BOOT_KEY_MAX_SIZE = 32;
Expand Down
1 change: 1 addition & 0 deletions Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -141,6 +141,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
// Maximum allowed buffer size for to encode the key parameters
// which is used while creating mac for key paramters.
public static final short MAX_KEY_PARAMS_BUF_SIZE = (short) 3072; // 3K

// Top 32 commands are reserved for provisioning.
private static final byte KEYMINT_CMD_APDU_START = 0x20;

Expand Down
2 changes: 1 addition & 1 deletion HAL/JavacardSecureElement.h
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -69,7 +69,7 @@ enum class Instruction {
INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31,
INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32,
INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33,
INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34,
INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34,
};

class JavacardSecureElement {
Expand Down
22 changes: 12 additions & 10 deletions ProvisioningTool/include/constants.h
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -101,14 +101,16 @@ constexpr char kSeFactoryProvisionLock[] = "se_factory_lock";
constexpr char kUnLockProvision[] = "unlock_provision";

// Instruction constatnts
// TODO Modify according to keymint
constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 1;
constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 2;
constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 3;
constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 4;
constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 3;
constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 4;
constexpr int kBootParamsCmd = INS_BEGIN_KM_CMD + 5;
constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 6;
constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 7;
constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 9;
constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 10;
constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 11;
constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 6;
constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 7;
constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 10;
constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 11;
constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 12;
constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 13;
constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 14;