First set of changes for AttestKeyTest.

Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java

@@ -100,7 +100,7 @@ public class KMAttestationCertImpl implements KMAttestationCert {
  private static final byte keyUsageCertSign = (byte) 0x04; // 5th- bit
 
  private static final byte KEYMASTER_VERSION = 100;
- private static final byte ATTESTATION_VERSION = 3;
+ private static final byte ATTESTATION_VERSION = 100;
  private static final byte[] pubExponent = {0x01, 0x00, 0x01};
  private static final byte SERIAL_NUM = (byte) 0x01;
  private static final byte X509_VERSION = (byte) 0x02;
@@ -138,7 +138,8 @@ public class KMAttestationCertImpl implements KMAttestationCert {
  private static short serialNum;
 
  private static byte certMode;
- private static short certAttestKey ;
+ private static short certAttestKeySecret;
+ private static short certAttestKeyRsaPubModulus;
  private static boolean certRsaSign;
  private static final byte SERIAL_NUM_MAX_LEN = 20;
  private static final byte SUBJECT_NAME_MAX_LEN = 32;
@@ -186,7 +187,7 @@ private static void init() {
  deviceLocked = 0;
  signPriv = 0;
  certMode = KMType.NO_CERT;
-certAttestKey = KMType.INVALID_VALUE;
+certAttestKeySecret = KMType.INVALID_VALUE;
  certRsaSign = true;
  issuer = KMType.INVALID_VALUE;
  subjectName = KMType.INVALID_VALUE;
@@ -862,8 +863,8 @@ public short getCertLength() {
  return certLength;
  }
 
- @Override
- public void build(byte[] attBuf, short attStart, short attLength, boolean rsaSign, boolean fakeCert) {
+
+ public void build(short attSecret, short attMod, boolean rsaSign, boolean fakeCert) {
  stackPtr = (short)(bufStart + bufLength);
  short last = stackPtr;
  short sigLen = 0;
@@ -891,18 +892,18 @@ else if (rsaSign) {
  tbsStart = stackPtr;
  tbsLength = (short) (tbsLength - tbsStart);
  KMJCardSimulator provider = KMJCardSimulator.getInstance();
- if(attBuf != null){
+ if(attSecret != KMType.INVALID_VALUE){
  // Sign with the attestation key
  // The pubKey is the modulus.
  if (rsaSign) {
  sigLen = provider
  .rsaSign256Pkcs1(
-attBuf,
-attStart,
-attLength,
- KMByteBlob.cast(pubKey).getBuffer(),
- KMByteBlob.cast(pubKey).getStartOff(),
- KMByteBlob.cast(pubKey).length(),
+KMByteBlob.cast(attSecret).getBuffer(),
+KMByteBlob.cast(attSecret).getStartOff(),
+KMByteBlob.cast(attSecret).length(),
+ KMByteBlob.cast(attMod).getBuffer(),
+ KMByteBlob.cast(attMod).getStartOff(),
+ KMByteBlob.cast(attMod).length(),
  stack,
  tbsStart,
  tbsLength,
@@ -912,9 +913,9 @@ else if (rsaSign) {
  } else {
  sigLen = provider
  .ecSign256(
-attBuf,
-attStart,
-attLength,
+KMByteBlob.cast(attSecret).getBuffer(),
+KMByteBlob.cast(attSecret).getStartOff(),
+KMByteBlob.cast(attSecret).length(),
  stack,
  tbsStart,
  tbsLength,
@@ -941,11 +942,9 @@ else if (rsaSign) {
  @Override
  public void build() {
  if(certMode == KMType.FAKE_CERT) {
- build(null, (short) 0, (short) 0, true, true);
+ build(KMType.INVALID_VALUE, KMType.INVALID_VALUE, true, true);
  }else {
- build(KMByteBlob.cast(certAttestKey).getBuffer(),
- KMByteBlob.cast(certAttestKey).getStartOff(),
- KMByteBlob.cast(certAttestKey).length(), certRsaSign, false);
+ build(certAttestKeySecret, certAttestKeyRsaPubModulus, certRsaSign, false);
  }
  }
 
@@ -1024,10 +1023,20 @@ public boolean subjectName(short sub){
  }
 
  @Override
- public KMAttestationCert attestKey(short attestKey, boolean rsaSign, byte mode){
+ public KMAttestationCert ecAttestKey(short attestKey, byte mode){
+ certMode = mode;
+ certAttestKeySecret = attestKey;
+ certAttestKeyRsaPubModulus = KMType.INVALID_VALUE;
+ certRsaSign = false;
+ return this;
+ }
+
+ @Override
+ public KMAttestationCert rsaAttestKey(short attestPrivExp, short attestMod, byte mode){
  certMode = mode;
- certAttestKey = attestKey;
- certRsaSign = rsaSign;
+ certAttestKeySecret = attestPrivExp;
+ certAttestKeyRsaPubModulus = attestMod;
+ certRsaSign = true;
  return this;
  }
 

Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java

@@ -148,7 +148,7 @@ private void setDummyBootParams(){
  (short) bootBlob.length);
  short verifiedHash = KMByteBlob.instance(bootBlob, (short) 0,
  (short) bootBlob.length);
- short bootState = KMType.VERIFIED_BOOT;
+ short bootState = KMType.UNVERIFIED_BOOT;
 
  ((KMJCardSimulator)seProvider).setBootPatchLevel(
  KMInteger.cast(bootPatchLevel).getBuffer(),

Applet/src/com/android/javacard/keymaster/KMAttestationCert.java

@@ -157,20 +157,6 @@ KMAttestationCert makeUniqueId(byte[] scratchpad, short scratchPadOff, byte[] cr
  */
  short getCertLength();
 
- /**
- * Build the certificate. After this method the certificate is ready and signed by the
- * attestation key passed in the parameter. If attBuf is null then factory set attestation key is
- * used to sign the cert. If there is no factory provisioned attestation key then signature is
- * left zero.
- *
- * @param attBuf the buffer that has attestation key
- * @param start the start offset of the attestation key in the buffer
- * @param length the length of the attestation key in the buffer
- * @param rsa the flag which states that the attestation key is rsa, if true or ec key otherwise.
- * Accordingly the certificate is signed with using rsa signature algorithm or the ecdsa
- * signature algorithm.
- */
- void build(byte[] attBuf, short start, short length, boolean rsa, boolean fakeCert);
 
  /**
  * Build a fake signed certificate. After this method executes the certificate is ready with the
@@ -197,5 +183,12 @@ KMAttestationCert makeUniqueId(byte[] scratchpad, short scratchPadOff, byte[] cr
  * @param attestKey KMByteBlob of the key
  * @param mode
  */
- KMAttestationCert attestKey(short attestKey, boolean rsaSign, byte mode);
+ KMAttestationCert ecAttestKey(short attestKey, byte mode);
+ /**
+ * Set attestation key and mode.
+ * @param attestKey KMByteBlob of the key
+ * @param mode
+ */
+ KMAttestationCert rsaAttestKey(short attestPrivExp, short attestMod, byte mode);
+
 }

Applet/src/com/android/javacard/keymaster/KMKeyParameters.java

@@ -232,6 +232,63 @@ public static short makeSbEnforced(short keyParamsPtr, byte origin,
  return createKeyParameters(scratchPad, (short) (arrInd / 2));
  }
 
+ public static short makeSbEnforced(short keyParamsPtr, byte[] scratchPad) {
+ final short[] hwEnforcedTagArr = {
+ // HW Enforced
+ KMType.ENUM_TAG, KMType.ORIGIN,
+ KMType.UINT_TAG, KMType.OS_VERSION,
+ KMType.UINT_TAG, KMType.OS_PATCH_LEVEL,
+ KMType.UINT_TAG, KMType.VENDOR_PATCH_LEVEL,
+ KMType.UINT_TAG, KMType.BOOT_PATCH_LEVEL,
+ KMType.ENUM_ARRAY_TAG, KMType.PURPOSE,
+ KMType.ENUM_TAG, KMType.ALGORITHM,
+ KMType.UINT_TAG, KMType.KEYSIZE,
+ KMType.ULONG_TAG, KMType.RSA_PUBLIC_EXPONENT,
+ KMType.ENUM_TAG, KMType.BLOB_USAGE_REQ,
+ KMType.ENUM_ARRAY_TAG, KMType.DIGEST,
+ KMType.ENUM_ARRAY_TAG, KMType.PADDING,
+ KMType.ENUM_ARRAY_TAG, KMType.BLOCK_MODE,
+ KMType.ENUM_ARRAY_TAG, KMType.RSA_OAEP_MGF_DIGEST,
+ KMType.BOOL_TAG, KMType.NO_AUTH_REQUIRED,
+ KMType.BOOL_TAG, KMType.CALLER_NONCE,
+ KMType.UINT_TAG, KMType.MIN_MAC_LENGTH,
+ KMType.ENUM_TAG, KMType.ECCURVE,
+ KMType.BOOL_TAG, KMType.INCLUDE_UNIQUE_ID,
+ KMType.BOOL_TAG, KMType.ROLLBACK_RESISTANCE,
+ KMType.BOOL_TAG, KMType.UNLOCKED_DEVICE_REQUIRED,
+ KMType.BOOL_TAG, KMType.RESET_SINCE_ID_ROTATION,
+ KMType.BOOL_TAG, KMType.EARLY_BOOT_ONLY,
+ };
+ byte index = 0;
+ short tagInd;
+ short arrInd = 0;
+ short tagPtr;
+ short tagKey;
+ short tagType;
+ short arrPtr = KMKeyParameters.cast(keyParamsPtr).getVals();
+ short len = KMArray.cast(arrPtr).length();
+ while (index < len) {
+ tagInd = 0;
+ tagPtr = KMArray.cast(arrPtr).get(index);
+ tagKey = KMTag.getKey(tagPtr);
+ tagType = KMTag.getTagType(tagPtr);
+ if (!isValidTag(tagType, tagKey)) {
+ KMException.throwIt(KMError.INVALID_KEY_BLOB);
+ }
+ while (tagInd < (short) hwEnforcedTagArr.length) {
+ if ((hwEnforcedTagArr[tagInd] == tagType)
+ && (hwEnforcedTagArr[(short) (tagInd + 1)] == tagKey)) {
+ Util.setShort(scratchPad, arrInd, tagPtr);
+ arrInd += 2;
+ break;
+ }
+ tagInd += 2;
+ }
+ index++;
+ }
+ return createKeyParameters(scratchPad, (short) (arrInd / 2));
+ }
+
  public static short makeHwEnforced(short sb, short tee){
  short len = KMKeyParameters.cast(sb).length();
  len += KMKeyParameters.cast(tee).length();