From e9c0d1411bc7180752f4085130005478dd274105 Mon Sep 17 00:00:00 2001 From: subrahmanyaman Date: Sat, 5 Feb 2022 05:54:59 +0000 Subject: [PATCH 1/3] Fixed the issue with Cose Signature --- .../kmdevice/KMAttestationCertImpl.java | 8 -- .../android/javacard/kmdevice/KMEnumTag.java | 2 +- .../javacard/kmdevice/KMKeymintDevice.java | 16 +++- .../javacard/kmdevice/KMPKCS8Decoder.java | 33 ++++++++ .../com/android/javacard/kmdevice/KMType.java | 2 +- .../RemotelyProvisionedComponentDevice.java | 81 ++++++++++++++++++- 6 files changed, 126 insertions(+), 16 deletions(-) diff --git a/Applet/src/com/android/javacard/kmdevice/KMAttestationCertImpl.java b/Applet/src/com/android/javacard/kmdevice/KMAttestationCertImpl.java index 9e817c9e..25640a62 100644 --- a/Applet/src/com/android/javacard/kmdevice/KMAttestationCertImpl.java +++ b/Applet/src/com/android/javacard/kmdevice/KMAttestationCertImpl.java @@ -1093,12 +1093,4 @@ public KMAttestationCert factoryAttestKey(KMAttestationKey key, byte mode) { factoryAttestKey = key; return this; } - - //Check - /* - * private void print(byte[] buf, short start, short length){ StringBuilder sb = - * new StringBuilder(length * 2); for(short i = start; i < (start+length); i - * ++){ sb.append(String.format("%02x", buf[i])); } System.out.println( - * sb.toString()); } - */ } diff --git a/Applet/src/com/android/javacard/kmdevice/KMEnumTag.java b/Applet/src/com/android/javacard/kmdevice/KMEnumTag.java index b796832c..38a53229 100644 --- a/Applet/src/com/android/javacard/kmdevice/KMEnumTag.java +++ b/Applet/src/com/android/javacard/kmdevice/KMEnumTag.java @@ -108,7 +108,7 @@ public static void create() { enums = new Object[]{ new byte[]{RSA, DES, EC, AES, HMAC}, - new byte[]{P_224, P_256, P_384, P_521}, + new byte[]{P_224, P_256, P_384, P_521, CURVE_25519}, new byte[]{STANDALONE, REQUIRES_FILE_SYSTEM}, new byte[]{USER_AUTH_NONE, PASSWORD, FINGERPRINT, BOTH, ANY}, new byte[]{GENERATED, DERIVED, IMPORTED, UNKNOWN, SECURELY_IMPORTED}, diff --git a/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java b/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java index cc326a64..48aa33ff 100644 --- a/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java +++ b/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java @@ -501,6 +501,10 @@ public short generateBcc(boolean testMode, byte[] scratchPad) { // do sign short len = seProvider.ecSign256(deviceUniqueKey, scratchPad, (short) 0, temp, scratchPad, temp); + len = + KMPKCS8Decoder.instance(). + decodeEcdsa256Signature(KMByteBlob.instance(scratchPad, temp, len), scratchPad, temp); + coseSignStructure = KMByteBlob.instance(scratchPad, temp, len); // construct cose_sign1 @@ -581,11 +585,17 @@ public short validateCertChain(boolean validateEekRoot, byte expCertAlg, KMArray.get(ptr1, KMCose.COSE_SIGN1_PAYLOAD_OFFSET)); encodedLen = encodeToApduBuffer(signStructure, scratchPad, keySize, RemotelyProvisionedComponentDevice.MAX_COSE_BUF_SIZE); + + short signatureLen = + rkp.encodeES256CoseSignSignature( + KMByteBlob.getBuffer(KMArray.get(ptr1, KMCose.COSE_SIGN1_SIGNATURE_OFFSET)), + KMByteBlob.getStartOff(KMArray.get(ptr1, KMCose.COSE_SIGN1_SIGNATURE_OFFSET)), + KMByteBlob.length(KMArray.get(ptr1, KMCose.COSE_SIGN1_SIGNATURE_OFFSET)), + scratchPad, + (short) (keySize + encodedLen)); if (!seProvider.ecVerify256(scratchPad, (short) 0, keySize, scratchPad, keySize, encodedLen, - KMByteBlob.getBuffer(KMArray.get(ptr1, KMCose.COSE_SIGN1_SIGNATURE_OFFSET)), - KMByteBlob.getStartOff(KMArray.get(ptr1, KMCose.COSE_SIGN1_SIGNATURE_OFFSET)), - KMByteBlob.length(KMArray.get(ptr1, KMCose.COSE_SIGN1_SIGNATURE_OFFSET)))) { + scratchPad, (short) (keySize + encodedLen), signatureLen)) { KMException.throwIt(KMError.STATUS_FAILED); } prevCoseKey = ptr2; diff --git a/Applet/src/com/android/javacard/kmdevice/KMPKCS8Decoder.java b/Applet/src/com/android/javacard/kmdevice/KMPKCS8Decoder.java index be94b586..72e07fea 100644 --- a/Applet/src/com/android/javacard/kmdevice/KMPKCS8Decoder.java +++ b/Applet/src/com/android/javacard/kmdevice/KMPKCS8Decoder.java @@ -118,6 +118,34 @@ private void updateModulus(short blob) { KMByteBlob.setLength(blob, --len); } } + + private short readEcdsa256SigIntegerHeader() { + short len = header(ASN1_INTEGER); + if (len == 33) { + if (0 != getByte()) { + KMException.throwIt(KMError.INVALID_DATA); + } + len--; + } else if (len > 33) { + KMException.throwIt(KMError.INVALID_DATA); + } + return len; + } + + // Seq [Int, Int] + public short decodeEcdsa256Signature(short blob, byte[] scratchPad, short scratchPadOff) { + init(blob); + short len = header(ASN1_SEQUENCE); + len = readEcdsa256SigIntegerHeader(); + // concatenate r and s in the buffer (r||s) + Util.arrayFillNonAtomic(scratchPad, scratchPadOff, (short) 64, (byte) 0); + // read r + getBytes(scratchPad, (short) (scratchPadOff + 32 - len), len); + len = readEcdsa256SigIntegerHeader(); + // read s + getBytes(scratchPad, (short) (scratchPadOff + 64 - len), len); + return (short) 64; + } // Seq [Int, Blob] public void decodeCommon(short version, byte[] alg) { @@ -217,6 +245,11 @@ private void getBytes(short blob) { KMByteBlob.getStartOff(blob), len); incrementCursor(len); } + + private void getBytes(byte[] buffer, short offset, short len) { + Util.arrayCopyNonAtomic(data, cur, buffer, offset, len); + incrementCursor(len); + } private short getLength() { byte len = getByte(); diff --git a/Applet/src/com/android/javacard/kmdevice/KMType.java b/Applet/src/com/android/javacard/kmdevice/KMType.java index 0650b775..b6f027e3 100644 --- a/Applet/src/com/android/javacard/kmdevice/KMType.java +++ b/Applet/src/com/android/javacard/kmdevice/KMType.java @@ -92,6 +92,7 @@ public abstract class KMType { public static final byte P_256 = 0x01; public static final byte P_384 = 0x02; public static final byte P_521 = 0x03; + public static final byte CURVE_25519 = 0x04; // KeyBlobUsageRequirements Enum Tag key and values. public static final short BLOB_USAGE_REQ = 0x012D; @@ -233,7 +234,6 @@ public abstract class KMType { public static final short ORIGINATION_EXPIRE_DATETIME = 0x0191; public static final short USAGE_EXPIRE_DATETIME = 0x0192; public static final short CREATION_DATETIME = 0x02BD; - ; public static final short CERTIFICATE_NOT_BEFORE = 0x03F0; public static final short CERTIFICATE_NOT_AFTER = 0x03F1; // Integer Array Tags - ULONG_REP and UINT_REP. diff --git a/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java b/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java index 814cb8f0..f46e062f 100644 --- a/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java +++ b/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java @@ -36,6 +36,8 @@ public class RemotelyProvisionedComponentDevice { private static final byte FALSE = 0x00; // RKP Version private static final short RKP_VERSION = (short) 0x01; + private static byte[] GOOGLE; + private static byte[] RKP_UNIQUE_ID; // Boot params private static final byte OS_VERSION_ID = 0x00; private static final byte SYSTEM_PATCH_LEVEL_ID = 0x01; @@ -150,6 +152,9 @@ public RemotelyProvisionedComponentDevice(KMKeymintDevice KMApplet, KMEncoder en } public static void initStatics() { + GOOGLE = new byte[]{0x47, 0x6F, 0x6F, 0x67, 0x6C, 0x65}; + RKP_UNIQUE_ID = new byte[]{0x73, 0x74, 0x72, 0x6f, 0x6e, 0x67, 0x62, 0x6f, + 0x78, 0x20, 0x6b, 0x65, 0x79, 0x6d, 0x69, 0x6e, 0x74}; // Device Info labels BRAND = new byte[]{0x62, 0x72, 0x61, 0x6E, 0x64}; MANUFACTURER = new byte[]{0x6D, 0x61, 0x6E, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, @@ -267,12 +272,12 @@ private short getEntryLength(short index) { private void processGetRkpHwInfoCmd(APDU apdu) { // Make the response // Author name - Google. - final byte[] google = {0x47, 0x6F, 0x6F, 0x67, 0x6C, 0x65}; - short respPtr = KMArray.instance((short) 4); + short respPtr = KMArray.instance((short) 5); KMArray.add(respPtr, (short) 0, KMInteger.uint_16(KMError.OK)); KMArray.add(respPtr, (short) 1, KMInteger.uint_16(RKP_VERSION)); - KMArray.add(respPtr, (short) 2, KMByteBlob.instance(google, (short) 0, (short) google.length)); + KMArray.add(respPtr, (short) 2, KMByteBlob.instance(GOOGLE, (short) 0, (short) GOOGLE.length)); KMArray.add(respPtr, (short) 3, KMInteger.uint_8(KMType.RKP_CURVE_P256)); + KMArray.add(respPtr, (short) 4, KMByteBlob.instance(RKP_UNIQUE_ID, (short) 0, (short) RKP_UNIQUE_ID.length)); KMAppletInst.sendOutgoing(apdu, respPtr); } @@ -847,6 +852,9 @@ private short createSignedMac(KMDeviceUniqueKey deviceUniqueKey, byte[] scratchP scratchPad, signStructure ); + len = + KMPKCS8Decoder.instance(). + decodeEcdsa256Signature(KMByteBlob.instance(scratchPad, signStructure, len), scratchPad, signStructure); signStructure = KMByteBlob.instance(scratchPad, signStructure, len); /* Construct unprotected headers */ @@ -1447,4 +1455,71 @@ private short getEcAttestKeyParameters() { KMArray.add(arrPtr, tagIndex, KMBoolTag.instance(KMType.NO_AUTH_REQUIRED)); return KMKeyParameters.instance(arrPtr); } + + private boolean isSignedByte(byte b) { + return ((b & 0x0080) != 0); + } + + private short writeIntegerHeader(short valueLen, byte[] data, short offset) { + // write length + data[offset] = (byte) valueLen; + // write INTEGER tag + offset--; + data[offset] = 0x02; + return offset; + } + + private short writeSequenceHeader(short valueLen, byte[] data, short offset) { + // write length + data[offset] = (byte) valueLen; + // write INTEGER tag + offset--; + data[offset] = 0x30; + return offset; + } + + private short writeSignatureData(byte[] input, short inputOff, short inputlen, byte[] output, short offset) { + Util.arrayCopyNonAtomic(input, inputOff, output, offset, inputlen); + if (isSignedByte(input[inputOff])) { + offset--; + output[offset] = (byte) 0; + } + return offset; + } + + public short encodeES256CoseSignSignature(byte[] input, short offset, short len, byte[] scratchPad, short scratchPadOff) { + // SEQ [ INTEGER(r), INTEGER(s)] + // write from bottom to the top + if (len != 64) { + KMException.throwIt(KMError.INVALID_DATA); + } + short maxTotalLen = 72; + short end = (short) (scratchPadOff + maxTotalLen); + // write s. + short start = (short) (end - 32); + start = writeSignatureData(input, (short) (offset + 32), (short) 32, scratchPad, start); + // write length and header + short length = (short) (end - start); + start--; + start = writeIntegerHeader(length, scratchPad, start); + // write r + short rEnd = start; + start = (short) (start - 32); + start = writeSignatureData(input, offset, (short) 32, scratchPad, start); + // write length and header + length = (short) (rEnd - start); + start--; + start = writeIntegerHeader(length, scratchPad, start); + // write length and sequence header + length = (short) (end - start); + start--; + start = writeSequenceHeader(length, scratchPad, start); + length = (short) (end - start); + if (start > scratchPadOff) { + // re adjust the buffer + Util.arrayCopyNonAtomic(scratchPad, start, scratchPad, scratchPadOff, length); + } + return length; + } + } From 441a1a64be6fb384548ee342795aca83b2b53390 Mon Sep 17 00:00:00 2001 From: subrahmanyaman Date: Sat, 5 Feb 2022 06:02:38 +0000 Subject: [PATCH 2/3] Added OMAPI files. Fixed compilation errors in HAL with latest master. Added UniqueId in RKPHardwareInfo --- HAL/Android.bp | 13 +- HAL/JavacardKeymaster.cpp | 16 ++ HAL/JavacardKeymaster.h | 16 ++ ...cardRemotelyProvisionedComponentDevice.cpp | 5 +- HAL/JavacardSharedSecret.cpp | 16 ++ HAL/JavacardSharedSecret.h | 16 ++ HAL/JavacardSoftKeymasterContext.cpp | 2 +- HAL/JavacardSoftKeymasterContext.h | 2 +- HAL/KMUtils.h | 2 +- HAL/OmapiTransport.cpp | 218 ++++++++++++++++++ HAL/OmapiTransport.h | 61 +++++ 11 files changed, 361 insertions(+), 6 deletions(-) create mode 100644 HAL/OmapiTransport.cpp create mode 100644 HAL/OmapiTransport.h diff --git a/HAL/Android.bp b/HAL/Android.bp index 83cb013c..f70c65f7 100644 --- a/HAL/Android.bp +++ b/HAL/Android.bp @@ -17,6 +17,7 @@ cc_library { name: "libjc_keymint", defaults: [ "keymaster_defaults", + "keymint_use_latest_hal_aidl_ndk_shared", ], srcs: [ "JavacardKeyMintDevice.cpp", @@ -27,7 +28,6 @@ cc_library { ], cflags:["-O0",], shared_libs: [ - "android.hardware.security.keymint-V1-ndk", "android.hardware.security.secureclock-V1-ndk", "android.hardware.security.sharedsecret-V1-ndk", "lib_android_keymaster_keymint_utils", @@ -73,6 +73,7 @@ cc_library { "libcrypto", "libcutils", "libjc_km_transport", + "android.se.omapi-V1-ndk", "libbinder_ndk", ], export_include_dirs: [ @@ -85,14 +86,18 @@ cc_library { name: "libjc_km_transport", vendor_available: true, srcs: [ + "OmapiTransport.cpp", "SocketTransport.cpp", ], export_include_dirs: [ "." ], shared_libs: [ + "libbinder", "libbase", "liblog", + "libbinder_ndk", + "android.se.omapi-V1-ndk", ], } @@ -164,6 +169,7 @@ cc_binary { "libcrypto", "libjc_keymaster", "libjc_keymaster_portable", + "android.se.omapi-V1-ndk", ], required: [ "android.hardware.keymaster_strongbox_keystore.xml", @@ -183,8 +189,10 @@ cc_binary { "-Wall", "-Wextra", ], + defaults: [ + "keymint_use_latest_hal_aidl_ndk_shared", + ], shared_libs: [ - "android.hardware.security.keymint-V1-ndk", "android.hardware.security.sharedsecret-V1-ndk", "libbase", "libbinder_ndk", @@ -196,6 +204,7 @@ cc_binary { "liblog", "libutils", "libjc_keymaster_portable", + "android.se.omapi-V1-ndk", ], srcs: [ "keymintService.cpp", diff --git a/HAL/JavacardKeymaster.cpp b/HAL/JavacardKeymaster.cpp index 2f20b32e..fafef7d4 100644 --- a/HAL/JavacardKeymaster.cpp +++ b/HAL/JavacardKeymaster.cpp @@ -1,3 +1,19 @@ +/* + ** + ** Copyright 2020, The Android Open Source Project + ** + ** Licensed under the Apache License, Version 2.0 (the "License"); + ** you may not use this file except in compliance with the License. + ** You may obtain a copy of the License at + ** + ** http://www.apache.org/licenses/LICENSE-2.0 + ** + ** Unless required by applicable law or agreed to in writing, software + ** distributed under the License is distributed on an "AS IS" BASIS, + ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ** See the License for the specific language governing permissions and + ** limitations under the License. + */ #include #include #include diff --git a/HAL/JavacardKeymaster.h b/HAL/JavacardKeymaster.h index adc9b936..d17d374f 100644 --- a/HAL/JavacardKeymaster.h +++ b/HAL/JavacardKeymaster.h @@ -1,3 +1,19 @@ +/* + ** + ** Copyright 2020, The Android Open Source Project + ** + ** Licensed under the Apache License, Version 2.0 (the "License"); + ** you may not use this file except in compliance with the License. + ** You may obtain a copy of the License at + ** + ** http://www.apache.org/licenses/LICENSE-2.0 + ** + ** Unless required by applicable law or agreed to in writing, software + ** distributed under the License is distributed on an "AS IS" BASIS, + ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ** See the License for the specific language governing permissions and + ** limitations under the License. + */ #pragma once #include "CborConverter.h" #include "JavacardSecureElement.h" diff --git a/HAL/JavacardRemotelyProvisionedComponentDevice.cpp b/HAL/JavacardRemotelyProvisionedComponentDevice.cpp index 847fbebb..01364e1a 100644 --- a/HAL/JavacardRemotelyProvisionedComponentDevice.cpp +++ b/HAL/JavacardRemotelyProvisionedComponentDevice.cpp @@ -86,15 +86,18 @@ ScopedAStatus JavacardRemotelyProvisionedComponentDevice::getHardwareInfo(RpcHar auto [item, err] = card_->sendRequest(Instruction::INS_GET_RKP_HARDWARE_INFO); uint32_t versionNumber; uint32_t supportedEekCurve; + std::string uniqueId; if (err != KM_ERROR_OK || !cbor_.getUint64(item, 1, versionNumber) || !cbor_.getBinaryArray(item, 2, info->rpcAuthorName) || - !cbor_.getUint64(item, 3, supportedEekCurve)) { + !cbor_.getUint64(item, 3, supportedEekCurve) || + !cbor_.getBinaryArray(item, 4, uniqueId)) { LOG(ERROR) << "Error in response of getHardwareInfo."; LOG(INFO) << "Returning defaultHwInfo in getHardwareInfo."; return defaultHwInfo(info); } info->versionNumber = static_cast(versionNumber); info->supportedEekCurve = static_cast(supportedEekCurve); + info->uniqueId = uniqueId; return ScopedAStatus::ok(); } diff --git a/HAL/JavacardSharedSecret.cpp b/HAL/JavacardSharedSecret.cpp index f2555a80..a053d4bf 100644 --- a/HAL/JavacardSharedSecret.cpp +++ b/HAL/JavacardSharedSecret.cpp @@ -1,3 +1,19 @@ +/* + ** + ** Copyright 2021, The Android Open Source Project + ** + ** Licensed under the Apache License, Version 2.0 (the "License"); + ** you may not use this file except in compliance with the License. + ** You may obtain a copy of the License at + ** + ** http://www.apache.org/licenses/LICENSE-2.0 + ** + ** Unless required by applicable law or agreed to in writing, software + ** distributed under the License is distributed on an "AS IS" BASIS, + ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ** See the License for the specific language governing permissions and + ** limitations under the License. + */ #define LOG_TAG "javacard.strongbox.keymint.operation-impl" #include "JavacardSharedSecret.h" #include diff --git a/HAL/JavacardSharedSecret.h b/HAL/JavacardSharedSecret.h index de965732..2d0af607 100644 --- a/HAL/JavacardSharedSecret.h +++ b/HAL/JavacardSharedSecret.h @@ -1,3 +1,19 @@ +/* + ** + ** Copyright 2020, The Android Open Source Project + ** + ** Licensed under the Apache License, Version 2.0 (the "License"); + ** you may not use this file except in compliance with the License. + ** You may obtain a copy of the License at + ** + ** http://www.apache.org/licenses/LICENSE-2.0 + ** + ** Unless required by applicable law or agreed to in writing, software + ** distributed under the License is distributed on an "AS IS" BASIS, + ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ** See the License for the specific language governing permissions and + ** limitations under the License. + */ #pragma once #include diff --git a/HAL/JavacardSoftKeymasterContext.cpp b/HAL/JavacardSoftKeymasterContext.cpp index c1abf46f..0c7c6705 100644 --- a/HAL/JavacardSoftKeymasterContext.cpp +++ b/HAL/JavacardSoftKeymasterContext.cpp @@ -1,5 +1,5 @@ /* - * Copyright 2015 The Android Open Source Project + * Copyright 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/HAL/JavacardSoftKeymasterContext.h b/HAL/JavacardSoftKeymasterContext.h index 4655a121..0bd7cdc8 100644 --- a/HAL/JavacardSoftKeymasterContext.h +++ b/HAL/JavacardSoftKeymasterContext.h @@ -1,5 +1,5 @@ /* - * Copyright 2015 The Android Open Source Project + * Copyright 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/HAL/KMUtils.h b/HAL/KMUtils.h index 05b7502f..3d3b9b73 100644 --- a/HAL/KMUtils.h +++ b/HAL/KMUtils.h @@ -19,8 +19,8 @@ #include #include #include -#include #include +#include namespace javacard_keymaster { using namespace ::keymaster; diff --git a/HAL/OmapiTransport.cpp b/HAL/OmapiTransport.cpp new file mode 100644 index 00000000..c442220a --- /dev/null +++ b/HAL/OmapiTransport.cpp @@ -0,0 +1,218 @@ +/* + ** + ** Copyright 2020, The Android Open Source Project + ** + ** Licensed under the Apache License, Version 2.0 (the "License"); + ** you may not use this file except in compliance with the License. + ** You may obtain a copy of the License at + ** + ** http://www.apache.org/licenses/LICENSE-2.0 + ** + ** Unless required by applicable law or agreed to in writing, software + ** distributed under the License is distributed on an "AS IS" BASIS, + ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ** See the License for the specific language governing permissions and + ** limitations under the License. + */ +#include +#include +#include +#include +#include +#include + +#include + +#include "OmapiTransport.h" + +namespace javacard_keymaster { + +class SEListener : public ::aidl::android::se::omapi::BnSecureElementListener {}; + +bool OmapiTransport::initialize() { + std::vector readers = {}; + + LOG(DEBUG) << "Initialize the secure element connection"; + + // Get OMAPI vendor stable service handler + ::ndk::SpAIBinder ks2Binder(AServiceManager_getService(omapiServiceName)); + omapiSeService = aidl::android::se::omapi::ISecureElementService::fromBinder(ks2Binder); + + if (omapiSeService == nullptr) { + LOG(ERROR) << "Failed to start omapiSeService null"; + return false; + } + + // reset readers, clear readers if already existing + if (mVSReaders.size() > 0) { + closeConnection(); + } + + // Get available readers + auto status = omapiSeService->getReaders(&readers); + if (!status.isOk()) { + LOG(ERROR) << "getReaders failed to get available readers: " << status.getMessage(); + return false; + } + + // Get SE readers handlers + for (auto readerName : readers) { + std::shared_ptr<::aidl::android::se::omapi::ISecureElementReader> reader; + status = omapiSeService->getReader(readerName, &reader); + if (!status.isOk()) { + LOG(ERROR) << "getReader for " << readerName.c_str() + << " Failed: " << status.getMessage(); + return false; + } + + mVSReaders[readerName] = reader; + } + + // Find eSE reader, as of now assumption is only eSE available on device + LOG(DEBUG) << "Finding eSE reader"; + eSEReader = nullptr; + if (mVSReaders.size() > 0) { + for (const auto& [name, reader] : mVSReaders) { + if (name.find(ESE_READER_PREFIX, 0) != std::string::npos) { + LOG(DEBUG) << "eSE reader found: " << name; + eSEReader = reader; + } + } + } + + if (eSEReader == nullptr) { + LOG(ERROR) << "secure element reader " << ESE_READER_PREFIX << " not found"; + return false; + } + + return true; +} + +bool OmapiTransport::internalTransmitApdu( + std::shared_ptr reader, + std::vector apdu, std::vector& transmitResponse) { + std::shared_ptr session; + std::shared_ptr channel; + auto mSEListener = ndk::SharedRefBase::make(); + std::vector selectResponse = {}; + std::vector SELECTABLE_AID = {0xA0, 0x00, 0x00, 0x04, 0x76, 0x41, 0x6E, 0x64, + 0x72, 0x6F, 0x69, 0x64, 0x43, 0x54, 0x53, 0x31}; + + LOG(DEBUG) << "internalTransmitApdu: trasmitting data to secure element"; + + if (reader == nullptr) { + LOG(ERROR) << "eSE reader is null"; + return false; + } + + bool status = false; + auto res = reader->isSecureElementPresent(&status); + if (!res.isOk()) { + LOG(ERROR) << "isSecureElementPresent error: " << res.getMessage(); + return false; + } + if (!status) { + LOG(ERROR) << "secure element not found"; + return false; + } + + res = reader->openSession(&session); + if (!res.isOk()) { + LOG(ERROR) << "openSession error: " << res.getMessage(); + return false; + } + if (session == nullptr) { + LOG(ERROR) << "Could not open session null"; + return false; + } + + res = session->openLogicalChannel(SELECTABLE_AID, 0x00, mSEListener, &channel); + if (!res.isOk()) { + LOG(ERROR) << "openLogicalChannel error: " << res.getMessage(); + return false; + } + if (channel == nullptr) { + LOG(ERROR) << "Could not open channel null"; + return false; + } + + res = channel->getSelectResponse(&selectResponse); + if (!res.isOk()) { + LOG(ERROR) << "getSelectResponse error: " << res.getMessage(); + return false; + } + if (selectResponse.size() < 2) { + LOG(ERROR) << "getSelectResponse size error"; + return false; + } + + res = channel->transmit(apdu, &transmitResponse); + if (channel != nullptr) channel->close(); + if (session != nullptr) session->close(); + + LOG(INFO) << "STATUS OF TRNSMIT: " << res.getExceptionCode() + << " Message: " << res.getMessage(); + if (!res.isOk()) { + LOG(ERROR) << "transmit error: " << res.getMessage(); + return false; + } + + return true; +} + +bool OmapiTransport::openConnection() { + + // if already conection setup done, no need to initialise it again. + if (isConnected()) { + return true; + } + + return initialize(); +} + +bool OmapiTransport::sendData(const vector& inData, vector& output) { + + if (!isConnected()) { + // Try to initialize connection to eSE + LOG(INFO) << "Failed to send data, try to initialize connection SE connection"; + if (!initialize()) { + LOG(ERROR) << "Failed to send data, initialization not completed"; + closeConnection(); + return false; + } + } + + if (eSEReader != nullptr) { + LOG(DEBUG) << "Sending apdu data to secure element: " << ESE_READER_PREFIX; + return internalTransmitApdu(eSEReader, inData, output); + } else { + LOG(ERROR) << "secure element reader " << ESE_READER_PREFIX << " not found"; + return false; + } +} + +bool OmapiTransport::closeConnection() { + LOG(DEBUG) << "Closing all connections"; + if (omapiSeService != nullptr) { + if (mVSReaders.size() > 0) { + for (const auto& [name, reader] : mVSReaders) { + reader->closeSessions(); + } + mVSReaders.clear(); + } + } + return true; +} + +bool OmapiTransport::isConnected() { + // Check already initialization completed or not + if (omapiSeService != nullptr && eSEReader != nullptr) { + LOG(DEBUG) << "Connection initialization already completed"; + return true; + } + + LOG(DEBUG) << "Connection initialization not completed"; + return false; +} + +} // namespace javacard_keymaster diff --git a/HAL/OmapiTransport.h b/HAL/OmapiTransport.h new file mode 100644 index 00000000..47db37f3 --- /dev/null +++ b/HAL/OmapiTransport.h @@ -0,0 +1,61 @@ +#pragma once + +#include "ITransport.h" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace javacard_keymaster { +using std::vector; + +/** + * OmapiTransport is derived from ITransport. This class gets the OMAPI service binder instance and + * uses IPC to communicate with OMAPI service. OMAPI inturn communicates with hardware via + * ISecureElement. + */ +class OmapiTransport : public ITransport { + + public: + /** + * Gets the binder instance of ISEService, gets the reader corresponding to secure element, + * establishes a session and opens a basic channel. + */ + bool openConnection() override; + /** + * Transmists the data over the opened basic channel and receives the data back. + */ + bool sendData(const vector& inData, vector& output) override; + + /** + * Closes the connection. + */ + bool closeConnection() override; + /** + * Returns the state of the connection status. Returns true if the connection is active, false + * if connection is broken. + */ + bool isConnected() override; + + private: + std::shared_ptr omapiSeService = nullptr; + std::shared_ptr eSEReader = nullptr; + std::map> + mVSReaders = {}; + std::string const ESE_READER_PREFIX = "eSE"; + constexpr static const char omapiServiceName[] = + "android.system.omapi.ISecureElementService/default"; + + bool initialize(); + bool + internalTransmitApdu(std::shared_ptr reader, + std::vector apdu, std::vector& transmitResponse); +}; + +} // namespace javacard_keymaster From 9a19f88d017e8c70c217897141b7b6ad5aadd9cf Mon Sep 17 00:00:00 2001 From: subrahmanyaman Date: Wed, 16 Feb 2022 11:35:47 +0000 Subject: [PATCH 3/3] Fixed compilation errors while using keymint V1 library --- .../RemotelyProvisionedComponentDevice.java | 11 +- HAL/Android.bp | 7 +- HAL/JavacardKeyMintDevice.cpp | 5 +- HAL/JavacardKeyMintOperation.cpp | 13 +- HAL/JavacardKeyMintUtils.cpp | 200 +++++++++++++++++- HAL/JavacardKeyMintUtils.h | 41 +++- ...cardRemotelyProvisionedComponentDevice.cpp | 7 +- HAL/JavacardSharedSecret.cpp | 2 +- HAL/keymintService.cpp | 2 +- 9 files changed, 259 insertions(+), 29 deletions(-) diff --git a/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java b/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java index f46e062f..1f2031a5 100644 --- a/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java +++ b/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java @@ -37,7 +37,6 @@ public class RemotelyProvisionedComponentDevice { // RKP Version private static final short RKP_VERSION = (short) 0x01; private static byte[] GOOGLE; - private static byte[] RKP_UNIQUE_ID; // Boot params private static final byte OS_VERSION_ID = 0x00; private static final byte SYSTEM_PATCH_LEVEL_ID = 0x01; @@ -153,8 +152,6 @@ public RemotelyProvisionedComponentDevice(KMKeymintDevice KMApplet, KMEncoder en public static void initStatics() { GOOGLE = new byte[]{0x47, 0x6F, 0x6F, 0x67, 0x6C, 0x65}; - RKP_UNIQUE_ID = new byte[]{0x73, 0x74, 0x72, 0x6f, 0x6e, 0x67, 0x62, 0x6f, - 0x78, 0x20, 0x6b, 0x65, 0x79, 0x6d, 0x69, 0x6e, 0x74}; // Device Info labels BRAND = new byte[]{0x62, 0x72, 0x61, 0x6E, 0x64}; MANUFACTURER = new byte[]{0x6D, 0x61, 0x6E, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, @@ -272,12 +269,11 @@ private short getEntryLength(short index) { private void processGetRkpHwInfoCmd(APDU apdu) { // Make the response // Author name - Google. - short respPtr = KMArray.instance((short) 5); + short respPtr = KMArray.instance((short) 4); KMArray.add(respPtr, (short) 0, KMInteger.uint_16(KMError.OK)); KMArray.add(respPtr, (short) 1, KMInteger.uint_16(RKP_VERSION)); KMArray.add(respPtr, (short) 2, KMByteBlob.instance(GOOGLE, (short) 0, (short) GOOGLE.length)); KMArray.add(respPtr, (short) 3, KMInteger.uint_8(KMType.RKP_CURVE_P256)); - KMArray.add(respPtr, (short) 4, KMByteBlob.instance(RKP_UNIQUE_ID, (short) 0, (short) RKP_UNIQUE_ID.length)); KMAppletInst.sendOutgoing(apdu, respPtr); } @@ -1089,6 +1085,11 @@ private short ecdhHkdfDeriveKey(byte[] privKeyA, short privKeyAOff, short privKe pubKeyBLen, scratchPad, (short) 0); key = KMByteBlob.instance(scratchPad, (short) 0, key); + // ignore 0x04 for ephemerical public key as kdfContext should not include 0x04. + pubKeyAOff += 1; + pubKeyALen -= 1; + pubKeyBOff += 1; + pubKeyBLen -= 1; short kdfContext = kmCoseInst.constructKdfContext(pubKeyA, pubKeyAOff, pubKeyALen, pubKeyB, pubKeyBOff, pubKeyBLen, diff --git a/HAL/Android.bp b/HAL/Android.bp index f70c65f7..f4c77c2c 100644 --- a/HAL/Android.bp +++ b/HAL/Android.bp @@ -17,7 +17,6 @@ cc_library { name: "libjc_keymint", defaults: [ "keymaster_defaults", - "keymint_use_latest_hal_aidl_ndk_shared", ], srcs: [ "JavacardKeyMintDevice.cpp", @@ -30,7 +29,7 @@ cc_library { shared_libs: [ "android.hardware.security.secureclock-V1-ndk", "android.hardware.security.sharedsecret-V1-ndk", - "lib_android_keymaster_keymint_utils", + "android.hardware.security.keymint-V1-ndk", "libbase", "libcppbor_external", "libkeymaster_portable", @@ -189,11 +188,9 @@ cc_binary { "-Wall", "-Wextra", ], - defaults: [ - "keymint_use_latest_hal_aidl_ndk_shared", - ], shared_libs: [ "android.hardware.security.sharedsecret-V1-ndk", + "android.hardware.security.keymint-V1-ndk", "libbase", "libbinder_ndk", "libcppbor_external", diff --git a/HAL/JavacardKeyMintDevice.cpp b/HAL/JavacardKeyMintDevice.cpp index a0850591..fe09e03e 100644 --- a/HAL/JavacardKeyMintDevice.cpp +++ b/HAL/JavacardKeyMintDevice.cpp @@ -20,7 +20,6 @@ #include #include #include -#include #include #include #include @@ -266,7 +265,7 @@ ScopedAStatus JavacardKeyMintDevice::begin(KeyPurpose purpose, const std::vector paramSet.Reinitialize(KmParamSet(params)); ::keymaster::HardwareAuthToken legacyToken; std::unique_ptr operation; - legacyHardwareAuthToken(aToken, &legacyToken); + km_utils::legacyHardwareAuthToken(aToken, &legacyToken); auto err = jcImpl_->begin(static_cast(purpose), keyBlob, paramSet, legacyToken, &outParams, operation); if (err != KM_ERROR_OK) { @@ -284,7 +283,7 @@ JavacardKeyMintDevice::deviceLocked(bool passwordOnly, const std::optional& timestampToken) { TimeStampToken tToken = timestampToken.value_or(TimeStampToken()); vector encodedTimestampToken; - auto err = encodeTimestampToken(tToken, &encodedTimestampToken); + auto err = km_utils::encodeTimestampToken(tToken, &encodedTimestampToken); if (err != KM_ERROR_OK) { LOG(ERROR) << "In deviceLocked failed to encode TimeStampToken" << (int32_t)err; return km_utils::kmError2ScopedAStatus(err); diff --git a/HAL/JavacardKeyMintOperation.cpp b/HAL/JavacardKeyMintOperation.cpp index 82d741b0..2e4ec42f 100644 --- a/HAL/JavacardKeyMintOperation.cpp +++ b/HAL/JavacardKeyMintOperation.cpp @@ -18,7 +18,6 @@ #include "JavacardKeyMintOperation.h" #include -#include #include #include #include @@ -35,8 +34,8 @@ ScopedAStatus JavacardKeyMintOperation::updateAad(const vector& input, vector encodedTimestampToken; HardwareAuthToken aToken = authToken.value_or(HardwareAuthToken()); TimeStampToken tToken = timestampToken.value_or(TimeStampToken()); - legacyHardwareAuthToken(aToken, &legacyToken); - encodeTimestampToken(tToken, &encodedTimestampToken); + km_utils::legacyHardwareAuthToken(aToken, &legacyToken); + km_utils::encodeTimestampToken(tToken, &encodedTimestampToken); auto err = jcKmOprImpl_->updateAad(input, legacyToken, encodedTimestampToken); return km_utils::kmError2ScopedAStatus(err); } @@ -49,8 +48,8 @@ ScopedAStatus JavacardKeyMintOperation::update(const vector& input, vector encodedTimestampToken; HardwareAuthToken aToken = authToken.value_or(HardwareAuthToken()); TimeStampToken tToken = timestampToken.value_or(TimeStampToken()); - legacyHardwareAuthToken(aToken, &legacyToken); - encodeTimestampToken(tToken, &encodedTimestampToken); + km_utils::legacyHardwareAuthToken(aToken, &legacyToken); + km_utils::encodeTimestampToken(tToken, &encodedTimestampToken); auto err = jcKmOprImpl_->update(input, nullopt, legacyToken, encodedTimestampToken, nullptr, nullptr, output); return km_utils::kmError2ScopedAStatus(err); @@ -71,8 +70,8 @@ ScopedAStatus JavacardKeyMintOperation::finish(const optional>& // If confirmation token is empty, then create empty vector. This is to // differentiate between the keymaster and keymint. std::optional> confToken = confirmationToken.value_or(vector()); - legacyHardwareAuthToken(aToken, &legacyToken); - encodeTimestampToken(tToken, &encodedTimestampToken); + km_utils::legacyHardwareAuthToken(aToken, &legacyToken); + km_utils::encodeTimestampToken(tToken, &encodedTimestampToken); auto err = jcKmOprImpl_->finish(inputData, nullopt, signatureData, legacyToken, encodedTimestampToken, confToken, nullptr, output); return km_utils::kmError2ScopedAStatus(err); diff --git a/HAL/JavacardKeyMintUtils.cpp b/HAL/JavacardKeyMintUtils.cpp index 33392e76..3ddec7cd 100644 --- a/HAL/JavacardKeyMintUtils.cpp +++ b/HAL/JavacardKeyMintUtils.cpp @@ -15,9 +15,137 @@ */ #include "JavacardKeyMintUtils.h" +#include #include -namespace aidl::android::hardware::security::keymint { +namespace aidl::android::hardware::security::keymint::km_utils { + +keymaster_key_param_t kInvalidTag{.tag = KM_TAG_INVALID, .integer = 0}; + +KeyParameter kmEnumParam2Aidl(const keymaster_key_param_t& param) { + switch (param.tag) { + case KM_TAG_PURPOSE: + return KeyParameter{Tag::PURPOSE, KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_ALGORITHM: + return KeyParameter{Tag::ALGORITHM, KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_BLOCK_MODE: + return KeyParameter{Tag::BLOCK_MODE, KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_DIGEST: + return KeyParameter{Tag::DIGEST, KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_PADDING: + return KeyParameter{Tag::PADDING, KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_EC_CURVE: + return KeyParameter{Tag::EC_CURVE, KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_USER_AUTH_TYPE: + return KeyParameter{Tag::USER_AUTH_TYPE, + KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_ORIGIN: + return KeyParameter{Tag::ORIGIN, KeyParameterValue::make( + static_cast(param.enumerated))}; + case KM_TAG_BLOB_USAGE_REQUIREMENTS: + case KM_TAG_KDF: + default: + return KeyParameter{Tag::INVALID, false}; + } +} + + +KeyParameter kmParam2Aidl(const keymaster_key_param_t& param) { + auto tag = legacy_enum_conversion(param.tag); + switch (typeFromTag(param.tag)) { + case KM_ENUM: + case KM_ENUM_REP: + return kmEnumParam2Aidl(param); + break; + + case KM_UINT: + case KM_UINT_REP: + return KeyParameter{tag, + KeyParameterValue::make(param.integer)}; + + case KM_ULONG: + case KM_ULONG_REP: + return KeyParameter{ + tag, KeyParameterValue::make(param.long_integer)}; + break; + + case KM_DATE: + return KeyParameter{tag, + KeyParameterValue::make(param.date_time)}; + break; + + case KM_BOOL: + return KeyParameter{tag, param.boolean}; + break; + + case KM_BIGNUM: + case KM_BYTES: + return {tag, KeyParameterValue::make( + std::vector(param.blob.data, param.blob.data + param.blob.data_length))}; + break; + + case KM_INVALID: + default: + CHECK(false) << "Unknown or unused tag type: Something is broken"; + return KeyParameter{Tag::INVALID, false}; + break; + } +} + +vector kmParamSet2Aidl(const keymaster_key_param_set_t& set) { + vector result; + if (set.length == 0 || set.params == nullptr) return result; + + result.reserve(set.length); + for (size_t i = 0; i < set.length; ++i) { + result.push_back(kmParam2Aidl(set.params[i])); + } + return result; +} + +template +keymaster_key_param_t aidlEnumVal2Km(keymaster_tag_t km_tag, const KeyParameterValue& value) { + return value.getTag() == aidl_tag + ? keymaster_param_enum(km_tag, static_cast(value.get())) + : kInvalidTag; +} + +keymaster_key_param_t aidlEnumParam2Km(const KeyParameter& param) { + auto tag = legacy_enum_conversion(param.tag); + switch (tag) { + case KM_TAG_PURPOSE: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_ALGORITHM: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_BLOCK_MODE: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_DIGEST: + case KM_TAG_RSA_OAEP_MGF_DIGEST: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_PADDING: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_EC_CURVE: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_USER_AUTH_TYPE: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_ORIGIN: + return aidlEnumVal2Km(tag, param.value); + case KM_TAG_BLOB_USAGE_REQUIREMENTS: + case KM_TAG_KDF: + default: + CHECK(false) << "Unknown or unused enum tag: Something is broken"; + return keymaster_param_enum(tag, false); + } +} + + keymaster_error_t legacyHardwareAuthToken(const HardwareAuthToken& aidlToken, LegacyHardwareAuthToken* legacyToken) { @@ -42,4 +170,74 @@ keymaster_error_t encodeTimestampToken(const TimeStampToken& timestampToken, return KM_ERROR_OK; } +keymaster_key_param_set_t aidlKeyParams2Km(const vector& keyParams) { + keymaster_key_param_set_t set; + + set.params = static_cast( + malloc(keyParams.size() * sizeof(keymaster_key_param_t))); + set.length = keyParams.size(); + + for (size_t i = 0; i < keyParams.size(); ++i) { + const auto& param = keyParams[i]; + auto tag = legacy_enum_conversion(param.tag); + switch (typeFromTag(tag)) { + + case KM_ENUM: + case KM_ENUM_REP: + set.params[i] = aidlEnumParam2Km(param); + break; + + case KM_UINT: + case KM_UINT_REP: + set.params[i] = + param.value.getTag() == KeyParameterValue::integer + ? keymaster_param_int(tag, param.value.get()) + : kInvalidTag; + break; + + case KM_ULONG: + case KM_ULONG_REP: + set.params[i] = + param.value.getTag() == KeyParameterValue::longInteger + ? keymaster_param_long(tag, param.value.get()) + : kInvalidTag; + break; + + case KM_DATE: + set.params[i] = + param.value.getTag() == KeyParameterValue::dateTime + ? keymaster_param_date(tag, param.value.get()) + : kInvalidTag; + break; + + case KM_BOOL: + set.params[i] = keymaster_param_bool(tag); + break; + + case KM_BIGNUM: + case KM_BYTES: + if (param.value.getTag() == KeyParameterValue::blob) { + const auto& value = param.value.get(); + uint8_t* copy = static_cast(malloc(value.size())); + std::copy(value.begin(), value.end(), copy); + set.params[i] = keymaster_param_blob(tag, copy, value.size()); + } else { + set.params[i] = kInvalidTag; + } + break; + + case KM_INVALID: + default: + CHECK(false) << "Invalid tag: Something is broken"; + set.params[i].tag = KM_TAG_INVALID; + /* just skip */ + break; + } + } + + return set; +} + + + } // namespace aidl::android::hardware::security::keymint diff --git a/HAL/JavacardKeyMintUtils.h b/HAL/JavacardKeyMintUtils.h index ca269a5e..a156a25e 100644 --- a/HAL/JavacardKeyMintUtils.h +++ b/HAL/JavacardKeyMintUtils.h @@ -15,18 +15,33 @@ */ #pragma once +#include +#include #include #include #include #include #include -namespace aidl::android::hardware::security::keymint { +namespace aidl::android::hardware::security::keymint::km_utils { using namespace ::keymaster; using secureclock::TimeStampToken; +using ::ndk::ScopedAStatus; using std::vector; using LegacyHardwareAuthToken = ::keymaster::HardwareAuthToken; +inline keymaster_tag_t legacy_enum_conversion(const Tag value) { + return static_cast(value); +} + +inline Tag legacy_enum_conversion(const keymaster_tag_t value) { + return static_cast(value); +} + +inline keymaster_tag_type_t typeFromTag(const keymaster_tag_t tag) { + return keymaster_tag_get_type(tag); +} + inline void Vec2KmBlob(const vector& input, KeymasterBlob* blob) { blob->Reset(input.size()); memcpy(blob->writable_data(), input.data(), input.size()); @@ -38,4 +53,28 @@ keymaster_error_t legacyHardwareAuthToken(const HardwareAuthToken& aidlToken, keymaster_error_t encodeTimestampToken(const TimeStampToken& timestampToken, vector* encodedToken); +inline ScopedAStatus kmError2ScopedAStatus(const keymaster_error_t value) { + return (value == KM_ERROR_OK + ? ScopedAStatus::ok() + : ScopedAStatus(AStatus_fromServiceSpecificError(static_cast(value)))); +} + +KeyParameter kmParam2Aidl(const keymaster_key_param_t& param); +vector kmParamSet2Aidl(const keymaster_key_param_set_t& set); +keymaster_key_param_set_t aidlKeyParams2Km(const vector& keyParams); + +class KmParamSet : public keymaster_key_param_set_t { + public: + explicit KmParamSet(const vector& keyParams) + : keymaster_key_param_set_t(aidlKeyParams2Km(keyParams)) {} + + KmParamSet(KmParamSet&& other) : keymaster_key_param_set_t{other.params, other.length} { + other.length = 0; + other.params = nullptr; + } + + KmParamSet(const KmParamSet&) = delete; + ~KmParamSet() { keymaster_free_param_set(this); } +}; + } // namespace aidl::android::hardware::security::keymint diff --git a/HAL/JavacardRemotelyProvisionedComponentDevice.cpp b/HAL/JavacardRemotelyProvisionedComponentDevice.cpp index 01364e1a..f9de091e 100644 --- a/HAL/JavacardRemotelyProvisionedComponentDevice.cpp +++ b/HAL/JavacardRemotelyProvisionedComponentDevice.cpp @@ -16,7 +16,7 @@ #define LOG_TAG "javacard.keymint.device.rkp.strongbox-impl" #include -#include +#include #include #include #include @@ -86,18 +86,15 @@ ScopedAStatus JavacardRemotelyProvisionedComponentDevice::getHardwareInfo(RpcHar auto [item, err] = card_->sendRequest(Instruction::INS_GET_RKP_HARDWARE_INFO); uint32_t versionNumber; uint32_t supportedEekCurve; - std::string uniqueId; if (err != KM_ERROR_OK || !cbor_.getUint64(item, 1, versionNumber) || !cbor_.getBinaryArray(item, 2, info->rpcAuthorName) || - !cbor_.getUint64(item, 3, supportedEekCurve) || - !cbor_.getBinaryArray(item, 4, uniqueId)) { + !cbor_.getUint64(item, 3, supportedEekCurve)) { LOG(ERROR) << "Error in response of getHardwareInfo."; LOG(INFO) << "Returning defaultHwInfo in getHardwareInfo."; return defaultHwInfo(info); } info->versionNumber = static_cast(versionNumber); info->supportedEekCurve = static_cast(supportedEekCurve); - info->uniqueId = uniqueId; return ScopedAStatus::ok(); } diff --git a/HAL/JavacardSharedSecret.cpp b/HAL/JavacardSharedSecret.cpp index a053d4bf..3521fdaf 100644 --- a/HAL/JavacardSharedSecret.cpp +++ b/HAL/JavacardSharedSecret.cpp @@ -16,7 +16,7 @@ */ #define LOG_TAG "javacard.strongbox.keymint.operation-impl" #include "JavacardSharedSecret.h" -#include +#include #include namespace aidl::android::hardware::security::sharedsecret { diff --git a/HAL/keymintService.cpp b/HAL/keymintService.cpp index 54b990b7..a63fb68a 100644 --- a/HAL/keymintService.cpp +++ b/HAL/keymintService.cpp @@ -1,5 +1,5 @@ /* - * Copyright 2020, The Android Open Source Project + * Copyright 2021, The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License.