diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMUtils.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMUtils.java index 65e83415..cdd86665 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMUtils.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMUtils.java @@ -70,17 +70,17 @@ public static short convertToDate(short time, byte[] scratchPad, (short) (8 - KMInteger.cast(time).length()), KMInteger.cast(time) .length()); // If the time is less then 1 Jan 2020 then it is an error - if (unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2020, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2020, (short) 0, (short) 8) < 0) { KMException.throwIt(KMError.INVALID_ARGUMENT); } if (utcFlag - && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, + && KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0, (short) 8) >= 0) { KMException.throwIt(KMError.INVALID_ARGUMENT); } - if (unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0, (short) 8) < 0) { Util.arrayCopyNonAtomic(firstJan2020, (short) 0, scratchPad, (short) 8, (short) 8); @@ -96,7 +96,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 8); } // divide the given time with four yrs msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, fourYrsMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, fourYrsMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(fourYrsMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -116,9 +116,9 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, // if leap year index is 0, then the number of days for the 1st year will be 366 days. // if leap year index is not 0, then the number of days for the 1st year will be 365 days. if (((leapYrIdx == 0) && - (unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, (short) 0,(short) 8) >= 0)) || + (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, (short) 0,(short) 8) >= 0)) || ((leapYrIdx != 0) && - (unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, (short) 0,(short) 8) >= 0))) { + (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, (short) 0,(short) 8) >= 0))) { for (short i = 0; i < 4; i++) { yrsCount++; if (i == leapYrIdx) { @@ -132,12 +132,12 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, Util.arrayCopyNonAtomic(scratchPad, (short) 16, scratchPad, (short) 0, (short) 8); if (((short) (i + 1) == leapYrIdx)) { - if (unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, (short) 0, (short) 8) < 0) { break; } } else { - if (unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, (short) 0, (short) 8) < 0) { break; } @@ -152,7 +152,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, yrsCount = (short) (year2051 + yrsCount); // divide the given time with one month msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneMonthMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneMonthMsec, (short) 0, (short) 8) >= 0) { for (short i = 0; i < 12; i++) { if (i == 1) { @@ -175,7 +175,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 8, (short) 8); } - if (unsignedByteArrayCompare(scratchPad, (short) 0, scratchPad, (short) 8, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, scratchPad, (short) 8, (short) 8) >= 0) { subtract(scratchPad, (short) 0, (short) 8, (short) 16); Util.arrayCopyNonAtomic(scratchPad, (short) 16, scratchPad, (short) 0, @@ -188,7 +188,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one day msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneDayMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneDayMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneDayMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -199,7 +199,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one hour msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneHourMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneHourMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneHourMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -209,7 +209,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one minute msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneMinMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneMinMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneMinMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -219,7 +219,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one second msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneSecMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneSecMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneSecMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -244,24 +244,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, return KMByteBlob.instance(scratchPad, (short) 0, len); // YYYY } - public static byte unsignedByteArrayCompare(byte[] a1, short offset1, byte[] a2, short offset2, short length) { - byte count = (byte) 0; - short val1 = (short)0; - short val2 = (short)0; - for (; count < length; count++) { - val1 = (short) (a1[(short) (count + offset1)] & 0x00FF); - val2 = (short) (a2[(short) (count + offset2)] & 0x00FF); - - if (val1 < val2) { - return -1; - } - if (val1 > val2) { - return 1; - } - } - return 0; - } public static short numberToString(short number, byte[] scratchPad, short offset) { @@ -311,7 +294,7 @@ public static void copy(byte[] buf, short from, short to) { } public static byte compare(byte[] buf, short lhs, short rhs) { - return unsignedByteArrayCompare(buf, lhs, buf, rhs, (short) 8); + return KMInteger.unsignedByteArrayCompare(buf, lhs, buf, rhs, (short) 8); } public static void shiftLeft(byte[] buf, short start) { diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java index 18e67e72..23e7a067 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java @@ -90,7 +90,6 @@ public class KMAttestationCertImpl implements KMAttestationCert { private static byte[] stack; private static short start; private static short length; - // private static KMRepository repo; private static short uniqueId; private static short attChallenge; private static short notBefore; diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMCipher.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMCipher.java index 3e67ed5e..a5d06a39 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMCipher.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMCipher.java @@ -24,19 +24,11 @@ public abstract class KMCipher { public abstract void updateAAD(byte[] buffer, short startOff, short length); - public abstract short getBlockMode(); - public abstract void setBlockMode(short mode); - public abstract short getPaddingAlgorithm(); - - public abstract short getCipherAlgorithm(); - public abstract void setPaddingAlgorithm(short alg); public abstract void setCipherAlgorithm(short alg); - public abstract short getCipherProvider(); - public abstract short getAesGcmOutputSize(short len, short macLength); } diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMEcdsa256NoDigestSignature.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMEcdsa256NoDigestSignature.java index 904353b1..56eaba5a 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMEcdsa256NoDigestSignature.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMEcdsa256NoDigestSignature.java @@ -85,18 +85,12 @@ public KMEcdsa256NoDigestSignature(byte mode, byte[] key, short keyStart, short ECPublicKey pubkey = (ECPublicKey) kf.generatePublic(pubkeyspec); sunSigner.initVerify(pubkey); } - } catch (NoSuchAlgorithmException e) { + } catch (NoSuchAlgorithmException | NoSuchProviderException e) { CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); - } catch (NoSuchProviderException e) { - CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); - } catch(InvalidParameterSpecException e) { - CryptoException.throwIt(CryptoException.INVALID_INIT); - } catch(InvalidKeySpecException e) { - CryptoException.throwIt(CryptoException.INVALID_INIT); - } catch(InvalidKeyException e) { + } catch(InvalidParameterSpecException | InvalidKeySpecException | InvalidKeyException e) { CryptoException.throwIt(CryptoException.INVALID_INIT); } - } + } @Override public void init(Key key, byte b) throws CryptoException { diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java index 0dad8f77..7e2f0760 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java @@ -73,9 +73,6 @@ public class KMJCardSimulator implements KMSEProvider { public static final byte[] aesICV = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; private static final short CERT_CHAIN_MAX_SIZE = 2500;//First 2 bytes for length. private static final short RSA_KEY_SIZE = 256; - - - public static boolean jcardSim = false; private static Signature kdf; private static Signature hmacSignature; @@ -117,13 +114,11 @@ public KMJCardSimulator() { jCardSimulator = this; } - public KeyPair createRsaKeyPair() { KeyPair rsaKeyPair = new KeyPair(KeyPair.ALG_RSA, KeyBuilder.LENGTH_RSA_2048); rsaKeyPair.genKeyPair(); return rsaKeyPair; } - public RSAPrivateKey createRsaKey(byte[] modBuffer, short modOff, short modLength, byte[] privBuffer, short privOff, short privLength) { @@ -132,16 +127,13 @@ public RSAPrivateKey createRsaKey(byte[] modBuffer, short modOff, short modLengt privKey.setExponent(privBuffer, privOff, privLength); privKey.setModulus(modBuffer, modOff, modLength); return privKey; - } - public KeyPair createECKeyPair() { KeyPair ecKeyPair = new KeyPair(KeyPair.ALG_EC_FP, KeyBuilder.LENGTH_EC_FP_256); ecKeyPair.genKeyPair(); return ecKeyPair; } - public ECPrivateKey createEcKey(byte[] privBuffer, short privOff, short privLength) { KeyPair ecKeyPair = new KeyPair(KeyPair.ALG_EC_FP, KeyBuilder.LENGTH_EC_FP_256); @@ -149,7 +141,6 @@ public ECPrivateKey createEcKey(byte[] privBuffer, short privOff, short privLeng privKey.setS(privBuffer,privOff, privLength); return privKey; } - public AESKey createAESKey(short keysize) { byte[] rndNum = new byte[(short) (keysize/8)]; @@ -169,13 +160,11 @@ public AESKey createAESKey(byte[] buf, short startOff, short length) { return key; } - public DESKey createTDESKey() { byte[] rndNum = new byte[24]; newRandomNumber(rndNum, (short) 0, (short)rndNum.length); return createTDESKey(rndNum, (short)0, (short)rndNum.length); } - public DESKey createTDESKey(byte[] secretBuffer, short secretOff, short secretLength) { DESKey triDesKey = @@ -183,7 +172,6 @@ public DESKey createTDESKey(byte[] secretBuffer, short secretOff, short secretLe triDesKey.setKey(secretBuffer, secretOff); return triDesKey; } - public HMACKey createHMACKey(short keysize) { if((keysize % 8 != 0) || !(keysize >= 64 && keysize <= 512)){ @@ -260,13 +248,13 @@ public void createAsymmetricKey(byte alg, byte[] privKeyBuf, short privKeyStart, public boolean importSymmetricKey(byte alg, short keysize, byte[] buf, short startOff, short length) { switch(alg){ case KMType.AES: - AESKey aesKey = createAESKey(buf,startOff,length); + createAESKey(buf,startOff,length); break; case KMType.DES: - DESKey desKey = createTDESKey(buf,startOff,length); + createTDESKey(buf,startOff,length); break; case KMType.HMAC: - HMACKey hmacKey = createHMACKey(buf,startOff,length); + createHMACKey(buf,startOff,length); break; default: CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); @@ -279,10 +267,10 @@ public boolean importSymmetricKey(byte alg, short keysize, byte[] buf, short sta public boolean importAsymmetricKey(byte alg, byte[] privKeyBuf, short privKeyStart, short privKeyLength, byte[] pubModBuf, short pubModStart, short pubModLength) { switch (alg){ case KMType.RSA: - RSAPrivateKey rsaKey = createRsaKey(pubModBuf,pubModStart,pubModLength,privKeyBuf,privKeyStart,privKeyLength); + createRsaKey(pubModBuf,pubModStart,pubModLength,privKeyBuf,privKeyStart,privKeyLength); break; case KMType.EC: - ECPrivateKey ecPrivKey = createEcKey(privKeyBuf,privKeyStart,privKeyLength); + createEcKey(privKeyBuf,privKeyStart,privKeyLength); break; default: CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); @@ -364,13 +352,7 @@ public short aesGCMEncrypt( byte[] outputBuf = new byte[cipher.getOutputSize(secretLen)]; try { len = (short)(cipher.doFinal(secret,secretStart,secretLen,outputBuf,(short)0)); - } catch (ShortBufferException e) { - e.printStackTrace(); - CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); - } catch (IllegalBlockSizeException e) { - e.printStackTrace(); - CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); - } catch (BadPaddingException e) { + } catch (ShortBufferException | IllegalBlockSizeException | BadPaddingException e) { e.printStackTrace(); CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); } @@ -458,13 +440,7 @@ public boolean aesGCMDecrypt( } catch (AEADBadTagException e) { e.printStackTrace(); return false; - } catch (ShortBufferException e) { - e.printStackTrace(); - CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); - } catch (IllegalBlockSizeException e) { - e.printStackTrace(); - CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); - } catch (BadPaddingException e) { + } catch (ShortBufferException | IllegalBlockSizeException | BadPaddingException e) { e.printStackTrace(); CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); } @@ -687,19 +663,10 @@ private KMCipher createRsaOAEP256Cipher(byte mode,byte digest, } catch (NoSuchAlgorithmException e) { e.printStackTrace(); CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); - } catch (InvalidKeySpecException e) { + } catch (InvalidKeySpecException | InvalidAlgorithmParameterException | NoSuchPaddingException e) { e.printStackTrace(); CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); - } catch (InvalidKeyException e) { - e.printStackTrace(); - CryptoException.throwIt(CryptoException.INVALID_INIT); - } catch (InvalidAlgorithmParameterException e) { - e.printStackTrace(); - CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); - } catch (NoSuchPaddingException e) { - e.printStackTrace(); - CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); - } catch (NoSuchProviderException e) { + } catch (InvalidKeyException | NoSuchProviderException e) { e.printStackTrace(); CryptoException.throwIt(CryptoException.INVALID_INIT); } @@ -763,13 +730,7 @@ public Signature createEcSigner(short digest, byte[] secret, short secretStart, return ecSigner; } - - public KMCipher createSymmetricCipher( - short cipherAlg, short mode, short blockMode, short padding, byte[] secret, short secretStart, short secretLength) { - return createSymmetricCipher(cipherAlg, mode, blockMode, padding, secret,secretStart,secretLength,null,(short)0,(short)0); - } - public KMCipher createSymmetricCipher(short alg, short purpose, short blockMode, short padding, byte[] secret, short secretStart, short secretLength, byte[] ivBuffer, short ivStart, short ivLength) { @@ -949,7 +910,6 @@ private KMCipher createAesCtrCipherNoPad(short mode, byte[] secret, short secret return ret; } - public Signature createHmacSignerVerifier(short purpose, short digest, byte[] secret, short secretStart, short secretLength) { short alg = Signature.ALG_HMAC_SHA_256; if(digest != KMType.SHA2_256) CryptoException.throwIt(CryptoException.ILLEGAL_VALUE); @@ -959,7 +919,6 @@ public Signature createHmacSignerVerifier(short purpose, short digest, byte[] se hmacSignerVerifier.init(key,(byte)purpose); return hmacSignerVerifier; } - public KMCipher createAesGcmCipher(short mode, short tagLen, byte[] secret, short secretStart, short secretLength, byte[] ivBuffer, short ivStart, short ivLength) { @@ -1215,7 +1174,7 @@ public KMMasterKey createMasterKey(short keySizeBits) { getTrueRandomNumber(keyData, (short) 0, keyLen); masterKey.setKey(keyData, (short) 0); } - return (KMMasterKey) masterKey; + return masterKey; } @Override @@ -1227,7 +1186,7 @@ public KMAttestationKey createAttestationKey(byte[] keyData, short offset, attestationKey = new KMECPrivateKey(ecKeyPair); } attestationKey.setS(keyData, offset, length); - return (KMAttestationKey) attestationKey; + return attestationKey; } @Override @@ -1242,7 +1201,7 @@ public KMPreSharedKey createPresharedKey(byte[] keyData, short offset, short len preSharedKey = new KMHmacKey(key); } preSharedKey.setKey(keyData, offset, length); - return (KMPreSharedKey) preSharedKey; + return preSharedKey; } @Override diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMRsa2048NoDigestSignature.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMRsa2048NoDigestSignature.java index fc953d73..de97d02c 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMRsa2048NoDigestSignature.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMRsa2048NoDigestSignature.java @@ -121,7 +121,7 @@ private boolean isValidData(byte[] buf, short start, short len) { if (padding == KMType.PADDING_NONE) { if (len > 256) return false; else if (len == 256) { - short v = KMUtils.unsignedByteArrayCompare(buf, start, rsaModulus, (short) 0, len); + short v = KMInteger.unsignedByteArrayCompare(buf, start, rsaModulus, (short) 0, len); if (v > 0) return false; } } else {//pkcs1 no digest diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMUtils.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMUtils.java index 65e83415..c494bb34 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMUtils.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMUtils.java @@ -52,7 +52,6 @@ public class KMUtils { public static final short year2051 = 2051; public static final short year2020 = 2020; - // -------------------------------------- public static short convertToDate(short time, byte[] scratchPad, boolean utcFlag) { @@ -70,17 +69,17 @@ public static short convertToDate(short time, byte[] scratchPad, (short) (8 - KMInteger.cast(time).length()), KMInteger.cast(time) .length()); // If the time is less then 1 Jan 2020 then it is an error - if (unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2020, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2020, (short) 0, (short) 8) < 0) { KMException.throwIt(KMError.INVALID_ARGUMENT); } if (utcFlag - && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, + && KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0, (short) 8) >= 0) { KMException.throwIt(KMError.INVALID_ARGUMENT); } - if (unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 0, (short) 8) < 0) { Util.arrayCopyNonAtomic(firstJan2020, (short) 0, scratchPad, (short) 8, (short) 8); @@ -96,7 +95,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 8); } // divide the given time with four yrs msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, fourYrsMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, fourYrsMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(fourYrsMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -116,9 +115,9 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, // if leap year index is 0, then the number of days for the 1st year will be 366 days. // if leap year index is not 0, then the number of days for the 1st year will be 365 days. if (((leapYrIdx == 0) && - (unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, (short) 0,(short) 8) >= 0)) || + (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, (short) 0,(short) 8) >= 0)) || ((leapYrIdx != 0) && - (unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, (short) 0,(short) 8) >= 0))) { + (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, (short) 0,(short) 8) >= 0))) { for (short i = 0; i < 4; i++) { yrsCount++; if (i == leapYrIdx) { @@ -132,12 +131,12 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, Util.arrayCopyNonAtomic(scratchPad, (short) 16, scratchPad, (short) 0, (short) 8); if (((short) (i + 1) == leapYrIdx)) { - if (unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, leapYearMsec, (short) 0, (short) 8) < 0) { break; } } else { - if (unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, yearMsec, (short) 0, (short) 8) < 0) { break; } @@ -152,7 +151,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, yrsCount = (short) (year2051 + yrsCount); // divide the given time with one month msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneMonthMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneMonthMsec, (short) 0, (short) 8) >= 0) { for (short i = 0; i < 12; i++) { if (i == 1) { @@ -175,7 +174,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, (short) 8, (short) 8); } - if (unsignedByteArrayCompare(scratchPad, (short) 0, scratchPad, (short) 8, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, scratchPad, (short) 8, (short) 8) >= 0) { subtract(scratchPad, (short) 0, (short) 8, (short) 16); Util.arrayCopyNonAtomic(scratchPad, (short) 16, scratchPad, (short) 0, @@ -188,7 +187,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one day msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneDayMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneDayMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneDayMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -199,7 +198,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one hour msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneHourMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneHourMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneHourMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -209,7 +208,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one minute msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneMinMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneMinMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneMinMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -219,7 +218,7 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, } // divide the given time with one second msec count - if (unsignedByteArrayCompare(scratchPad, (short) 0, oneSecMsec, (short) 0, + if (KMInteger.unsignedByteArrayCompare(scratchPad, (short) 0, oneSecMsec, (short) 0, (short) 8) >= 0) { Util.arrayCopyNonAtomic(oneSecMsec, (short) 0, scratchPad, (short) 8, (short) 8); @@ -244,25 +243,6 @@ && unsignedByteArrayCompare(scratchPad, (short) 0, firstJan2051, return KMByteBlob.instance(scratchPad, (short) 0, len); // YYYY } - public static byte unsignedByteArrayCompare(byte[] a1, short offset1, byte[] a2, short offset2, short length) { - byte count = (byte) 0; - short val1 = (short)0; - short val2 = (short)0; - - for (; count < length; count++) { - val1 = (short) (a1[(short) (count + offset1)] & 0x00FF); - val2 = (short) (a2[(short) (count + offset2)] & 0x00FF); - - if (val1 < val2) { - return -1; - } - if (val1 > val2) { - return 1; - } - } - return 0; - } - public static short numberToString(short number, byte[] scratchPad, short offset) { byte zero = 0x30; @@ -311,7 +291,7 @@ public static void copy(byte[] buf, short from, short to) { } public static byte compare(byte[] buf, short lhs, short rhs) { - return unsignedByteArrayCompare(buf, lhs, buf, rhs, (short) 8); + return KMInteger.unsignedByteArrayCompare(buf, lhs, buf, rhs, (short) 8); } public static void shiftLeft(byte[] buf, short start) { diff --git a/Applet/src/com/android/javacard/keymaster/KMByteBlob.java b/Applet/src/com/android/javacard/keymaster/KMByteBlob.java index 28b916db..eb065e10 100644 --- a/Applet/src/com/android/javacard/keymaster/KMByteBlob.java +++ b/Applet/src/com/android/javacard/keymaster/KMByteBlob.java @@ -115,10 +115,4 @@ public boolean isValid() { } return true; } - - public void decrementLength(short len) { - short length = Util.getShort(heap, (short) (instPtr + 1)); - length = (short) (length - len); - Util.setShort(heap, (short) (instPtr + 1), length); - } } diff --git a/Applet/src/com/android/javacard/keymaster/KMEncoder.java b/Applet/src/com/android/javacard/keymaster/KMEncoder.java index 685ba468..b4055f04 100644 --- a/Applet/src/com/android/javacard/keymaster/KMEncoder.java +++ b/Applet/src/com/android/javacard/keymaster/KMEncoder.java @@ -38,7 +38,6 @@ public class KMEncoder { private static final byte UINT64_LENGTH = (byte) 0x1B; private static final short TINY_PAYLOAD = 0x17; private static final short SHORT_PAYLOAD = 0x100; - //TODO make this static. private byte[] buffer; private short startOff; private short length; @@ -73,7 +72,6 @@ public short encode(short object, byte[] buffer, short startOff) { }else{ this.length = (short)buffer.length; } - //this.length = (short)(startOff + length); push(object); encode(); return (short)(this.startOff - startOff); diff --git a/Applet/src/com/android/javacard/keymaster/KMEnumArrayTag.java b/Applet/src/com/android/javacard/keymaster/KMEnumArrayTag.java index 37e23286..98ec05f7 100644 --- a/Applet/src/com/android/javacard/keymaster/KMEnumArrayTag.java +++ b/Applet/src/com/android/javacard/keymaster/KMEnumArrayTag.java @@ -279,12 +279,4 @@ public boolean isValidPurpose(byte alg) { } return true; } - - public boolean isValidBlockMode(byte alg) { - if (alg == KMType.AES || alg == KMType.DES) { - return true; - } else { - return false; - } - } } diff --git a/Applet/src/com/android/javacard/keymaster/KMError.java b/Applet/src/com/android/javacard/keymaster/KMError.java index 83eb8c7c..0a52da0a 100644 --- a/Applet/src/com/android/javacard/keymaster/KMError.java +++ b/Applet/src/com/android/javacard/keymaster/KMError.java @@ -21,82 +21,61 @@ */ public class KMError { public static final short OK = 0; - public static final short ROOT_OF_TRUST_ALREADY_SET = 1; + public static final short UNSUPPORTED_PURPOSE = 2; public static final short INCOMPATIBLE_PURPOSE = 3; public static final short UNSUPPORTED_ALGORITHM = 4; public static final short INCOMPATIBLE_ALGORITHM = 5; public static final short UNSUPPORTED_KEY_SIZE = 6; - public static final short UNSUPPORTED_BLOCK_MODE = 7; + public static final short INCOMPATIBLE_BLOCK_MODE = 8; public static final short UNSUPPORTED_MAC_LENGTH = 9; public static final short UNSUPPORTED_PADDING_MODE = 10; public static final short INCOMPATIBLE_PADDING_MODE = 11; public static final short UNSUPPORTED_DIGEST = 12; public static final short INCOMPATIBLE_DIGEST = 13; - public static final short INVALID_EXPIRATION_TIME = 14; - public static final short INVALID_USER_ID = 15; - public static final short INVALID_AUTHORIZATION_TIMEOUT = 16; - public static final short UNSUPPORTED_KEY_FORMAT = 17; - public static final short INCOMPATIBLE_KEY_FORMAT = 18; + public static final short UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = 19; - /** For PKCS8 & PKCS12 */ - public static final short UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = 20; - /** For PKCS8 & PKCS12 */ + + /** For PKCS8 & PKCS12 */ public static final short INVALID_INPUT_LENGTH = 21; - public static final short KEY_EXPORT_OPTIONS_INVALID = 22; - public static final short DELEGATION_NOT_ALLOWED = 23; - public static final short KEY_NOT_YET_VALID = 24; - public static final short KEY_EXPIRED = 25; + public static final short KEY_USER_NOT_AUTHENTICATED = 26; - public static final short OUTPUT_PARAMETER_NULL = 27; + public static final short INVALID_OPERATION_HANDLE = 28; - public static final short INSUFFICIENT_BUFFER_SPACE = 29; + public static final short VERIFICATION_FAILED = 30; public static final short TOO_MANY_OPERATIONS = 31; - public static final short UNEXPECTED_NULL_POINTER = 32; public static final short INVALID_KEY_BLOB = 33; - public static final short IMPORTED_KEY_NOT_ENCRYPTED = 34; - public static final short IMPORTED_KEY_DECRYPTION_FAILED = 35; - public static final short IMPORTED_KEY_NOT_SIGNED = 36; - public static final short IMPORTED_KEY_VERIFICATION_FAILED = 37; + public static final short INVALID_ARGUMENT = 38; public static final short UNSUPPORTED_TAG = 39; public static final short INVALID_TAG = 40; - public static final short MEMORY_ALLOCATION_FAILED = 41; + public static final short IMPORT_PARAMETER_MISMATCH = 44; - public static final short SECURE_HW_ACCESS_DENIED = 45; public static final short OPERATION_CANCELLED = 46; - public static final short CONCURRENT_ACCESS_CONFLICT = 47; - public static final short SECURE_HW_BUSY = 48; - public static final short SECURE_HW_COMMUNICATION_FAILED = 49; - public static final short UNSUPPORTED_EC_FIELD = 50; + public static final short MISSING_NONCE = 51; public static final short INVALID_NONCE = 52; public static final short MISSING_MAC_LENGTH = 53; - public static final short KEY_RATE_LIMIT_EXCEEDED = 54; + public static final short CALLER_NONCE_PROHIBITED = 55; - public static final short KEY_MAX_OPS_EXCEEDED = 56; + public static final short INVALID_MAC_LENGTH = 57; public static final short MISSING_MIN_MAC_LENGTH = 58; public static final short UNSUPPORTED_MIN_MAC_LENGTH = 59; - public static final short UNSUPPORTED_KDF = 60; + public static final short UNSUPPORTED_EC_CURVE = 61; public static final short KEY_REQUIRES_UPGRADE = 62; - public static final short ATTESTATION_CHALLENGE_MISSING = 63; - public static final short KEYMASTER_NOT_CONFIGURED = 64; + public static final short ATTESTATION_APPLICATION_ID_MISSING = 65; - public static final short CANNOT_ATTEST_IDS = 66; public static final short ROLLBACK_RESISTANCE_UNAVAILABLE = 67; - public static final short HARDWARE_TYPE_UNAVAILABLE = 68; - public static final short PROOF_OF_PRESENCE_REQUIRED = 69; - public static final short CONCURRENT_PROOF_OF_PRESENCE_REQUESTED = 70; - public static final short NO_USER_CONFIRMATION = 71; + public static final short DEVICE_LOCKED = 72; public static final short EARLY_BOOT_ENDED = 73; + public static final short UNIMPLEMENTED = 100; - public static final short VERSION_MISMATCH = 101; public static final short UNKNOWN_ERROR = 1000; //Extended errors diff --git a/Applet/src/com/android/javacard/keymaster/KMInteger.java b/Applet/src/com/android/javacard/keymaster/KMInteger.java index 18944e4d..44a0779a 100644 --- a/Applet/src/com/android/javacard/keymaster/KMInteger.java +++ b/Applet/src/com/android/javacard/keymaster/KMInteger.java @@ -162,10 +162,30 @@ public static short compare(short num1, short num2){ KMInteger.cast(num1).getValue(repository.getHeap(),(short)(num1Buf+(short)(8-len)),len); len = KMInteger.cast(num2).length(); KMInteger.cast(num2).getValue(repository.getHeap(),(short)(num2Buf+(short)(8-len)),len); - return KMUtils.unsignedByteArrayCompare( + return KMInteger.unsignedByteArrayCompare( repository.getHeap(), num1Buf, repository.getHeap(), num2Buf, (short)8); } + + public static byte unsignedByteArrayCompare(byte[] a1, short offset1, byte[] a2, short offset2, short length) { + byte count = (byte) 0; + short val1 = (short)0; + short val2 = (short)0; + + for (; count < length; count++) { + val1 = (short) (a1[(short) (count + offset1)] & 0x00FF); + val2 = (short) (a2[(short) (count + offset2)] & 0x00FF); + + if (val1 < val2) { + return -1; + } + if (val1 > val2) { + return 1; + } + } + return 0; + } + } diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index e1e8214d..3942a891 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -3481,7 +3481,7 @@ private void checkVersionAndPatchLevel(byte[] scratchPad) { if (tmpVariables[0] != KMType.INVALID_VALUE) { tmpVariables[1] = repository.getOsVersion(); tmpVariables[1] = - KMUtils.unsignedByteArrayCompare( + KMInteger.unsignedByteArrayCompare( KMInteger.cast(tmpVariables[1]).getBuffer(), KMInteger.cast(tmpVariables[1]).getStartOff(), scratchPad, @@ -3500,7 +3500,7 @@ private void checkVersionAndPatchLevel(byte[] scratchPad) { if (tmpVariables[0] != KMType.INVALID_VALUE) { tmpVariables[1] = repository.getOsPatch(); tmpVariables[1] = - KMUtils.unsignedByteArrayCompare( + KMInteger.unsignedByteArrayCompare( KMInteger.cast(tmpVariables[1]).getBuffer(), KMInteger.cast(tmpVariables[1]).getStartOff(), scratchPad, diff --git a/Applet/src/com/android/javacard/keymaster/KMOperationState.java b/Applet/src/com/android/javacard/keymaster/KMOperationState.java index 6ea96941..6d033443 100644 --- a/Applet/src/com/android/javacard/keymaster/KMOperationState.java +++ b/Applet/src/com/android/javacard/keymaster/KMOperationState.java @@ -41,7 +41,7 @@ public class KMOperationState { // short type private static final byte KEY_SIZE = 6; private static final byte MAC_LENGTH = 8; - // Handle - currently this is short + private static final byte OP_HANDLE = 10; // Auth time 64 bits private static final byte AUTH_TIME = 12; diff --git a/Applet/src/com/android/javacard/keymaster/KMSEProvider.java b/Applet/src/com/android/javacard/keymaster/KMSEProvider.java index a057eb9e..0719d04b 100644 --- a/Applet/src/com/android/javacard/keymaster/KMSEProvider.java +++ b/Applet/src/com/android/javacard/keymaster/KMSEProvider.java @@ -220,7 +220,7 @@ boolean aesGCMDecrypt( * This is a oneshot operation that performs key derivation function using cmac kdf (CKDF) as * defined in android keymaster hal definition. * - * @param instance of pre-shared key. + * @param hmacKey instance of pre-shared key. * @param label is the label to be used for ckdf. * @param labelStart is the start of label. * @param labelLen is the length of the label. @@ -269,7 +269,7 @@ short hmacSign( * This is a oneshot operation that signs the data using hmac algorithm. * This is used to derive the key, which is used to encrypt the keyblob. * - * @param instance of masterkey. + * @param masterkey instance of masterkey. * @param data is the buffer containing data to be signed. * @param dataStart is the start of the data. * @param dataLength is the length of the data. @@ -344,7 +344,7 @@ short rsaDecipherOAEP256( /** * This is a oneshot operation that signs the data using EC private key. * - * @param instance of KMAttestationKey. + * @param ecPrivKey instance of KMAttestationKey. * @param inputDataBuf is the buffer of the input data. * @param inputDataStart is the start of the input data buffer. * @param inputDataLength is the length of the inpur data buffer in bytes. diff --git a/Applet/src/com/android/javacard/keymaster/KMType.java b/Applet/src/com/android/javacard/keymaster/KMType.java index 4d81de45..53442440 100644 --- a/Applet/src/com/android/javacard/keymaster/KMType.java +++ b/Applet/src/com/android/javacard/keymaster/KMType.java @@ -41,7 +41,6 @@ public abstract class KMType { public static final byte HW_AUTH_TOKEN_TYPE = 0x08; public static final byte VERIFICATION_TOKEN_TYPE = 0x09; public static final byte HMAC_SHARING_PARAM_TYPE = 0x0A; - public static final byte X509_CERT = 0x0B; // Tag Types public static final short INVALID_TAG = 0x0000; public static final short ENUM_TAG = 0x1000; @@ -51,7 +50,6 @@ public abstract class KMType { public static final short ULONG_TAG = 0x5000; public static final short DATE_TAG = 0x6000; public static final short BOOL_TAG = 0x7000; - public static final short BIGNUM_TAG = (short) 0x8000; public static final short BYTES_TAG = (short) 0x9000; public static final short ULONG_ARRAY_TAG = (short) 0xA000; public static final short TAG_TYPE_MASK = (short) 0xF000; @@ -271,7 +269,6 @@ public abstract class KMType { // Confirmation Token public static final short CONFIRMATION_TOKEN = (short) 0x03ED; - public static final short LENGTH_FROM_PDU = (short) 0xFFFF; public static final byte NO_VALUE = (byte) 0xff;