diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index 99ca1ffd..97b75ecc 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -43,21 +43,21 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis // Provider specific Commands private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00; - private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1; + private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; private static final byte INS_PROVISION_PRESHARED_SECRET_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 2; - private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; - private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4; + INS_KEYMINT_PROVIDER_APDU_START + 4; private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; + private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; + private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + //0x08 was reserved for INS_INIT_STRONGBOX_CMD + //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. + private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; + private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 6; + INS_KEYMINT_PROVIDER_APDU_START + 13; private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 7; - private static final byte INS_SET_BOOT_ENDED_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 8; //unused - private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9; - private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; - private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + INS_KEYMINT_PROVIDER_APDU_START + 14; private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F; public static final byte BOOT_KEY_MAX_SIZE = 32; @@ -563,7 +563,7 @@ private void processSetBootParamsCmd(APDU apdu) { private boolean isProvisioningComplete() { short pStatus = kmDataStore.getProvisionStatus(); short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN | - PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS; + PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY; if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) { return true; } diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index cd665ef3..84c76f5b 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -32,21 +32,21 @@ public class KMJCardSimApplet extends KMKeymasterApplet { // Provider specific Commands private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00; - private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1; + private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; private static final byte INS_PROVISION_PRESHARED_SECRET_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 2; - private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; - private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4; + INS_KEYMINT_PROVIDER_APDU_START + 4; private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; + private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; + private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + //0x08 was reserved for INS_INIT_STRONGBOX_CMD + //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. + private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; + private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 6; + INS_KEYMINT_PROVIDER_APDU_START + 13; private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 7; - private static final byte INS_SET_BOOT_ENDED_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 8; //unused - private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9; - private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; - private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + INS_KEYMINT_PROVIDER_APDU_START + 14; private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F; public static final byte BOOT_KEY_MAX_SIZE = 32; @@ -551,7 +551,7 @@ private void processSetBootParamsCmd(APDU apdu) { private boolean isProvisioningComplete() { short pStatus = kmDataStore.getProvisionStatus(); short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN | - PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS; + PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY; if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) { return true; } diff --git a/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java b/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java index 7f423f00..4797046f 100644 --- a/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java +++ b/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java @@ -1488,43 +1488,41 @@ public com.android.javacard.seprovider.KMPreSharedKey createPreSharedKey( } -@Override -public KMOperation getRkpOperation(byte purpose, byte alg, + @Override + public KMOperation getRkpOperation(byte purpose, byte alg, byte digest, byte padding, byte blockMode, byte[] keyBuf, short keyStart, short keyLength, byte[] ivBuf, short ivStart, short ivLength, short macLength) { KMOperation opr = null; switch (alg) { - case KMType.AES: - KMCipher aesGcm = createAesGcmCipher(purpose, macLength, keyBuf, keyStart, keyLength, + case KMType.AES: + KMCipher aesGcm = createAesGcmCipher(purpose, macLength, keyBuf, keyStart, keyLength, ivBuf, ivStart, ivLength); - opr = new KMOperationImpl(aesGcm); - break; - case KMType.HMAC: - Signature signerVerifier = createHmacSignerVerifier(purpose, digest, keyBuf, keyStart, + opr = new KMOperationImpl(aesGcm); + break; + case KMType.HMAC: + Signature signerVerifier = createHmacSignerVerifier(purpose, digest, keyBuf, keyStart, keyLength); - opr = new KMOperationImpl(signerVerifier); - break; - default: - CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); - break; + opr = new KMOperationImpl(signerVerifier); + break; + default: + CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); + break; } return opr; -} + } -@Override -public boolean isBootSignalEventSupported() { - return false; -} + @Override + public boolean isBootSignalEventSupported() { + return false; + } -@Override -public boolean isDeviceRebooted() { - return false; -} + @Override + public boolean isDeviceRebooted() { + return false; + } -@Override -public void clearDeviceBooted(boolean resetBootFlag) { - // TODO Auto-generated method stub - -} + @Override + public void clearDeviceBooted(boolean resetBootFlag) { + } } diff --git a/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java b/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java index 9d801044..be6590e3 100644 --- a/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java +++ b/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java @@ -168,20 +168,21 @@ public short decodeRsaPrivateKey(short version){ len = header(ASN1_INTEGER); short modulus = KMByteBlob.instance(len); getBytes(modulus); - updateModulus(modulus); + updateRsaKeyBuffer(modulus); len = header(ASN1_INTEGER); short pubKey = KMByteBlob.instance(len); getBytes(pubKey); len = header(ASN1_INTEGER); short privKey = KMByteBlob.instance(len); getBytes(privKey); + updateRsaKeyBuffer(privKey); KMArray.cast(resp).add((short)0, modulus); KMArray.cast(resp).add((short)1, pubKey); KMArray.cast(resp).add((short)2, privKey); return resp; } - private void updateModulus(short blob) { + private void updateRsaKeyBuffer(short blob) { byte[] buffer = KMByteBlob.cast(blob).getBuffer(); short startOff = KMByteBlob.cast(blob).getStartOff(); short len = KMByteBlob.cast(blob).length(); diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index 6682788c..19eb1ab3 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -141,6 +141,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe // Maximum allowed buffer size for to encode the key parameters // which is used while creating mac for key paramters. public static final short MAX_KEY_PARAMS_BUF_SIZE = (short) 3072; // 3K + // Top 32 commands are reserved for provisioning. private static final byte KEYMINT_CMD_APDU_START = 0x20; diff --git a/HAL/JavacardSecureElement.h b/HAL/JavacardSecureElement.h index 20a3b964..12e86931 100644 --- a/HAL/JavacardSecureElement.h +++ b/HAL/JavacardSecureElement.h @@ -69,7 +69,7 @@ enum class Instruction { INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31, INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32, INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33, - INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34, + INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34, }; class JavacardSecureElement { diff --git a/ProvisioningTool/include/constants.h b/ProvisioningTool/include/constants.h index 62c2efcc..89d7413a 100644 --- a/ProvisioningTool/include/constants.h +++ b/ProvisioningTool/include/constants.h @@ -101,14 +101,16 @@ constexpr char kSeFactoryProvisionLock[] = "se_factory_lock"; constexpr char kUnLockProvision[] = "unlock_provision"; // Instruction constatnts -// TODO Modify according to keymint -constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 1; -constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 2; -constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 3; -constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 4; +constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 3; +constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 4; constexpr int kBootParamsCmd = INS_BEGIN_KM_CMD + 5; -constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 6; -constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 7; -constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 9; -constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 10; -constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 11; +constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 6; +constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 7; +constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 10; +constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 11; +constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 12; +constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 13; +constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 14; + + +