From 4876c9a495def8cf4a84df713ed51efc4d602976 Mon Sep 17 00:00:00 2001 From: "avinash.hedage" Date: Wed, 20 Jul 2022 09:24:00 +0000 Subject: [PATCH 1/5] updated provision status condition for INS_OEM_LOCK_PROVISIONING_CMD command --- .../javacard/keymaster/KMAndroidSEApplet.java | 2 +- .../javacard/keymaster/KMJCardSimApplet.java | 2 +- .../javacard/seprovider/KMJCardSimulator.java | 52 +++++++++---------- 3 files changed, 27 insertions(+), 29 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index 99ca1ffd..c58cfb5c 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -563,7 +563,7 @@ private void processSetBootParamsCmd(APDU apdu) { private boolean isProvisioningComplete() { short pStatus = kmDataStore.getProvisionStatus(); short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN | - PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS; + PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY; if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) { return true; } diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index cd665ef3..6dad0438 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -551,7 +551,7 @@ private void processSetBootParamsCmd(APDU apdu) { private boolean isProvisioningComplete() { short pStatus = kmDataStore.getProvisionStatus(); short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN | - PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS; + PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY; if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) { return true; } diff --git a/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java b/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java index 7f423f00..4797046f 100644 --- a/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java +++ b/Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java @@ -1488,43 +1488,41 @@ public com.android.javacard.seprovider.KMPreSharedKey createPreSharedKey( } -@Override -public KMOperation getRkpOperation(byte purpose, byte alg, + @Override + public KMOperation getRkpOperation(byte purpose, byte alg, byte digest, byte padding, byte blockMode, byte[] keyBuf, short keyStart, short keyLength, byte[] ivBuf, short ivStart, short ivLength, short macLength) { KMOperation opr = null; switch (alg) { - case KMType.AES: - KMCipher aesGcm = createAesGcmCipher(purpose, macLength, keyBuf, keyStart, keyLength, + case KMType.AES: + KMCipher aesGcm = createAesGcmCipher(purpose, macLength, keyBuf, keyStart, keyLength, ivBuf, ivStart, ivLength); - opr = new KMOperationImpl(aesGcm); - break; - case KMType.HMAC: - Signature signerVerifier = createHmacSignerVerifier(purpose, digest, keyBuf, keyStart, + opr = new KMOperationImpl(aesGcm); + break; + case KMType.HMAC: + Signature signerVerifier = createHmacSignerVerifier(purpose, digest, keyBuf, keyStart, keyLength); - opr = new KMOperationImpl(signerVerifier); - break; - default: - CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); - break; + opr = new KMOperationImpl(signerVerifier); + break; + default: + CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM); + break; } return opr; -} + } -@Override -public boolean isBootSignalEventSupported() { - return false; -} + @Override + public boolean isBootSignalEventSupported() { + return false; + } -@Override -public boolean isDeviceRebooted() { - return false; -} + @Override + public boolean isDeviceRebooted() { + return false; + } -@Override -public void clearDeviceBooted(boolean resetBootFlag) { - // TODO Auto-generated method stub - -} + @Override + public void clearDeviceBooted(boolean resetBootFlag) { + } } From 26eefc06766e1ff2baa717833755a26f76357448 Mon Sep 17 00:00:00 2001 From: avinashhedage Date: Fri, 29 Jul 2022 11:25:09 +0000 Subject: [PATCH 2/5] updated keymint provision instruction set to allign with keymaster instruction set --- .../javacard/keymaster/KMAndroidSEApplet.java | 20 ++++++++--------- .../javacard/keymaster/KMJCardSimApplet.java | 20 ++++++++--------- ProvisioningTool/include/constants.h | 22 ++++++++++--------- 3 files changed, 30 insertions(+), 32 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index c58cfb5c..ce374539 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -43,21 +43,19 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis // Provider specific Commands private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00; - private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1; + private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; private static final byte INS_PROVISION_PRESHARED_SECRET_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 2; - private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; - private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4; + INS_KEYMINT_PROVIDER_APDU_START + 4; private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; + private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; + private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; + private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 6; + INS_KEYMINT_PROVIDER_APDU_START + 13; private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 7; - private static final byte INS_SET_BOOT_ENDED_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 8; //unused - private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9; - private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; - private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + INS_KEYMINT_PROVIDER_APDU_START + 14; private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F; public static final byte BOOT_KEY_MAX_SIZE = 32; diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index 6dad0438..a3302a29 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -32,21 +32,19 @@ public class KMJCardSimApplet extends KMKeymasterApplet { // Provider specific Commands private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00; - private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1; + private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; private static final byte INS_PROVISION_PRESHARED_SECRET_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 2; - private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3; - private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4; + INS_KEYMINT_PROVIDER_APDU_START + 4; private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; + private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; + private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; + private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 6; + INS_KEYMINT_PROVIDER_APDU_START + 13; private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 7; - private static final byte INS_SET_BOOT_ENDED_CMD = - INS_KEYMINT_PROVIDER_APDU_START + 8; //unused - private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9; - private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; - private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; + INS_KEYMINT_PROVIDER_APDU_START + 14; private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F; public static final byte BOOT_KEY_MAX_SIZE = 32; diff --git a/ProvisioningTool/include/constants.h b/ProvisioningTool/include/constants.h index 62c2efcc..89d7413a 100644 --- a/ProvisioningTool/include/constants.h +++ b/ProvisioningTool/include/constants.h @@ -101,14 +101,16 @@ constexpr char kSeFactoryProvisionLock[] = "se_factory_lock"; constexpr char kUnLockProvision[] = "unlock_provision"; // Instruction constatnts -// TODO Modify according to keymint -constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 1; -constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 2; -constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 3; -constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 4; +constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 3; +constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 4; constexpr int kBootParamsCmd = INS_BEGIN_KM_CMD + 5; -constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 6; -constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 7; -constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 9; -constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 10; -constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 11; +constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 6; +constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 7; +constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 10; +constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 11; +constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 12; +constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 13; +constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 14; + + + From 0ea596448dda636089f0965bb4e8d2e081011882 Mon Sep 17 00:00:00 2001 From: avinashhedage Date: Mon, 1 Aug 2022 07:03:46 +0000 Subject: [PATCH 3/5] updated instruction command set values --- .../javacard/keymaster/KMAndroidSEApplet.java | 2 ++ .../javacard/keymaster/KMJCardSimApplet.java | 2 ++ .../javacard/keymaster/KMKeymasterApplet.java | 23 +++++++++++-------- HAL/JavacardSecureElement.h | 20 ++++++++-------- 4 files changed, 28 insertions(+), 19 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index ce374539..647b3ed8 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -49,6 +49,8 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index a3302a29..a5669816 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -38,6 +38,8 @@ public class KMJCardSimApplet extends KMKeymasterApplet { private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; + //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12; diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index 6682788c..eab1e7ec 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -141,6 +141,10 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe // Maximum allowed buffer size for to encode the key parameters // which is used while creating mac for key paramters. public static final short MAX_KEY_PARAMS_BUF_SIZE = (short) 3072; // 3K + + // Aligned INS_INIT_STRONGBOX_CMD value with INS_SET_VERSION_PATCHLEVEL_CMD value in Keymaster instruction set + private static final byte INS_INIT_STRONGBOX_CMD = 0x08; + // Top 32 commands are reserved for provisioning. private static final byte KEYMINT_CMD_APDU_START = 0x20; @@ -169,17 +173,16 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe private static final byte INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23; //0x37 private static final byte INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24; //0x38 private static final byte INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25; //0x39 - private static final byte INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26; //0x3A // RKP - public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27; //0x3B - public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C - public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D - public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E - public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F - public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 - public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 - public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34; //0x42 - private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 35; //0x43 + public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26; //0x3A + public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27; //0x3B + public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C + public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D + public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E + public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F + public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 + public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 + private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 34; //0x42 private static final byte INS_END_KM_CMD = 0x7F; // Data Dictionary items diff --git a/HAL/JavacardSecureElement.h b/HAL/JavacardSecureElement.h index 20a3b964..c04dfe6b 100644 --- a/HAL/JavacardSecureElement.h +++ b/HAL/JavacardSecureElement.h @@ -35,6 +35,9 @@ using std::vector; enum class Instruction { // Keymaster commands + // Aligned INS_INIT_STRONGBOX_CMD value with Keymaster instruction set + INS_INIT_STRONGBOX_CMD = 0x08, + INS_GENERATE_KEY_CMD = KEYMINT_CMD_APDU_START + 1, INS_IMPORT_KEY_CMD = KEYMINT_CMD_APDU_START + 2, INS_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 3, @@ -60,16 +63,15 @@ enum class Instruction { INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23, INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24, INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25, - INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26, // RKP Commands - INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27, - INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28, - INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29, - INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30, - INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31, - INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32, - INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33, - INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34, + INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26, + INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27, + INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28, + INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29, + INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30, + INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31, + INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32, + INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33, }; class JavacardSecureElement { From c8a4898496f688e93d0b0b6669bd7c9502bc96b5 Mon Sep 17 00:00:00 2001 From: avinashhedage Date: Wed, 3 Aug 2022 09:43:12 +0000 Subject: [PATCH 4/5] Aligned keymint provision instruction commands with keymaster --- .../javacard/keymaster/KMAndroidSEApplet.java | 2 +- .../javacard/keymaster/KMJCardSimApplet.java | 2 +- .../javacard/keymaster/KMKeymasterApplet.java | 22 +++++++++---------- HAL/JavacardSecureElement.h | 20 ++++++++--------- 4 files changed, 21 insertions(+), 25 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index 647b3ed8..97b75ecc 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -49,7 +49,7 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; - //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x08 was reserved for INS_INIT_STRONGBOX_CMD //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java index a5669816..84c76f5b 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java @@ -38,7 +38,7 @@ public class KMJCardSimApplet extends KMKeymasterApplet { private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6; private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7; - //0x08 is reserved for INS_INIT_STRONGBOX_CMD + //0x08 was reserved for INS_INIT_STRONGBOX_CMD //0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now. private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10; private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11; diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index eab1e7ec..19eb1ab3 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -142,9 +142,6 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe // which is used while creating mac for key paramters. public static final short MAX_KEY_PARAMS_BUF_SIZE = (short) 3072; // 3K - // Aligned INS_INIT_STRONGBOX_CMD value with INS_SET_VERSION_PATCHLEVEL_CMD value in Keymaster instruction set - private static final byte INS_INIT_STRONGBOX_CMD = 0x08; - // Top 32 commands are reserved for provisioning. private static final byte KEYMINT_CMD_APDU_START = 0x20; @@ -173,16 +170,17 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe private static final byte INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23; //0x37 private static final byte INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24; //0x38 private static final byte INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25; //0x39 + private static final byte INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26; //0x3A // RKP - public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26; //0x3A - public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27; //0x3B - public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C - public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D - public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E - public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F - public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 - public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 - private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 34; //0x42 + public static final byte INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27; //0x3B + public static final byte INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28; //0x3C + public static final byte INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29; //0x3D + public static final byte INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30; //0x3E + public static final byte INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31; //0x3F + public static final byte INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32; //0x40 + public static final byte INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33; //0x41 + public static final byte INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34; //0x42 + private static final byte KEYMINT_CMD_APDU_END = KEYMINT_CMD_APDU_START + 35; //0x43 private static final byte INS_END_KM_CMD = 0x7F; // Data Dictionary items diff --git a/HAL/JavacardSecureElement.h b/HAL/JavacardSecureElement.h index c04dfe6b..12e86931 100644 --- a/HAL/JavacardSecureElement.h +++ b/HAL/JavacardSecureElement.h @@ -35,9 +35,6 @@ using std::vector; enum class Instruction { // Keymaster commands - // Aligned INS_INIT_STRONGBOX_CMD value with Keymaster instruction set - INS_INIT_STRONGBOX_CMD = 0x08, - INS_GENERATE_KEY_CMD = KEYMINT_CMD_APDU_START + 1, INS_IMPORT_KEY_CMD = KEYMINT_CMD_APDU_START + 2, INS_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 3, @@ -63,15 +60,16 @@ enum class Instruction { INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23, INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24, INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25, + INS_INIT_STRONGBOX_CMD = KEYMINT_CMD_APDU_START + 26, // RKP Commands - INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 26, - INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 27, - INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 28, - INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 29, - INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 30, - INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 31, - INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 32, - INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 33, + INS_GET_RKP_HARDWARE_INFO = KEYMINT_CMD_APDU_START + 27, + INS_GENERATE_RKP_KEY_CMD = KEYMINT_CMD_APDU_START + 28, + INS_BEGIN_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 29, + INS_UPDATE_KEY_CMD = KEYMINT_CMD_APDU_START + 30, + INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31, + INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32, + INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33, + INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34, }; class JavacardSecureElement { From 025beccbe5918375a79490e92dae799500583320 Mon Sep 17 00:00:00 2001 From: avinashhedage Date: Fri, 5 Aug 2022 10:06:05 +0000 Subject: [PATCH 5/5] In import key, handled RSA private key of size 257 bytes --- Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java b/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java index 9d801044..be6590e3 100644 --- a/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java +++ b/Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java @@ -168,20 +168,21 @@ public short decodeRsaPrivateKey(short version){ len = header(ASN1_INTEGER); short modulus = KMByteBlob.instance(len); getBytes(modulus); - updateModulus(modulus); + updateRsaKeyBuffer(modulus); len = header(ASN1_INTEGER); short pubKey = KMByteBlob.instance(len); getBytes(pubKey); len = header(ASN1_INTEGER); short privKey = KMByteBlob.instance(len); getBytes(privKey); + updateRsaKeyBuffer(privKey); KMArray.cast(resp).add((short)0, modulus); KMArray.cast(resp).add((short)1, pubKey); KMArray.cast(resp).add((short)2, privKey); return resp; } - private void updateModulus(short blob) { + private void updateRsaKeyBuffer(short blob) { byte[] buffer = KMByteBlob.cast(blob).getBuffer(); short startOff = KMByteBlob.cast(blob).getStartOff(); short len = KMByteBlob.cast(blob).length();