Skip to content

Javacard key mint 100 master#103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
subrahmanyaman merged 9 commits into from
Aug 5, 2022
Merged

Javacard key mint 100 master #103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e82379c
Merge pull request #203 from subrahmanyaman/Javacard_KeyMint_100_master
mdwivedi Jul 18, 2022
4876c9a
updated provision status condition for INS_OEM_LOCK_PROVISIONING_CMD …
AvinashHedage Jul 20, 2022
e310bde
Merge pull request #205 from AvinashHedage/keymint_provision
mdwivedi Jul 22, 2022
26eefc0
updated keymint provision instruction set to allign with keymaster in…
Jul 29, 2022
0ea5964
updated instruction command set values
Aug 1, 2022
c8a4898
Aligned keymint provision instruction commands with keymaster
Aug 3, 2022
d501240
Merge pull request #208 from AvinashHedage/keymint_100_provision
mdwivedi Aug 3, 2022
025becc
In import key, handled RSA private key of size 257 bytes
Aug 5, 2022
29df04c
Merge pull request #210 from AvinashHedage/keymint_wycheproof_fix
mdwivedi Aug 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,21 +43,21 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis

// Provider specific Commands
private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_PROVISION_PRESHARED_SECRET_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 2;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4;
INS_KEYMINT_PROVIDER_APDU_START + 4;
private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7;
//0x08 was reserved for INS_INIT_STRONGBOX_CMD
//0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now.
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12;
private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 6;
INS_KEYMINT_PROVIDER_APDU_START + 13;
private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 7;
private static final byte INS_SET_BOOT_ENDED_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 8; //unused
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
INS_KEYMINT_PROVIDER_APDU_START + 14;

private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F;
public static final byte BOOT_KEY_MAX_SIZE = 32;
Expand DownExpand Up@@ -563,7 +563,7 @@ private void processSetBootParamsCmd(APDU apdu) {
private boolean isProvisioningComplete() {
short pStatus = kmDataStore.getProvisionStatus();
short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN |
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS;
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY;
if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) {
return true;
}
Expand Down
24 changes: 12 additions & 12 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -32,21 +32,21 @@ public class KMJCardSimApplet extends KMKeymasterApplet {

// Provider specific Commands
private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1;
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_PROVISION_PRESHARED_SECRET_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 2;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4;
INS_KEYMINT_PROVIDER_APDU_START + 4;
private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5;
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6;
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7;
//0x08 was reserved for INS_INIT_STRONGBOX_CMD
//0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now.
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12;
private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 6;
INS_KEYMINT_PROVIDER_APDU_START + 13;
private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 7;
private static final byte INS_SET_BOOT_ENDED_CMD =
INS_KEYMINT_PROVIDER_APDU_START + 8; //unused
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9;
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
INS_KEYMINT_PROVIDER_APDU_START + 14;

private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F;
public static final byte BOOT_KEY_MAX_SIZE = 32;
Expand DownExpand Up@@ -551,7 +551,7 @@ private void processSetBootParamsCmd(APDU apdu) {
private boolean isProvisioningComplete() {
short pStatus = kmDataStore.getProvisionStatus();
short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN |
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS;
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY;
if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) {
return true;
}
Expand Down
52 changes: 25 additions & 27 deletions Applet/JCardSimProviderLib/src/com/android/javacard/seprovider/KMJCardSimulator.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1488,43 +1488,41 @@ public com.android.javacard.seprovider.KMPreSharedKey createPreSharedKey(
}


@Override
public KMOperation getRkpOperation(byte purpose, byte alg,
@Override
public KMOperation getRkpOperation(byte purpose, byte alg,
byte digest, byte padding, byte blockMode, byte[] keyBuf, short keyStart,
short keyLength, byte[] ivBuf, short ivStart, short ivLength,
short macLength) {
KMOperation opr = null;
switch (alg) {
case KMType.AES:
KMCipher aesGcm = createAesGcmCipher(purpose, macLength, keyBuf, keyStart, keyLength,
case KMType.AES:
KMCipher aesGcm = createAesGcmCipher(purpose, macLength, keyBuf, keyStart, keyLength,
ivBuf, ivStart, ivLength);
opr = new KMOperationImpl(aesGcm);
break;
case KMType.HMAC:
Signature signerVerifier = createHmacSignerVerifier(purpose, digest, keyBuf, keyStart,
opr = new KMOperationImpl(aesGcm);
break;
case KMType.HMAC:
Signature signerVerifier = createHmacSignerVerifier(purpose, digest, keyBuf, keyStart,
keyLength);
opr = new KMOperationImpl(signerVerifier);
break;
default:
CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
break;
opr = new KMOperationImpl(signerVerifier);
break;
default:
CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
break;
}
return opr;
}
}

@Override
public boolean isBootSignalEventSupported() {
return false;
}
@Override
public boolean isBootSignalEventSupported() {
return false;
}

@Override
public boolean isDeviceRebooted() {
return false;
}
@Override
public boolean isDeviceRebooted() {
return false;
}

@Override
public void clearDeviceBooted(boolean resetBootFlag) {
// TODO Auto-generated method stub

}
@Override
public void clearDeviceBooted(boolean resetBootFlag) {
}
}
5 changes: 3 additions & 2 deletions Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -168,20 +168,21 @@ public short decodeRsaPrivateKey(short version){
len = header(ASN1_INTEGER);
short modulus = KMByteBlob.instance(len);
getBytes(modulus);
updateModulus(modulus);
updateRsaKeyBuffer(modulus);
len = header(ASN1_INTEGER);
short pubKey = KMByteBlob.instance(len);
getBytes(pubKey);
len = header(ASN1_INTEGER);
short privKey = KMByteBlob.instance(len);
getBytes(privKey);
updateRsaKeyBuffer(privKey);
KMArray.cast(resp).add((short)0, modulus);
KMArray.cast(resp).add((short)1, pubKey);
KMArray.cast(resp).add((short)2, privKey);
return resp;
}

private void updateModulus(short blob) {
private void updateRsaKeyBuffer(short blob) {
byte[] buffer = KMByteBlob.cast(blob).getBuffer();
short startOff = KMByteBlob.cast(blob).getStartOff();
short len = KMByteBlob.cast(blob).length();
Expand Down
1 change: 1 addition & 0 deletions Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -141,6 +141,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
// Maximum allowed buffer size for to encode the key parameters
// which is used while creating mac for key paramters.
public static final short MAX_KEY_PARAMS_BUF_SIZE = (short) 3072; // 3K

// Top 32 commands are reserved for provisioning.
private static final byte KEYMINT_CMD_APDU_START = 0x20;

Expand Down
2 changes: 1 addition & 1 deletion HAL/JavacardSecureElement.h
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -69,7 +69,7 @@ enum class Instruction {
INS_UPDATE_EEK_CHAIN_CMD = KEYMINT_CMD_APDU_START + 31,
INS_UPDATE_CHALLENGE_CMD = KEYMINT_CMD_APDU_START + 32,
INS_FINISH_SEND_DATA_CMD = KEYMINT_CMD_APDU_START + 33,
INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34,
INS_GET_RESPONSE_CMD = KEYMINT_CMD_APDU_START + 34,
};

class JavacardSecureElement {
Expand Down
22 changes: 12 additions & 10 deletions ProvisioningTool/include/constants.h
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -101,14 +101,16 @@ constexpr char kSeFactoryProvisionLock[] = "se_factory_lock";
constexpr char kUnLockProvision[] = "unlock_provision";

// Instruction constatnts
// TODO Modify according to keymint
constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 1;
constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 2;
constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 3;
constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 4;
constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 3;
constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 4;
constexpr int kBootParamsCmd = INS_BEGIN_KM_CMD + 5;
constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 6;
constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 7;
constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 9;
constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 10;
constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 11;
constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 6;
constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 7;
constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 10;
constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 11;
constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 12;
constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 13;
constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 14;