diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java index 3dc1aabf..057d9f8a 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java @@ -64,8 +64,8 @@ public void onRestore(Element element) { packageVersion = packageVersion_; provisionStatus = provisionStatus_; keymasterState = element.readByte(); - repository.onRestore(element, packageVersion, CURRENT_PACKAGE_VERSION); - seProvider.onRestore(element, packageVersion, CURRENT_PACKAGE_VERSION); + repository.onRestore(element, packageVersion, KM_PERSISTENT_DATA_STORAGE_VERSION); + seProvider.onRestore(element, packageVersion, KM_PERSISTENT_DATA_STORAGE_VERSION); handleDataUpgradeToVersion2_0(); } @@ -106,8 +106,8 @@ public boolean isUpgradeAllowed(short version) { boolean upgradeAllowed = false; short oldMajorVersion = (short) ((version >> 8) & 0x00FF); short oldMinorVersion = (short) (version & 0x00FF); - short currentMajorVersion = (short) (CURRENT_PACKAGE_VERSION >> 8 & 0x00FF); - short currentMinorVersion = (short) (CURRENT_PACKAGE_VERSION & 0x00FF); + short currentMajorVersion = (short) (KM_PERSISTENT_DATA_STORAGE_VERSION >> 8 & 0x00FF); + short currentMinorVersion = (short) (KM_PERSISTENT_DATA_STORAGE_VERSION & 0x00FF); // Downgrade of the Applet is not allowed. // Upgrade is not allowed to a next version which is not immediate. if ((short) (currentMajorVersion - oldMajorVersion) == 1) { @@ -143,7 +143,7 @@ public void handleDataUpgradeToVersion2_0() { status = (byte) (status | 0x20); } provisionStatus = status; - packageVersion = CURRENT_PACKAGE_VERSION; + packageVersion = KM_PERSISTENT_DATA_STORAGE_VERSION; short certExpiryLen = 0; short issuerLen = 0; diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java index 5ff8cc63..c2b2f1ce 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java @@ -75,11 +75,10 @@ public class KMAttestationCertImpl implements KMAttestationCert { private static final short[] swTagIds = { KMType.ATTESTATION_APPLICATION_ID, KMType.CREATION_DATETIME, + KMType.ALLOW_WHILE_ON_BODY, KMType.USAGE_EXPIRE_DATETIME, KMType.ORIGINATION_EXPIRE_DATETIME, - KMType.ACTIVE_DATETIME, - KMType.UNLOCKED_DEVICE_REQUIRED, - KMType.ALLOW_WHILE_ON_BODY + KMType.ACTIVE_DATETIME }; // Below are the allowed hardwareEnforced Authorization tags inside the attestation certificate's extension. @@ -90,7 +89,8 @@ public class KMAttestationCertImpl implements KMAttestationCert { KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT, KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND, KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST, - KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT, + KMType.ORIGIN, KMType.UNLOCKED_DEVICE_REQUIRED, + KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT, KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED, KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH, KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE, diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java index 1b09fa53..6e5090a1 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java @@ -26,7 +26,4 @@ public class KMConfigurations { public static final short CERT_ISSUER_MAX_SIZE = 250; public static final short CERT_EXPIRY_MAX_SIZE = 20; public static final short TOTAL_ATTEST_IDS_SIZE = 300; - // If the size of the attestation ids is known and lesser than 64 - // then reduce the size here. It reduces the heap memory usage. - public static final byte MAX_ATTESTATION_IDS_SIZE = 64; } diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java index 6d75d076..14c9dff3 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java @@ -448,9 +448,9 @@ private static void pushSWParams() { // Below are the allowed softwareEnforced Authorization tags inside the attestation certificate's extension. short[] tagIds = { KMType.ATTESTATION_APPLICATION_ID, KMType.CREATION_DATETIME, - KMType.USAGE_EXPIRE_DATETIME, KMType.ORIGINATION_EXPIRE_DATETIME, - KMType.ACTIVE_DATETIME, KMType.UNLOCKED_DEVICE_REQUIRED, - KMType.ALLOW_WHILE_ON_BODY}; + KMType.ALLOW_WHILE_ON_BODY, KMType.USAGE_EXPIRE_DATETIME, + KMType.ORIGINATION_EXPIRE_DATETIME, KMType.ACTIVE_DATETIME + }; byte index = 0; do { pushParams(swParams, swParamsIndex, tagIds[index]); @@ -468,7 +468,8 @@ private static void pushHWParams() { KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT, KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND, KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST, - KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT, + KMType.ORIGIN, KMType.UNLOCKED_DEVICE_REQUIRED, + KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT, KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED, KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH, KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE, diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMConfigurations.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMConfigurations.java index 1b09fa53..6e5090a1 100644 --- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMConfigurations.java +++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMConfigurations.java @@ -26,7 +26,4 @@ public class KMConfigurations { public static final short CERT_ISSUER_MAX_SIZE = 250; public static final short CERT_EXPIRY_MAX_SIZE = 20; public static final short TOTAL_ATTEST_IDS_SIZE = 300; - // If the size of the attestation ids is known and lesser than 64 - // then reduce the size here. It reduces the heap memory usage. - public static final byte MAX_ATTESTATION_IDS_SIZE = 64; } diff --git a/Applet/src/com/android/javacard/keymaster/KMByteTag.java b/Applet/src/com/android/javacard/keymaster/KMByteTag.java index c37fd8fc..0460a6c4 100644 --- a/Applet/src/com/android/javacard/keymaster/KMByteTag.java +++ b/Applet/src/com/android/javacard/keymaster/KMByteTag.java @@ -122,10 +122,6 @@ private static boolean validateKey(short key, short byteBlob) { case ATTESTATION_ID_MEID: case ATTESTATION_ID_MANUFACTURER: case ATTESTATION_ID_MODEL: - if (valueLen > KMConfigurations.MAX_ATTESTATION_IDS_SIZE) { - KMException.throwIt(KMError.INVALID_INPUT_LENGTH); - } - break; case ASSOCIATED_DATA: case NONCE: case CONFIRMATION_TOKEN: diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index ae378924..c72cb517 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -46,7 +46,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe // Magic number version public static final byte KM_MAGIC_NUMBER = (byte) 0x81; // MSB byte is for Major version and LSB byte is for Minor version. - public static final short CURRENT_PACKAGE_VERSION = 0x0201; // 2.1 + public static final short KM_PERSISTENT_DATA_STORAGE_VERSION = 0x0200; // 2.0 // "Keymaster HMAC Verification" - used for HMAC key verification. public static final byte[] sharingCheck = { @@ -201,7 +201,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe // ComputeHMAC constants private static final short HMAC_SHARED_PARAM_MAX_SIZE = 64; // Maximum certificate size. - private static final short MAX_CERT_SIZE = 2048; + private static final short MAX_CERT_SIZE = 3000; // Buffer constants. private static final short BUF_START_OFFSET = 0; private static final short BUF_LEN_OFFSET = 2; @@ -240,7 +240,7 @@ protected KMKeymasterApplet(KMSEProvider seImpl) { if (!isUpgrading) { keymasterState = KMKeymasterApplet.INIT_STATE; seProvider.createMasterKey((short) (KMRepository.MASTER_KEY_SIZE * 8)); - packageVersion = CURRENT_PACKAGE_VERSION; + packageVersion = KM_PERSISTENT_DATA_STORAGE_VERSION; } KMType.initialize(); encoder = new KMEncoder(); @@ -933,9 +933,6 @@ private void saveAttId() { tmpVariables[0] = KMKeyParameters.findTag(KMType.BYTES_TAG, attTag, data[KEY_PARAMETERS]); if (tmpVariables[0] != KMType.INVALID_VALUE) { tmpVariables[0] = KMByteTag.cast(tmpVariables[0]).getValue(); - if (KMByteBlob.cast(tmpVariables[0]).length() > KMConfigurations.MAX_ATTESTATION_IDS_SIZE) { - KMException.throwIt(KMError.INVALID_INPUT_LENGTH); - } repository.persistAttId( mapToAttId(attTag), KMByteBlob.cast(tmpVariables[0]).getBuffer(), diff --git a/HAL/keymaster/4.1/JavacardKeymaster4Device.cpp b/HAL/keymaster/4.1/JavacardKeymaster4Device.cpp index 208b9887..a222f93f 100644 --- a/HAL/keymaster/4.1/JavacardKeymaster4Device.cpp +++ b/HAL/keymaster/4.1/JavacardKeymaster4Device.cpp @@ -649,16 +649,25 @@ Return JavacardKeymaster4Device::importKey(const hidl_vec& k std::vector cborOutData; ErrorCode errorCode = ErrorCode::UNKNOWN_ERROR; KeyCharacteristics keyCharacteristics; + hidl_vec updatedParams(keyParams); cppbor::Array subArray; // Send earlyBootEnded if there is any pending earlybootEnded event. handleSendEarlyBootEndedEvent(); + if(!findTag(keyParams, Tag::CREATION_DATETIME) && + !findTag(keyParams, Tag::ACTIVE_DATETIME)) { + //Add CREATION_DATETIME in HAL, as secure element is not having clock. + size_t size = keyParams.size(); + updatedParams.resize(size+1); + updatedParams[size].tag = Tag::CREATION_DATETIME; + updatedParams[size].f.dateTime = java_time(time(nullptr)); + } if(keyFormat != KeyFormat::PKCS8 && keyFormat != KeyFormat::RAW) { LOG(ERROR) << "INS_IMPORT_KEY_CMD unsupported key format " << (int32_t)keyFormat; _hidl_cb(ErrorCode::UNSUPPORTED_KEY_FORMAT, keyBlob, keyCharacteristics); return Void(); } - cborConverter_.addKeyparameters(array, keyParams); + cborConverter_.addKeyparameters(array, updatedParams); array.add(static_cast(keyFormat)); //javacard accepts only RAW. array.add(std::vector(keyData)); @@ -708,7 +717,16 @@ Return JavacardKeymaster4Device::importWrappedKey(const hidl_vec& _hidl_cb(errorCode, keyBlob, keyCharacteristics); return Void(); } - cborConverter_.addKeyparameters(array, authList); + hidl_vec updatedParams(authList); + if(!findTag(authList, Tag::CREATION_DATETIME) && + !findTag(authList, Tag::ACTIVE_DATETIME)) { + //Add CREATION_DATETIME in HAL, as secure element is not having clock. + size_t size = authList.size(); + updatedParams.resize(size+1); + updatedParams[size].tag = Tag::CREATION_DATETIME; + updatedParams[size].f.dateTime = java_time(time(nullptr)); + } + cborConverter_.addKeyparameters(array, updatedParams); array.add(static_cast(keyFormat)); array.add(secureKey); array.add(tag);