Skip to content

Javacard km 41 aosp upmerge 0630#65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
subrahmanyaman merged 3 commits into from
May 19, 2022
Merged

Javacard km 41 aosp upmerge 0630 #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b45a2f4
1. Renamed the PACKAGE_VERSION to DATA_BASE_VERSION
subrahmanyaman May 17, 2022
960ea3e
Add CREATION_DATETIME tag in generateKey, import and importWrappedKey
subrahmanyaman May 19, 2022
d8e3dcc
Merge pull request #131 from subrahmanyaman/keymaster_bug_fixes
mdwivedi May 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -64,8 +64,8 @@ public void onRestore(Element element) {
packageVersion = packageVersion_;
provisionStatus = provisionStatus_;
keymasterState = element.readByte();
repository.onRestore(element, packageVersion, CURRENT_PACKAGE_VERSION);
seProvider.onRestore(element, packageVersion, CURRENT_PACKAGE_VERSION);
repository.onRestore(element, packageVersion, KM_PERSISTENT_DATA_STORAGE_VERSION);
seProvider.onRestore(element, packageVersion, KM_PERSISTENT_DATA_STORAGE_VERSION);
handleDataUpgradeToVersion2_0();
}

Expand DownExpand Up@@ -106,8 +106,8 @@ public boolean isUpgradeAllowed(short version) {
boolean upgradeAllowed = false;
short oldMajorVersion = (short) ((version >> 8) & 0x00FF);
short oldMinorVersion = (short) (version & 0x00FF);
short currentMajorVersion = (short) (CURRENT_PACKAGE_VERSION >> 8 & 0x00FF);
short currentMinorVersion = (short) (CURRENT_PACKAGE_VERSION & 0x00FF);
short currentMajorVersion = (short) (KM_PERSISTENT_DATA_STORAGE_VERSION >> 8 & 0x00FF);
short currentMinorVersion = (short) (KM_PERSISTENT_DATA_STORAGE_VERSION & 0x00FF);
// Downgrade of the Applet is not allowed.
// Upgrade is not allowed to a next version which is not immediate.
if ((short) (currentMajorVersion - oldMajorVersion) == 1) {
Expand DownExpand Up@@ -143,7 +143,7 @@ public void handleDataUpgradeToVersion2_0() {
status = (byte) (status | 0x20);
}
provisionStatus = status;
packageVersion = CURRENT_PACKAGE_VERSION;
packageVersion = KM_PERSISTENT_DATA_STORAGE_VERSION;

short certExpiryLen = 0;
short issuerLen = 0;
Expand Down
8 changes: 4 additions & 4 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,11 +75,10 @@ public class KMAttestationCertImpl implements KMAttestationCert {
private static final short[] swTagIds = {
KMType.ATTESTATION_APPLICATION_ID,
KMType.CREATION_DATETIME,
KMType.ALLOW_WHILE_ON_BODY,
KMType.USAGE_EXPIRE_DATETIME,
KMType.ORIGINATION_EXPIRE_DATETIME,
KMType.ACTIVE_DATETIME,
KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.ALLOW_WHILE_ON_BODY
KMType.ACTIVE_DATETIME
};

// Below are the allowed hardwareEnforced Authorization tags inside the attestation certificate's extension.
Expand All@@ -90,7 +89,8 @@ public class KMAttestationCertImpl implements KMAttestationCert {
KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT,
KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND,
KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST,
KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.ORIGIN, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED,
KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH,
KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE,
Expand Down
3 changes: 0 additions & 3 deletions Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,4 @@ public class KMConfigurations {
public static final short CERT_ISSUER_MAX_SIZE = 250;
public static final short CERT_EXPIRY_MAX_SIZE = 20;
public static final short TOTAL_ATTEST_IDS_SIZE = 300;
// If the size of the attestation ids is known and lesser than 64
// then reduce the size here. It reduces the heap memory usage.
public static final byte MAX_ATTESTATION_IDS_SIZE = 64;
}
9 changes: 5 additions & 4 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMAttestationCertImpl.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -448,9 +448,9 @@ private static void pushSWParams() {
// Below are the allowed softwareEnforced Authorization tags inside the attestation certificate's extension.
short[] tagIds = {
KMType.ATTESTATION_APPLICATION_ID, KMType.CREATION_DATETIME,
KMType.USAGE_EXPIRE_DATETIME, KMType.ORIGINATION_EXPIRE_DATETIME,
KMType.ACTIVE_DATETIME, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.ALLOW_WHILE_ON_BODY};
KMType.ALLOW_WHILE_ON_BODY, KMType.USAGE_EXPIRE_DATETIME,
KMType.ORIGINATION_EXPIRE_DATETIME, KMType.ACTIVE_DATETIME
};
byte index = 0;
do {
pushParams(swParams, swParamsIndex, tagIds[index]);
Expand All@@ -468,7 +468,8 @@ private static void pushHWParams() {
KMType.ATTESTATION_ID_SERIAL, KMType.ATTESTATION_ID_PRODUCT,
KMType.ATTESTATION_ID_DEVICE, KMType.ATTESTATION_ID_BRAND,
KMType.OS_PATCH_LEVEL, KMType.OS_VERSION, KMType.ROOT_OF_TRUST,
KMType.ORIGIN, KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.ORIGIN, KMType.UNLOCKED_DEVICE_REQUIRED,
KMType.TRUSTED_CONFIRMATION_REQUIRED, KMType.AUTH_TIMEOUT,
KMType.USER_AUTH_TYPE, KMType.NO_AUTH_REQUIRED,
KMType.RSA_PUBLIC_EXPONENT, KMType.ECCURVE, KMType.MIN_MAC_LENGTH,
KMType.CALLER_NONCE, KMType.PADDING, KMType.DIGEST, KMType.BLOCK_MODE,
Expand Down
3 changes: 0 additions & 3 deletions Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMConfigurations.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,4 @@ public class KMConfigurations {
public static final short CERT_ISSUER_MAX_SIZE = 250;
public static final short CERT_EXPIRY_MAX_SIZE = 20;
public static final short TOTAL_ATTEST_IDS_SIZE = 300;
// If the size of the attestation ids is known and lesser than 64
// then reduce the size here. It reduces the heap memory usage.
public static final byte MAX_ATTESTATION_IDS_SIZE = 64;
}
4 changes: 0 additions & 4 deletions Applet/src/com/android/javacard/keymaster/KMByteTag.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -122,10 +122,6 @@ private static boolean validateKey(short key, short byteBlob) {
case ATTESTATION_ID_MEID:
case ATTESTATION_ID_MANUFACTURER:
case ATTESTATION_ID_MODEL:
if (valueLen > KMConfigurations.MAX_ATTESTATION_IDS_SIZE) {
KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
}
break;
case ASSOCIATED_DATA:
case NONCE:
case CONFIRMATION_TOKEN:
Expand Down
9 changes: 3 additions & 6 deletions Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -46,7 +46,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
// Magic number version
public static final byte KM_MAGIC_NUMBER = (byte) 0x81;
// MSB byte is for Major version and LSB byte is for Minor version.
public static final short CURRENT_PACKAGE_VERSION = 0x0201; // 2.1
public static final short KM_PERSISTENT_DATA_STORAGE_VERSION = 0x0200; // 2.0

// "Keymaster HMAC Verification" - used for HMAC key verification.
public static final byte[] sharingCheck = {
Expand DownExpand Up@@ -201,7 +201,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
// ComputeHMAC constants
private static final short HMAC_SHARED_PARAM_MAX_SIZE = 64;
// Maximum certificate size.
private static final short MAX_CERT_SIZE = 2048;
private static final short MAX_CERT_SIZE = 3000;
// Buffer constants.
private static final short BUF_START_OFFSET = 0;
private static final short BUF_LEN_OFFSET = 2;
Expand DownExpand Up@@ -240,7 +240,7 @@ protected KMKeymasterApplet(KMSEProvider seImpl) {
if (!isUpgrading) {
keymasterState = KMKeymasterApplet.INIT_STATE;
seProvider.createMasterKey((short) (KMRepository.MASTER_KEY_SIZE * 8));
packageVersion = CURRENT_PACKAGE_VERSION;
packageVersion = KM_PERSISTENT_DATA_STORAGE_VERSION;
}
KMType.initialize();
encoder = new KMEncoder();
Expand DownExpand Up@@ -933,9 +933,6 @@ private void saveAttId() {
tmpVariables[0] = KMKeyParameters.findTag(KMType.BYTES_TAG, attTag, data[KEY_PARAMETERS]);
if (tmpVariables[0] != KMType.INVALID_VALUE) {
tmpVariables[0] = KMByteTag.cast(tmpVariables[0]).getValue();
if (KMByteBlob.cast(tmpVariables[0]).length() > KMConfigurations.MAX_ATTESTATION_IDS_SIZE) {
KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
}
repository.persistAttId(
mapToAttId(attTag),
KMByteBlob.cast(tmpVariables[0]).getBuffer(),
Expand Down
22 changes: 20 additions & 2 deletions HAL/keymaster/4.1/JavacardKeymaster4Device.cpp
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -649,16 +649,25 @@ Return<void> JavacardKeymaster4Device::importKey(const hidl_vec<KeyParameter>& k
std::vector<uint8_t> cborOutData;
ErrorCode errorCode = ErrorCode::UNKNOWN_ERROR;
KeyCharacteristics keyCharacteristics;
hidl_vec<KeyParameter> updatedParams(keyParams);
cppbor::Array subArray;
// Send earlyBootEnded if there is any pending earlybootEnded event.
handleSendEarlyBootEndedEvent();
if(!findTag(keyParams, Tag::CREATION_DATETIME) &&
!findTag(keyParams, Tag::ACTIVE_DATETIME)) {
//Add CREATION_DATETIME in HAL, as secure element is not having clock.
size_t size = keyParams.size();
updatedParams.resize(size+1);
updatedParams[size].tag = Tag::CREATION_DATETIME;
updatedParams[size].f.dateTime = java_time(time(nullptr));
}

if(keyFormat != KeyFormat::PKCS8 && keyFormat != KeyFormat::RAW) {
LOG(ERROR) << "INS_IMPORT_KEY_CMD unsupported key format " << (int32_t)keyFormat;
_hidl_cb(ErrorCode::UNSUPPORTED_KEY_FORMAT, keyBlob, keyCharacteristics);
return Void();
}
cborConverter_.addKeyparameters(array, keyParams);
cborConverter_.addKeyparameters(array, updatedParams);
array.add(static_cast<uint32_t>(keyFormat)); //javacard accepts only RAW.

array.add(std::vector<uint8_t>(keyData));
Expand DownExpand Up@@ -708,7 +717,16 @@ Return<void> JavacardKeymaster4Device::importWrappedKey(const hidl_vec<uint8_t>&
_hidl_cb(errorCode, keyBlob, keyCharacteristics);
return Void();
}
cborConverter_.addKeyparameters(array, authList);
hidl_vec<KeyParameter> updatedParams(authList);
if(!findTag(authList, Tag::CREATION_DATETIME) &&
!findTag(authList, Tag::ACTIVE_DATETIME)) {
//Add CREATION_DATETIME in HAL, as secure element is not having clock.
size_t size = authList.size();
updatedParams.resize(size+1);
updatedParams[size].tag = Tag::CREATION_DATETIME;
updatedParams[size].f.dateTime = java_time(time(nullptr));
}
cborConverter_.addKeyparameters(array, updatedParams);
array.add(static_cast<uint64_t>(keyFormat));
array.add(secureKey);
array.add(tag);
Expand Down