diff --git a/Applet/src/com/android/javacard/keymaster/KMKeyParameters.java b/Applet/src/com/android/javacard/keymaster/KMKeyParameters.java index 5e2a0437..40bcbc2c 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeyParameters.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeyParameters.java @@ -57,11 +57,9 @@ public class KMKeyParameters extends KMType { KMType.ENUM_TAG, KMType.ECCURVE, KMType.BOOL_TAG, KMType.INCLUDE_UNIQUE_ID, KMType.BOOL_TAG, KMType.ROLLBACK_RESISTANCE, - KMType.BOOL_TAG, KMType.UNLOCKED_DEVICE_REQUIRED, KMType.BOOL_TAG, KMType.EARLY_BOOT_ONLY, KMType.BOOL_TAG, KMType.BOOTLOADER_ONLY, KMType.UINT_TAG, KMType.MAX_USES_PER_BOOT, - KMType.BOOL_TAG, KMType.TRUSTED_CONFIRMATION_REQUIRED, }; private static final short[] swEnforcedTagsArr = { @@ -79,6 +77,8 @@ public class KMKeyParameters extends KMType { KMType.ULONG_ARRAY_TAG, KMType.USER_SECURE_ID, KMType.UINT_TAG, KMType.AUTH_TIMEOUT, KMType.ENUM_TAG, KMType.USER_AUTH_TYPE, + KMType.BOOL_TAG, KMType.UNLOCKED_DEVICE_REQUIRED, + KMType.BOOL_TAG, KMType.TRUSTED_CONFIRMATION_REQUIRED, }; private static final short[] invalidTagsArr = { diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index 1fc59fc6..11a461e3 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -456,7 +456,7 @@ public void process(APDU apdu) { } byte[] apduBuffer = apdu.getBuffer(); byte apduIns = apduBuffer[ISO7816.OFFSET_INS]; - if (!isKeymintReady(apduIns)) { + if (!isKeyMintReady(apduIns)) { ISOException.throwIt(ISO7816.SW_COMMAND_NOT_ALLOWED); } switch (apduIns) { @@ -568,7 +568,7 @@ public void process(APDU apdu) { // 1. boot parameters are set, // 2. system properties are set and // 3. computed the shared secret successfully. - private boolean isKeymintReady(byte apduIns) { + private boolean isKeyMintReady(byte apduIns) { if(kmDataStore.isDeviceReady()) { return true; } @@ -1073,7 +1073,7 @@ private boolean isKeyUpgradeRequired(short keyBlob, short appId, short appData, if (version < KEYBLOB_CURRENT_VERSION) { return true; } - short bootPatchLevel = getBootPatchLevel(scratchPad); + short bootPatchLevel = kmDataStore.getBootPatchLevel(); // Fill the key-value properties in the scratchpad Util.arrayFillNonAtomic(scratchPad, (short) 0, (short) 16, (byte) 0); Util.setShort(scratchPad, (short) 0, KMType.OS_VERSION); @@ -3840,15 +3840,6 @@ private static void generateHmacKey(byte[] scratchPad) { data[KEY_BLOB] = createKeyBlobInstance(SYM_KEY_TYPE); } - protected static short getBootPatchLevel(byte[] scratchPad){ - Util.arrayFillNonAtomic(scratchPad,(short)0, BOOT_PATCH_LVL_SIZE, (byte)0); - short len = kmDataStore.getBootPatchLevel(scratchPad,(short)0); - if(len != BOOT_PATCH_LVL_SIZE){ - KMException.throwIt(KMError.UNKNOWN_ERROR); - } - return KMInteger.uint_32(scratchPad, (short)0); - } - // This function is only called from processUpgradeKey command. // 1. Update the latest values of OSVersion, OSPatch, VendorPatch and BootPatch in the // KeyBlob's KeyCharacteristics. @@ -3863,7 +3854,7 @@ private static void upgradeKeyBlobKeyCharacteristics(short hwParams, byte[] scra short osVersion = kmDataStore.getOsVersion(); short osPatch = kmDataStore.getOsPatch(); short vendorPatch = kmDataStore.getVendorPatchLevel(); - short bootPatch = getBootPatchLevel(scratchPad); + short bootPatch = kmDataStore.getBootPatchLevel(); data[SB_PARAMETERS] = KMKeyParameters.makeSbEnforced( hwParams, (byte) data[ORIGIN], osVersion, osPatch, vendorPatch, bootPatch, scratchPad); data[TEE_PARAMETERS] = KMKeyParameters.makeTeeEnforced(hwParams, scratchPad); @@ -3874,7 +3865,7 @@ private static void makeKeyCharacteristics(byte[] scratchPad) { short osVersion = kmDataStore.getOsVersion(); short osPatch = kmDataStore.getOsPatch(); short vendorPatch = kmDataStore.getVendorPatchLevel(); - short bootPatch = getBootPatchLevel(scratchPad); + short bootPatch = kmDataStore.getBootPatchLevel(); data[SB_PARAMETERS] = KMKeyParameters.makeSbEnforced( data[KEY_PARAMETERS], (byte) data[ORIGIN], osVersion, osPatch, vendorPatch, bootPatch, scratchPad); data[TEE_PARAMETERS] = KMKeyParameters.makeTeeEnforced(data[KEY_PARAMETERS], scratchPad); diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymintDataStore.java b/Applet/src/com/android/javacard/keymaster/KMKeymintDataStore.java index 4380cb67..a2edeb82 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymintDataStore.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymintDataStore.java @@ -345,12 +345,12 @@ public void setDeviceBootStatus(byte initStatus) { } public boolean isDeviceReady() { - boolean result = false; - short offset = repository.allocReclaimableMemory(DEVICE_STATUS_FLAG_SIZE); - byte[] buf = repository.getHeap(); - getDeviceBootStatus(buf, offset); - byte bootCompleteStatus = SET_BOOT_PARAMS_SUCCESS | SET_SYSTEM_PROPERTIES_SUCCESS | - SET_SYSTEM_PROPERTIES_SUCCESS; + boolean result = false; + short offset = repository.allocReclaimableMemory(DEVICE_STATUS_FLAG_SIZE); + byte[] buf = repository.getHeap(); + getDeviceBootStatus(buf, offset); + byte bootCompleteStatus = (SET_BOOT_PARAMS_SUCCESS | SET_SYSTEM_PROPERTIES_SUCCESS | + NEGOTIATED_SHARED_SECRET_SUCCESS); if (bootCompleteStatus == (buf[offset] & bootCompleteStatus)) { result = true; } @@ -770,13 +770,11 @@ public boolean isDeviceBootLocked() { return deviceBootLocked; } - public short getBootPatchLevel(byte[] buffer, short start) { + public short getBootPatchLevel() { if (bootPatchLevel == null) { KMException.throwIt(KMError.INVALID_DATA); } - Util.arrayCopyNonAtomic(bootPatchLevel, (short) 0, buffer, start, - (short) bootPatchLevel.length); - return (short) bootPatchLevel.length; + return KMInteger.uint_32(bootPatchLevel, (short) 0); } public void setVerifiedBootHash(byte[] buffer, short start, short length) { diff --git a/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java b/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java index aaca3d72..750d9c5e 100644 --- a/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java +++ b/Applet/src/com/android/javacard/keymaster/RemotelyProvisionedComponentDevice.java @@ -998,8 +998,7 @@ private short getBootParams(byte bootParam, byte[] scratchPad) { value = storeDataInst.getOsPatch(); break; case BOOT_PATCH_LEVEL_ID: - short len = storeDataInst.getBootPatchLevel(scratchPad, (short) 0); - value = KMByteBlob.instance(scratchPad, (short) 0, len); + value = storeDataInst.getBootPatchLevel(); break; case VENDOR_PATCH_LEVEL_ID: value = storeDataInst.getVendorPatchLevel();