Skip to content

Applet upgrade#95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
subrahmanyaman merged 4 commits into from
Jun 28, 2022
Merged

Applet upgrade #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
052af21
Merge pull request #183 from AvinashHedage/Keyblob_auth_data_changes
mdwivedi Jun 27, 2022
44cdf28
Merge pull request #184 from AvinashHedage/Buffer_input__RSA_decrypt
mdwivedi Jun 27, 2022
61a53a2
Merge pull request #185 from AvinashHedage/cert_subject_email
mdwivedi Jun 27, 2022
fd4dae7
code review changes and code cleanup in applet upgrade
AvinashHedage Jun 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 0 additions & 18 deletions Applet/AndroidSEProviderLib/src/com/android/javacard/seprovider/KMAndroidSEProvider.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1144,18 +1144,12 @@ public void onSave(Element element, byte interfaceType, Object object) {
return;
}
switch (interfaceType) {
case KMDataStoreConstants.INTERFACE_TYPE_COMPUTED_HMAC_KEY:
KMHmacKey.onSave(element, (KMHmacKey) object);
break;
case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
KMAESKey.onSave(element, (KMAESKey) object);
break;
case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
KMHmacKey.onSave(element, (KMHmacKey) object);
break;
case KMDataStoreConstants.INTERFACE_TYPE_ATTESTATION_KEY:
KMECPrivateKey.onSave(element, (KMECPrivateKey) object);
break;
case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
KMECDeviceUniqueKey.onSave(element, (KMECDeviceUniqueKey) object);
break;
Expand All@@ -1180,8 +1174,6 @@ public Object onRestore(Element element) {
return KMAESKey.onRestore((AESKey) element.readObject());
case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
return KMHmacKey.onRestore((HMACKey) element.readObject());
case KMDataStoreConstants.INTERFACE_TYPE_ATTESTATION_KEY:
return KMECPrivateKey.onRestore((KeyPair) element.readObject());
case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
return KMECDeviceUniqueKey.onRestore((KeyPair) element.readObject());
case KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY:
Expand All@@ -1196,18 +1188,12 @@ public Object onRestore(Element element) {
public short getBackupPrimitiveByteCount(byte interfaceType) {
short primitiveCount = 1; // interface type
switch (interfaceType) {
case KMDataStoreConstants.INTERFACE_TYPE_COMPUTED_HMAC_KEY:
primitiveCount += KMHmacKey.getBackupPrimitiveByteCount();
break;
case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
primitiveCount += KMAESKey.getBackupPrimitiveByteCount();
break;
case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
primitiveCount += KMHmacKey.getBackupPrimitiveByteCount();
break;
case KMDataStoreConstants.INTERFACE_TYPE_ATTESTATION_KEY:
primitiveCount += KMECPrivateKey.getBackupPrimitiveByteCount();
break;
case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
primitiveCount += KMECDeviceUniqueKey.getBackupPrimitiveByteCount();
break;
Expand All@@ -1223,14 +1209,10 @@ public short getBackupPrimitiveByteCount(byte interfaceType) {
@Override
public short getBackupObjectCount(byte interfaceType) {
switch (interfaceType) {
case KMDataStoreConstants.INTERFACE_TYPE_COMPUTED_HMAC_KEY:
return KMHmacKey.getBackupObjectCount();
case KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY:
return KMAESKey.getBackupObjectCount();
case KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY:
return KMHmacKey.getBackupObjectCount();
case KMDataStoreConstants.INTERFACE_TYPE_ATTESTATION_KEY:
return KMECPrivateKey.getBackupObjectCount();
case KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR:
return KMECDeviceUniqueKey.getBackupObjectCount();
case KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY:
Expand Down
15 changes: 7 additions & 8 deletions Applet/src/com/android/javacard/keymaster/KMKeymintDataStore.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -910,7 +910,7 @@ private void handlePreviousVersionUpgrade(Element element) {
element.readObject(); // pop verifiedHash
element.readObject(); //pop bootKey
element.readObject(); // pop bootPatchLevel
additionalCertChain = (byte[]) element.readObject(); //
additionalCertChain = (byte[]) element.readObject();
bcc = (byte[]) element.readObject();

// Read Key Objects
Expand DownExpand Up@@ -953,12 +953,13 @@ void handleProvisionStatusUpgrade(byte[] dataTable, short dataTableIndex){
short dInex = repository.allocReclaimableMemory((short)2);
byte data[] = repository.getHeap();
getProvisionStatus(dataTable, data, dInex);
JCSystem.beginTransaction();
provisionStatus = (short)( data[dInex] & 0x00ff);
short pStatus = (short)( data[dInex] & 0x00ff);
if( KMKeymasterApplet.PROVISION_STATUS_PROVISIONING_LOCKED
== (provisionStatus & KMKeymasterApplet.PROVISION_STATUS_PROVISIONING_LOCKED)) {
provisionStatus |= KMKeymasterApplet.PROVISION_STATUS_SE_LOCKED;
== (pStatus & KMKeymasterApplet.PROVISION_STATUS_PROVISIONING_LOCKED)) {
pStatus |= KMKeymasterApplet.PROVISION_STATUS_SE_LOCKED;
}
JCSystem.beginTransaction();
provisionStatus = pStatus;
JCSystem.commitTransaction();
repository.reclaimMemory((short)2);
}
Expand All@@ -980,12 +981,10 @@ public short getBackupObjectCount() {
// BCC - 1
// oemRootPublicKey - 1
return (short) (11 +
seProvider.getBackupObjectCount(KMDataStoreConstants.INTERFACE_TYPE_COMPUTED_HMAC_KEY) +
seProvider.getBackupObjectCount(KMDataStoreConstants.INTERFACE_TYPE_MASTER_KEY) +
seProvider.getBackupObjectCount(KMDataStoreConstants.INTERFACE_TYPE_PRE_SHARED_KEY) +
seProvider.getBackupObjectCount(KMDataStoreConstants.INTERFACE_TYPE_DEVICE_UNIQUE_KEY_PAIR) +
seProvider.getBackupObjectCount(
KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY));
seProvider.getBackupObjectCount(KMDataStoreConstants.INTERFACE_TYPE_RKP_MAC_KEY));
}

}
5 changes: 3 additions & 2 deletions Applet/src/com/android/javacard/keymaster/KMOperationState.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -311,8 +311,9 @@ public byte getBufferingMode() {
short padding = getPadding();
short blockMode = getBlockMode();

if (alg == KMType.RSA && digest == KMType.DIGEST_NONE && purpose == KMType.SIGN) {
return KMType.BUF_RSA_NO_DIGEST;
if (alg == KMType.RSA && ((digest == KMType.DIGEST_NONE && purpose == KMType.SIGN) ||
purpose == KMType.DECRYPT)) {
return KMType.BUF_RSA_DECRYPT_OR_NO_DIGEST;
}

if (alg == KMType.EC && digest == KMType.DIGEST_NONE && purpose == KMType.SIGN) {
Expand Down
2 changes: 1 addition & 1 deletion Applet/src/com/android/javacard/keymaster/KMType.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -346,7 +346,7 @@ public abstract class KMType {
public static final byte FAKE_CERT = 3;
// Buffering Mode
public static final byte BUF_NONE = 0;
public static final byte BUF_RSA_NO_DIGEST = 1;
public static final byte BUF_RSA_DECRYPT_OR_NO_DIGEST = 1;
public static final byte BUF_EC_NO_DIGEST = 2;
public static final byte BUF_AES_ENCRYPT_PKCS7_BLOCK_ALIGN = 3;
public static final byte BUF_AES_DECRYPT_PKCS7_BLOCK_ALIGN = 4;
Expand Down
6 changes: 3 additions & 3 deletions HAL/JavacardKeyMintOperation.cpp
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -62,7 +62,7 @@ ScopedAStatus JavacardKeyMintOperation::update(const vector<uint8_t>& input,
return km_utils::kmError2ScopedAStatus(err);
}
if (!(bufferingMode_ == BufferingMode::EC_NO_DIGEST ||
bufferingMode_ == BufferingMode::RSA_NO_DIGEST)) {
bufferingMode_ == BufferingMode::RSA_DECRYPT_OR_NO_DIGEST)) {
if (view.length > MAX_CHUNK_SIZE) {
err = updateInChunks(view, aToken, tToken, output);
if (err != KM_ERROR_OK) {
Expand All@@ -86,7 +86,7 @@ ScopedAStatus JavacardKeyMintOperation::finish(
DataView view = {.buffer = {}, .data = inData, .start = 0, .length = inData.size()};
const vector<uint8_t> sign = signature.value_or(vector<uint8_t>());
if (!(bufferingMode_ == BufferingMode::EC_NO_DIGEST ||
bufferingMode_ == BufferingMode::RSA_NO_DIGEST)) {
bufferingMode_ == BufferingMode::RSA_DECRYPT_OR_NO_DIGEST)) {
appendBufferedData(view);
if (view.length > MAX_CHUNK_SIZE) {
auto err = updateInChunks(view, aToken, tToken, output);
Expand DownExpand Up@@ -166,7 +166,7 @@ uint16_t JavacardKeyMintOperation::getDataViewOffset(DataView& view, uint16_t bl
keymaster_error_t JavacardKeyMintOperation::bufferData(DataView& view) {
if (view.data.empty()) return KM_ERROR_OK; // nothing to buffer
switch (bufferingMode_) {
case BufferingMode::RSA_NO_DIGEST:
case BufferingMode::RSA_DECRYPT_OR_NO_DIGEST:
buffer_.insert(buffer_.end(), view.data.begin(), view.data.end());
if (buffer_.size() > RSA_BUFFER_SIZE) {
abort();
Expand Down
10 changes: 5 additions & 5 deletions HAL/JavacardKeyMintOperation.h
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -41,11 +41,11 @@ using std::vector;

// Bufferig modes for update
enum class BufferingMode : int32_t {
NONE = 0, // Send everything to javacard - most of the assymteric operations
RSA_NO_DIGEST = 1, // Buffer everything in update upto 256 bytes and send in finish. If
// input data is greater then 256 bytes then it is an error. Javacard
// will further check according to exact key size and crypto provider.
EC_NO_DIGEST = 2, // Buffer upto 65 bytes and then truncate. Javacard will further truncate
NONE = 0, // Send everything to javacard - most of the assymteric operations
RSA_DECRYPT_OR_NO_DIGEST = 1, // Buffer everything in update upto 256 bytes and send in finish. If
// input data is greater then 256 bytes then it is an error. Javacard
// will further check according to exact key size and crypto provider.
EC_NO_DIGEST = 2, // Buffer upto 65 bytes and then truncate. Javacard will further truncate
// upto exact keysize.
BUF_AES_ENCRYPT_PKCS7_BLOCK_ALIGNED = 3, // Buffer 16 bytes.
BUF_AES_DECRYPT_PKCS7_BLOCK_ALIGNED = 4, // Buffer 16 bytes.
Expand Down