1 /*
2 * Copyright 2020, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "android.hardware.security.keymint-impl"
18 #include <android-base/logging.h>
19
20 #include "KeyMintUtils.h"
21
22 namespace aidl::android::hardware::security::keymint::km_utils {
23
24 namespace {
25
26 using keymaster::hton;
27
kmEnumParam2Aidl(const keymaster_key_param_t & param)28 KeyParameter kmEnumParam2Aidl(const keymaster_key_param_t& param) {
29 switch (param.tag) {
30 case KM_TAG_PURPOSE:
31 return KeyParameter{Tag::PURPOSE, KeyParameterValue::make<KeyParameterValue::keyPurpose>(
32 static_cast<KeyPurpose>(param.enumerated))};
33 case KM_TAG_ALGORITHM:
34 return KeyParameter{Tag::ALGORITHM, KeyParameterValue::make<KeyParameterValue::algorithm>(
35 static_cast<Algorithm>(param.enumerated))};
36 case KM_TAG_BLOCK_MODE:
37 return KeyParameter{Tag::BLOCK_MODE, KeyParameterValue::make<KeyParameterValue::blockMode>(
38 static_cast<BlockMode>(param.enumerated))};
39 case KM_TAG_DIGEST:
40 return KeyParameter{Tag::DIGEST, KeyParameterValue::make<KeyParameterValue::digest>(
41 static_cast<Digest>(param.enumerated))};
42
43 case KM_TAG_RSA_OAEP_MGF_DIGEST:
44 return KeyParameter{Tag::RSA_OAEP_MGF_DIGEST,
45 KeyParameterValue::make<KeyParameterValue::digest>(
46 static_cast<Digest>(param.enumerated))};
47
48 case KM_TAG_PADDING:
49 return KeyParameter{Tag::PADDING, KeyParameterValue::make<KeyParameterValue::paddingMode>(
50 static_cast<PaddingMode>(param.enumerated))};
51 case KM_TAG_EC_CURVE:
52 return KeyParameter{Tag::EC_CURVE, KeyParameterValue::make<KeyParameterValue::ecCurve>(
53 static_cast<EcCurve>(param.enumerated))};
54 case KM_TAG_USER_AUTH_TYPE:
55 return KeyParameter{Tag::USER_AUTH_TYPE,
56 KeyParameterValue::make<KeyParameterValue::hardwareAuthenticatorType>(
57 static_cast<HardwareAuthenticatorType>(param.enumerated))};
58 case KM_TAG_ORIGIN:
59 return KeyParameter{Tag::ORIGIN, KeyParameterValue::make<KeyParameterValue::origin>(
60 static_cast<KeyOrigin>(param.enumerated))};
61
62 case KM_TAG_BLOB_USAGE_REQUIREMENTS:
63 case KM_TAG_KDF:
64 return KeyParameter{Tag::INVALID, false};
65
66 default:
67 // Unknown tag. We can't represent it properly because it's some unknown enum. But KeyMint
68 // specs require us to return unknown tags. Pretending it's an integer value is the best we
69 // can do. Upstream will have to deal with it.
70 return KeyParameter{static_cast<Tag>(param.tag),
71 KeyParameterValue::make<KeyParameterValue::integer>(param.enumerated)};
72 }
73 }
74
75 keymaster_key_param_t kInvalidTag{.tag = KM_TAG_INVALID, .integer = 0};
76
77 template <KeyParameterValue::Tag aidl_tag>
aidlEnumVal2Km(keymaster_tag_t km_tag,const KeyParameterValue & value)78 keymaster_key_param_t aidlEnumVal2Km(keymaster_tag_t km_tag, const KeyParameterValue& value) {
79 return value.getTag() == aidl_tag
80 ? keymaster_param_enum(km_tag, static_cast<uint32_t>(value.get<aidl_tag>()))
81 : kInvalidTag;
82 }
83
aidlEnumParam2Km(const KeyParameter & param)84 keymaster_key_param_t aidlEnumParam2Km(const KeyParameter& param) {
85 auto tag = km_utils::legacy_enum_conversion(param.tag);
86 switch (tag) {
87 case KM_TAG_PURPOSE:
88 return aidlEnumVal2Km<KeyParameterValue::keyPurpose>(tag, param.value);
89 case KM_TAG_ALGORITHM:
90 return aidlEnumVal2Km<KeyParameterValue::algorithm>(tag, param.value);
91 case KM_TAG_BLOCK_MODE:
92 return aidlEnumVal2Km<KeyParameterValue::blockMode>(tag, param.value);
93 case KM_TAG_DIGEST:
94 case KM_TAG_RSA_OAEP_MGF_DIGEST:
95 return aidlEnumVal2Km<KeyParameterValue::digest>(tag, param.value);
96 case KM_TAG_PADDING:
97 return aidlEnumVal2Km<KeyParameterValue::paddingMode>(tag, param.value);
98 case KM_TAG_EC_CURVE:
99 return aidlEnumVal2Km<KeyParameterValue::ecCurve>(tag, param.value);
100 case KM_TAG_USER_AUTH_TYPE:
101 return aidlEnumVal2Km<KeyParameterValue::hardwareAuthenticatorType>(tag, param.value);
102 case KM_TAG_ORIGIN:
103 return aidlEnumVal2Km<KeyParameterValue::origin>(tag, param.value);
104 case KM_TAG_BLOB_USAGE_REQUIREMENTS:
105 case KM_TAG_KDF:
106 CHECK(false) << "Unused enum tag: Something is broken";
107 return keymaster_param_enum(KM_TAG_INVALID, false);
108 default:
109 // Unknown tag. This can happen when system is newer than secure world. Pass it through.
110 return keymaster_param_enum(tag, param.value.get<KeyParameterValue::integer>());
111 }
112 }
113
114 } // namespace
115
authToken2AidlVec(const std::optional<HardwareAuthToken> & token)116 vector<uint8_t> authToken2AidlVec(const std::optional<HardwareAuthToken>& token) {
117 static_assert(1 /* version size */ + sizeof(token->challenge) + sizeof(token->userId) +
118 sizeof(token->authenticatorId) + sizeof(token->authenticatorType) +
119 sizeof(token->timestamp) + 32 /* HMAC size */
120 == sizeof(hw_auth_token_t),
121 "HardwareAuthToken content size does not match hw_auth_token_t size");
122
123 vector<uint8_t> result;
124
125 if (!token.has_value()) return result;
126 if (token->mac.size() != 32) return result;
127
128 result.resize(sizeof(hw_auth_token_t));
129 auto pos = result.begin();
130 *pos++ = 0; // Version byte
131 pos = copy_bytes_to_iterator(token->challenge, pos);
132 pos = copy_bytes_to_iterator(token->userId, pos);
133 pos = copy_bytes_to_iterator(token->authenticatorId, pos);
134 pos = copy_bytes_to_iterator(hton(static_cast<uint32_t>(token->authenticatorType)), pos);
135 pos = copy_bytes_to_iterator(hton(token->timestamp.milliSeconds), pos);
136 pos = std::copy(token->mac.data(), token->mac.data() + token->mac.size(), pos);
137
138 return result;
139 }
140
kmParam2Aidl(const keymaster_key_param_t & param)141 KeyParameter kmParam2Aidl(const keymaster_key_param_t& param) {
142 auto tag = legacy_enum_conversion(param.tag);
143 switch (typeFromTag(param.tag)) {
144 case KM_ENUM:
145 case KM_ENUM_REP:
146 return kmEnumParam2Aidl(param);
147
148 case KM_UINT:
149 case KM_UINT_REP:
150 return KeyParameter{tag,
151 KeyParameterValue::make<KeyParameterValue::integer>(param.integer)};
152
153 case KM_ULONG:
154 case KM_ULONG_REP:
155 return KeyParameter{
156 tag, KeyParameterValue::make<KeyParameterValue::longInteger>(param.long_integer)};
157
158 case KM_DATE:
159 return KeyParameter{tag,
160 KeyParameterValue::make<KeyParameterValue::dateTime>(param.date_time)};
161
162 case KM_BOOL:
163 return KeyParameter{tag, param.boolean};
164
165 case KM_BIGNUM:
166 case KM_BYTES:
167 return {tag, KeyParameterValue::make<KeyParameterValue::blob>(
168 std::vector(param.blob.data, param.blob.data + param.blob.data_length))};
169
170 case KM_INVALID:
171 default:
172 CHECK(false) << "Unknown or unused tag type: Something is broken";
173 return KeyParameter{Tag::INVALID, false};
174 }
175 }
176
kmParamSet2Aidl(const keymaster_key_param_set_t & set)177 vector<KeyParameter> kmParamSet2Aidl(const keymaster_key_param_set_t& set) {
178 vector<KeyParameter> result;
179 if (set.length == 0 || set.params == nullptr) return result;
180
181 result.reserve(set.length);
182 for (size_t i = 0; i < set.length; ++i) {
183 result.push_back(kmParam2Aidl(set.params[i]));
184 }
185 return result;
186 }
187
aidlKeyParams2Km(const vector<KeyParameter> & keyParams)188 keymaster_key_param_set_t aidlKeyParams2Km(const vector<KeyParameter>& keyParams) {
189 keymaster_key_param_set_t set;
190
191 set.params = static_cast<keymaster_key_param_t*>(
192 malloc(keyParams.size() * sizeof(keymaster_key_param_t)));
193 set.length = keyParams.size();
194
195 for (size_t i = 0; i < keyParams.size(); ++i) {
196 const auto& param = keyParams[i];
197 auto tag = legacy_enum_conversion(param.tag);
198 switch (typeFromTag(tag)) {
199
200 case KM_ENUM:
201 case KM_ENUM_REP:
202 set.params[i] = aidlEnumParam2Km(param);
203 break;
204
205 case KM_UINT:
206 case KM_UINT_REP:
207 set.params[i] =
208 param.value.getTag() == KeyParameterValue::integer
209 ? keymaster_param_int(tag, param.value.get<KeyParameterValue::integer>())
210 : kInvalidTag;
211 break;
212
213 case KM_ULONG:
214 case KM_ULONG_REP:
215 set.params[i] =
216 param.value.getTag() == KeyParameterValue::longInteger
217 ? keymaster_param_long(tag, param.value.get<KeyParameterValue::longInteger>())
218 : kInvalidTag;
219 break;
220
221 case KM_DATE:
222 set.params[i] =
223 param.value.getTag() == KeyParameterValue::dateTime
224 ? keymaster_param_date(tag, param.value.get<KeyParameterValue::dateTime>())
225 : kInvalidTag;
226 break;
227
228 case KM_BOOL:
229 set.params[i] = keymaster_param_bool(tag);
230 break;
231
232 case KM_BIGNUM:
233 case KM_BYTES:
234 if (param.value.getTag() == KeyParameterValue::blob) {
235 const auto& value = param.value.get<KeyParameterValue::blob>();
236 uint8_t* copy = static_cast<uint8_t*>(malloc(value.size()));
237 std::copy(value.begin(), value.end(), copy);
238 set.params[i] = keymaster_param_blob(tag, copy, value.size());
239 } else {
240 set.params[i] = kInvalidTag;
241 }
242 break;
243
244 case KM_INVALID:
245 default:
246 CHECK(false) << "Invalid tag: Something is broken";
247 set.params[i].tag = KM_TAG_INVALID;
248 /* just skip */
249 break;
250 }
251 }
252
253 return set;
254 }
255
256 } // namespace aidl::android::hardware::security::keymint::km_utils
257