KMRemotelyProvisionedComponentDevice.java (revision 5c4dab75aa57366379dce576b1a9e082a44e2b3a) - OpenGrok cross reference for /aosp_15_r20/external/libese/ready_se/google/keymint/KM200/Applet/src/com/android/javacard/keymaster/KMRemotelyProvisionedComponentDevice.java

/*
 * Copyright(C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.android.javacard.keymaster;

import com.android.javacard.seprovider.KMException;
import com.android.javacard.seprovider.KMKey;
import com.android.javacard.seprovider.KMOperation;
import com.android.javacard.seprovider.KMSEProvider;
import javacard.framework.APDU;
import javacard.framework.ISO7816;
import javacard.framework.ISOException;
import javacard.framework.JCSystem;
import javacard.framework.Util;

/**
 * This class handles remote key provisioning. Generates an RKP key and generates a certificate
 * signing request(CSR). The generation of CSR is divided among multiple functions to the save the
 * memory inside the Applet. The set of functions to be called sequentially in the order to complete
 * the process of generating the CSR are processBeginSendData, processUpdateKey,
 * processUpdateEekChain, processUpdateChallenge, processFinishSendData, and getResponse.
 * ProcessUpdateKey is called Ntimes, where N is the number of keys. Similarly, getResponse is
 * called multiple times till the client receives the response completely.
 */
public class KMRemotelyProvisionedComponentDevice {

  // Below are the device info labels
  // The string "brand" in hex
  public static final byte[] BRAND = {0x62, 0x72, 0x61, 0x6E, 0x64};
  // The string "manufacturer" in hex
  public static final byte[] MANUFACTURER = {
    0x6D, 0x61, 0x6E, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x65, 0x72
  };
  // The string "product" in hex
  public static final byte[] PRODUCT = {0x70, 0x72, 0x6F, 0x64, 0x75, 0x63, 0x74};
  // The string "model" in hex
  public static final byte[] MODEL = {0x6D, 0x6F, 0x64, 0x65, 0x6C};
  // // The string "device" in hex
  public static final byte[] DEVICE = {0x64, 0x65, 0x76, 0x69, 0x63, 0x65};
  // The string "vb_state" in hex
  public static final byte[] VB_STATE = {0x76, 0x62, 0x5F, 0x73, 0x74, 0x61, 0x74, 0x65};
  // The string "bootloader_state" in hex.
  public static final byte[] BOOTLOADER_STATE = {
    0x62, 0x6F, 0x6F, 0x74, 0x6C, 0x6F, 0x61, 0x64, 0x65, 0x72, 0x5F, 0x73, 0x74, 0x61, 0x74, 0x65
  };
  // The string "vb_meta_digest" in hdex.
  public static final byte[] VB_META_DIGEST = {
    0X76, 0X62, 0X6D, 0X65, 0X74, 0X61, 0X5F, 0X64, 0X69, 0X67, 0X65, 0X73, 0X74
  };
  // The string "os_version" in hex.
  public static final byte[] OS_VERSION = {
    0x6F, 0x73, 0x5F, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E
  };
  // The string "system_patch_level" in hex.
  public static final byte[] SYSTEM_PATCH_LEVEL = {
    0x73, 0x79, 0x73, 0x74, 0x65, 0x6D, 0x5F, 0x70, 0x61, 0x74, 0x63, 0x68, 0x5F, 0x6C, 0x65, 0x76,
    0x65, 0x6C
  };
  // The string "boot_patch_level" in hex.
  public static final byte[] BOOT_PATCH_LEVEL = {
    0x62, 0x6F, 0x6F, 0x74, 0x5F, 0x70, 0x61, 0x74, 0x63, 0x68, 0x5F, 0x6C, 0x65, 0x76, 0x65, 0x6C
  };
  // The string "vendor_patch_level"  in hex.
  public static final byte[] VENDOR_PATCH_LEVEL = {
    0x76, 0x65, 0x6E, 0x64, 0x6F, 0x72, 0x5F, 0x70, 0x61, 0x74, 0x63, 0x68, 0x5F, 0x6C, 0x65, 0x76,
    0x65, 0x6C
  };
  // The string "version" in hex.
  public static final byte[] DEVICE_INFO_VERSION = {0x76, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E};
  // The string "security_level" in hex.
  public static final byte[] SECURITY_LEVEL = {
    0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x5F, 0x6C, 0x65, 0x76, 0x65, 0x6C
  };
  // The string "fused" in hex.
  public static final byte[] FUSED = {0x66, 0x75, 0x73, 0x65, 0x64};
  // Below are the Verified boot state values
  // The string "green" in hex.
  public static final byte[] VB_STATE_GREEN = {0x67, 0x72, 0x65, 0x65, 0x6E};
  // The string "yellow" in hex.
  public static final byte[] VB_STATE_YELLOW = {0x79, 0x65, 0x6C, 0x6C, 0x6F, 0x77};
  // The string "orange" in hex.
  public static final byte[] VB_STATE_ORANGE = {0x6F, 0x72, 0x61, 0x6E, 0x67, 0x65};
  // The string "red" in hex.
  public static final byte[] VB_STATE_RED = {0x72, 0x65, 0x64};
  // Below are the boot loader state values
  // The string "unlocked" in hex.
  public static final byte[] UNLOCKED = {0x75, 0x6E, 0x6C, 0x6F, 0x63, 0x6B, 0x65, 0x64};
  // The string "locked" in hex.
  public static final byte[] LOCKED = {0x6C, 0x6F, 0x63, 0x6B, 0x65, 0x64};
  // Device info CDDL schema version
  public static final byte DI_SCHEMA_VERSION = 2;
  // The string "strongbox" in hex.
  public static final byte[] DI_SECURITY_LEVEL = {
    0x73, 0x74, 0x72, 0x6F, 0x6E, 0x67, 0x62, 0x6F, 0x78
  };
  // Represents each element size inside the data buffer. Each element has two entries
  // 1) Length of the element and 2) offset of the element in the data buffer.
  public static final byte DATA_INDEX_ENTRY_SIZE = 4;
  // It is the offset, which represents the position where the element is present
  // in the data buffer.
  public static final byte DATA_INDEX_ENTRY_OFFSET = 2;
  // Flag to denote TRUE
  private static final byte TRUE = 0x01;
  // Flag to denote FALSE
  private static final byte FALSE = 0x00;
  // RKP hardware info Version
  private static final short RKP_VERSION = (short) 0x02;
  // Below constants used to denote the type of the boot parameters. Note that these
  // constants are only defined to be used internally.
  private static final byte OS_VERSION_ID = 0x00;
  private static final byte SYSTEM_PATCH_LEVEL_ID = 0x01;
  private static final byte BOOT_PATCH_LEVEL_ID = 0x02;
  private static final byte VENDOR_PATCH_LEVEL_ID = 0x03;
  // Configurable flag to denote if Additional certificate chain is supported in the
  // RKP server.
  private static final boolean IS_ACC_SUPPORTED_IN_RKP_SERVER = false;
  // The maximum possible output buffer.
  private static final short MAX_SEND_DATA = 512;
  // The string "Google Strongbox KeyMint 2" in hex.
  private static final byte[] uniqueId = {
    0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x53, 0x74, 0x72, 0x6f, 0x6e, 0x67, 0x62, 0x6f, 0x78,
    0x20, 0x4b, 0x65, 0x79, 0x4d, 0x69, 0x6e, 0x74, 0x20, 0x32
  };
  // Flag to denote more response is available to the clients.
  private static final byte MORE_DATA = 0x01;
  // Flag to denote no response is available to the clients.
  private static final byte NO_DATA = 0x00;
  // Below are the response processing states. As the protected data response is huge it is
  // sent back incrementally and the clients are responsible to call get response multiple times
  // based on MORE_DATA or NO_DATA flags. BCC - Boot Certificate Chain.
  // ACC - Additional Certificate Chain.
  private static final byte START_PROCESSING = 0x00;
  private static final byte PROCESSING_BCC_IN_PROGRESS = 0x02;
  private static final byte PROCESSING_BCC_COMPLETE = 0x04;
  private static final byte PROCESSING_ACC_IN_PROGRESS = 0x08;
  private static final byte PROCESSING_ACC_COMPLETE = 0x0A;
  // The data table size.
  private static final short DATA_SIZE = 512;
  // Number of entries in the data table.
  private static final byte DATA_INDEX_SIZE = 11;
  // Below are the data table offsets.
  private static final byte EPHEMERAL_MAC_KEY = 0;
  private static final byte TOTAL_KEYS_TO_SIGN = 1;
  private static final byte KEYS_TO_SIGN_COUNT = 2;
  private static final byte TEST_MODE = 3;
  private static final byte EEK_KEY = 4;
  private static final byte EEK_KEY_ID = 5;
  private static final byte CHALLENGE = 6;
  private static final byte GENERATE_CSR_PHASE = 7;
  private static final byte EPHEMERAL_PUB_KEY = 8;
  private static final byte RESPONSE_PROCESSING_STATE = 9;
  private static final byte ACC_PROCESSED_LENGTH = 10;

  // Below are some of the sizes defined in the data table.
  // The size of the Ephemeral Mac key used to sign the rkp public key.
  private static final byte EPHEMERAL_MAC_KEY_SIZE = 32;
  // The size of short types.
  private static final byte SHORT_SIZE = 2;
  // The size of byte types
  private static final byte BYTE_SIZE = 1;
  // The size of the test mode flag.
  private static final byte TEST_MODE_SIZE = 1;
  // Below are the different processing stages for generateCSR.
  // BEGIN -        It is the initial stage where the process is initialized and construction of
  //                MacedPublickeys are initiated.
  // UPDATE -       Challenge, EEK and RKP keys are sent to the applet for further process.
  // FINISH -       MacedPublicKeys are constructed and construction of protected data is initiated.
  // GET_RESPONSE - Called multiple times by the client till all the protected data is received.
  private static final byte BEGIN = 0x01;
  private static final byte UPDATE = 0x02;
  private static final byte FINISH = 0x04;
  private static final byte GET_RESPONSE = 0x06;

  // RKP mac key size
  private static final byte RKP_MAC_KEY_SIZE = 32;
  // This holds the Google ECDSA P256 root key for the Endpoint Encryption Key.
  public static Object[] authorizedEekRoots;
  // Used to hold the temporary results.
  public short[] rkpTmpVariables;
  // Data table to hold the entries at the initial stages of generateCSR and which are used
  // at later stages to construct the response data.
  private byte[] data;
  // Instance of the CBOR encoder.
  private KMEncoder encoder;
  // Instance of the CBOR decoder.
  private KMDecoder decoder;
  // Instance of the KMRepository for memory management.
  private KMRepository repository;
  // Instance of the provider for cyrpto operations.
  private KMSEProvider seProvider;
  // Instance of the KMKeymintDataStore to save or retrieve the data.
  private KMKeymintDataStore storeDataInst;
  // Holds the KMOperation instance. This is used to do multi part update operations.
  private Object[] operation;
  // Holds the current index in the data table.
  private short[] dataIndex;

  public KMRemotelyProvisionedComponentDevice(
      KMEncoder encoder,
      KMDecoder decoder,
      KMRepository repository,
      KMSEProvider seProvider,
      KMKeymintDataStore storeDInst) {
    this.encoder = encoder;
    this.decoder = decoder;
    this.repository = repository;
    this.seProvider = seProvider;
    this.storeDataInst = storeDInst;
    rkpTmpVariables = JCSystem.makeTransientShortArray((short) 32, JCSystem.CLEAR_ON_RESET);
    data = JCSystem.makeTransientByteArray(DATA_SIZE, JCSystem.CLEAR_ON_RESET);
    operation = JCSystem.makeTransientObjectArray((short) 1, JCSystem.CLEAR_ON_RESET);
    dataIndex = JCSystem.makeTransientShortArray((short) 1, JCSystem.CLEAR_ON_RESET);
    // Initialize RKP mac key
    if (!seProvider.isUpgrading()) {
      short offset = repository.allocReclaimableMemory((short) RKP_MAC_KEY_SIZE);
      byte[] buffer = repository.getHeap();
      seProvider.getTrueRandomNumber(buffer, offset, RKP_MAC_KEY_SIZE);
      storeDataInst.createRkpMacKey(buffer, offset, RKP_MAC_KEY_SIZE);
      repository.reclaimMemory(RKP_MAC_KEY_SIZE);
    }
    operation[0] = null;
    createAuthorizedEEKRoot();
  }

  private void createAuthorizedEEKRoot() {
    if (authorizedEekRoots == null) {
      authorizedEekRoots =
          new Object[] {
            new byte[] {
              (byte) 0x04, (byte) 0xf7, (byte) 0x14, (byte) 0x8a, (byte) 0xdb, (byte) 0x97,
              (byte) 0xf4, (byte) 0xcc, (byte) 0x53, (byte) 0xef, (byte) 0xd2, (byte) 0x64,
              (byte) 0x11, (byte) 0xc4, (byte) 0xe3, (byte) 0x75, (byte) 0x1f, (byte) 0x66,
              (byte) 0x1f, (byte) 0xa4, (byte) 0x71, (byte) 0x0c, (byte) 0x6c, (byte) 0xcf,
              (byte) 0xfa, (byte) 0x09, (byte) 0x46, (byte) 0x80, (byte) 0x74, (byte) 0x87,
              (byte) 0x54, (byte) 0xf2, (byte) 0xad, (byte) 0x5e, (byte) 0x7f, (byte) 0x5b,
              (byte) 0xf6, (byte) 0xec, (byte) 0xe4, (byte) 0xf6, (byte) 0x19, (byte) 0xcc,
              (byte) 0xff, (byte) 0x13, (byte) 0x37, (byte) 0xfd, (byte) 0x0f, (byte) 0xa1,
              (byte) 0xc8, (byte) 0x93, (byte) 0xdb, (byte) 0x18, (byte) 0x06, (byte) 0x76,
              (byte) 0xc4, (byte) 0x5d, (byte) 0xe6, (byte) 0xd7, (byte) 0x6a, (byte) 0x77,
              (byte) 0x86, (byte) 0xc3, (byte) 0x2d, (byte) 0xaf, (byte) 0x8f
            },
          };
    }
  }

  private void initializeDataTable() {
    clearDataTable();
    releaseOperation();
    dataIndex[0] = (short) (DATA_INDEX_SIZE * DATA_INDEX_ENTRY_SIZE);
  }

  private short dataAlloc(short length) {
    if ((short) (dataIndex[0] + length) > (short) data.length) {
      ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);
    }
    dataIndex[0] += length;
    return (short) (dataIndex[0] - length);
  }

  private void clearDataTable() {
    Util.arrayFillNonAtomic(data, (short) 0, (short) data.length, (byte) 0x00);
    dataIndex[0] = 0x00;
  }

  private void releaseOperation() {
    if (operation[0] != null) {
      ((KMOperation) operation[0]).abort();
      operation[0] = null;
    }
  }

  private short createEntry(short index, short length) {
    index = (short) (index * DATA_INDEX_ENTRY_SIZE);
    short ptr = dataAlloc(length);
    Util.setShort(data, index, length);
    Util.setShort(data, (short) (index + DATA_INDEX_ENTRY_OFFSET), ptr);
    return ptr;
  }

  private short getEntry(short index) {
    index = (short) (index * DATA_INDEX_ENTRY_SIZE);
    return Util.getShort(data, (short) (index + DATA_INDEX_ENTRY_OFFSET));
  }

  private short getEntryLength(short index) {
    index = (short) (index * DATA_INDEX_ENTRY_SIZE);
    return Util.getShort(data, index);
  }

  private void processGetRkpHwInfoCmd(APDU apdu) {
    // Make the response
    // Author name - Google.
    short respPtr = KMArray.instance((short) 5);
    KMArray resp = KMArray.cast(respPtr);
    resp.add((short) 0, KMInteger.uint_16(KMError.OK));
    resp.add((short) 1, KMInteger.uint_16(RKP_VERSION));
    resp.add(
        (short) 2,
        KMByteBlob.instance(
            KMKeymasterApplet.Google, (short) 0, (short) KMKeymasterApplet.Google.length));
    resp.add((short) 3, KMInteger.uint_8(KMType.RKP_CURVE_P256));
    resp.add((short) 4, KMByteBlob.instance(uniqueId, (short) 0, (short) uniqueId.length));
    KMKeymasterApplet.sendOutgoing(apdu, respPtr);
  }

  /**
   * This function generates an EC key pair with attest key as purpose and creates an encrypted key
   * blob. It then generates a COSEMac message which includes the ECDSA public key.
   */
  public void processGenerateRkpKey(APDU apdu) {
    short arr = KMArray.instance((short) 1);
    KMArray.cast(arr).add((short) 0, KMSimpleValue.exp());
    arr = KMKeymasterApplet.receiveIncoming(apdu, arr);
    // Re-purpose the apdu buffer as scratch pad.
    byte[] scratchPad = apdu.getBuffer();
    // test mode flag.
    boolean testMode =
        (KMSimpleValue.TRUE == KMSimpleValue.cast(KMArray.cast(arr).get((short) 0)).getValue());
    KMKeymasterApplet.generateRkpKey(scratchPad, getEcAttestKeyParameters());
    short pubKey = KMKeymasterApplet.getPubKey();
    short coseMac0 = constructCoseMacForRkpKey(testMode, scratchPad, pubKey);
    // Encode the COSE_MAC0 object
    arr = KMArray.instance((short) 3);
    KMArray.cast(arr).add((short) 0, KMInteger.uint_16(KMError.OK));
    KMArray.cast(arr).add((short) 1, coseMac0);
    KMArray.cast(arr).add((short) 2, KMKeymasterApplet.getPivateKey());
    KMKeymasterApplet.sendOutgoing(apdu, arr);
  }

  /**
   * This is the first command of the generateCSR.
   * Input:
   *   1) Number of RKP keys.
   *   2) Total length of the encoded CoseKeys (Each RKP key is represented in CoseKey)
   *   3) Flag which represents Test mode or Production mode.
   * Process:
   *   1) Generate Ephemeral mac key and store in the temporary data buffer. This key is
   *      used to sign Mac_Structure, which contains array of encoded RKP keys,
   *   2) Initialize the HMAC operation with the ephemeral mac key and do partial sign of the
   *      Mac_Structure with the input initial data received. A Multipart update on HMAC is
   *      called on each updateKey command in the second stage.
   *   3) Store the number of RKP keys and the test mode flag in the temporary data buffer.
   *   4) Update the phase of the generateCSR function to BEGIN.
   * Response:
   *   Send OK response.
   *
   * @param apdu Input apdu
   */
  public void processBeginSendData(APDU apdu) throws Exception {
    try {
      initializeDataTable();
      short arr = KMArray.instance((short) 3);
      KMArray.cast(arr).add((short) 0, KMInteger.exp()); // Array length
      KMArray.cast(arr).add((short) 1, KMInteger.exp()); // Total length of the encoded CoseKeys.
      KMArray.cast(arr).add((short) 2, KMSimpleValue.exp());
      arr = KMKeymasterApplet.receiveIncoming(apdu, arr);
      // Re-purpose the apdu buffer as scratch pad.
      byte[] scratchPad = apdu.getBuffer();
      // Generate ephemeral mac key.
      short dataEntryIndex = createEntry(EPHEMERAL_MAC_KEY, EPHEMERAL_MAC_KEY_SIZE);
      seProvider.newRandomNumber(data, dataEntryIndex, EPHEMERAL_MAC_KEY_SIZE);
      // Initialize hmac operation.
      initHmacOperation();
      // Partially encode CoseMac structure with partial payload.
      constructPartialPubKeysToSignMac(
          scratchPad,
          KMInteger.cast(KMArray.cast(arr).get((short) 0)).getShort(),
          KMInteger.cast(KMArray.cast(arr).get((short) 1)).getShort());
      // Store the total keys in data table.
      dataEntryIndex = createEntry(TOTAL_KEYS_TO_SIGN, SHORT_SIZE);
      Util.setShort(
          data, dataEntryIndex, KMInteger.cast(KMArray.cast(arr).get((short) 0)).getShort());
      // Store the test mode value in data table.
      dataEntryIndex = createEntry(TEST_MODE, TEST_MODE_SIZE);
      data[dataEntryIndex] =
          (KMSimpleValue.TRUE == KMSimpleValue.cast(KMArray.cast(arr).get((short) 2)).getValue())
              ? TRUE
              : FALSE;
      // Store the current csr status, which is BEGIN.
      createEntry(GENERATE_CSR_PHASE, BYTE_SIZE);
      updateState(BEGIN);
      // Send response.
      KMKeymasterApplet.sendResponse(apdu, KMError.OK);
    } catch (Exception e) {
      clearDataTable();
      releaseOperation();
      throw e;
    }
  }

  /**
   * This is the second command of the generateCSR.
   * Input:
   *   CoseMac0 containing the RKP Key
   * Process:
   *   1) Validate the phase of generateCSR. Prior state should be either BEGIN or UPDATE.
   *   2) Validate the number of RKP Keys received against the value received in first command.
   *   3) Validate the CoseMac0 structure and extract the RKP Key.
   *   4) Do Multipart HMAC update operation with the input as RKP key.
   *   5) Update the number of keys received count into the data buffer.
   *   6) Update the phase of the generateCSR function to UPDATE.
   * Response:
   *   Send OK response.
   * @param apdu Input apdu
   */
  public void processUpdateKey(APDU apdu) throws Exception {
    try {
      // The prior state can be BEGIN or UPDATE
      validateState((byte) (BEGIN | UPDATE));
      validateKeysToSignCount();
      short headers = KMCoseHeaders.exp();
      short arrInst = KMArray.instance((short) 4);
      KMArray.cast(arrInst).add((short) 0, KMByteBlob.exp());
      KMArray.cast(arrInst).add((short) 1, headers);
      KMArray.cast(arrInst).add((short) 2, KMByteBlob.exp());
      KMArray.cast(arrInst).add((short) 3, KMByteBlob.exp());
      short arr = KMArray.exp(arrInst);
      arr = KMKeymasterApplet.receiveIncoming(apdu, arr);
      arrInst = KMArray.cast(arr).get((short) 0);
      // Re-purpose the apdu buffer as scratch pad.
      byte[] scratchPad = apdu.getBuffer();

      // Validate and extract the CoseKey from CoseMac0 message.
      short coseKey = validateAndExtractPublicKey(arrInst, scratchPad);
      // Encode CoseKey
      short length =
          KMKeymasterApplet.encodeToApduBuffer(
              coseKey, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
      // Do Hmac update with input as encoded CoseKey.
      ((KMOperation) operation[0]).update(scratchPad, (short) 0, length);
      // Increment the count each time this function gets executed.
      // Store the count in data table.
      short dataEntryIndex = getEntry(KEYS_TO_SIGN_COUNT);
      if (dataEntryIndex == 0) {
        dataEntryIndex = createEntry(KEYS_TO_SIGN_COUNT, SHORT_SIZE);
      }
      length = Util.getShort(data, dataEntryIndex);
      Util.setShort(data, dataEntryIndex, ++length);
      // Update the csr state
      updateState(UPDATE);
      // Send response.
      KMKeymasterApplet.sendResponse(apdu, KMError.OK);
    } catch (Exception e) {
      clearDataTable();
      releaseOperation();
      throw e;
    }
  }

  /**
   * This is the third command of generateCSR.
   * Input:
   *   EEK chain ordered from Root to Leaf in CoseSign1 format.
   * Process:
   *   1) Validate the phase of generateCSR. Prior state should be UPDATE.
   *   2) Validate the EEK chain and extract the Leaf EEK
   *   3) Retrieve the EEK Id and Public key of Leaf EEK and store in the data buffer.
   *   4) Update the phase of the generateCSR function to UPDATE.
   * Response:
   *   Send OK response.
   * @param apdu Input apdu.
   */
  public void processUpdateEekChain(APDU apdu) throws Exception {
    try {
      // The prior state can be BEGIN or UPDATE
      validateState((byte) (BEGIN | UPDATE));
      short headers = KMCoseHeaders.exp();
      short arrInst = KMArray.instance((short) 4);
      KMArray.cast(arrInst).add((short) 0, KMByteBlob.exp());
      KMArray.cast(arrInst).add((short) 1, headers);
      KMArray.cast(arrInst).add((short) 2, KMByteBlob.exp());
      KMArray.cast(arrInst).add((short) 3, KMByteBlob.exp());
      short arrSignPtr = KMArray.exp(arrInst);
      arrInst = KMKeymasterApplet.receiveIncoming(apdu, arrSignPtr);
      if (KMArray.cast(arrInst).length() == 0) {
        KMException.throwIt(KMError.STATUS_INVALID_EEK);
      }
      // Re-purpose the apdu buffer as scratch pad.
      byte[] scratchPad = apdu.getBuffer();
      // Validate eek chain.
      short eekKey = validateAndExtractEekPub(arrInst, scratchPad);
      // Store eek public key and eek id in the data table.
      short eekKeyId = KMCoseKey.cast(eekKey).getKeyIdentifier();
      short dataEntryIndex = createEntry(EEK_KEY_ID, KMByteBlob.cast(eekKeyId).length());
      Util.arrayCopyNonAtomic(
          KMByteBlob.cast(eekKeyId).getBuffer(),
          KMByteBlob.cast(eekKeyId).getStartOff(),
          data,
          dataEntryIndex,
          KMByteBlob.cast(eekKeyId).length());
      // Convert the coseKey to a public key.
      short len = KMCoseKey.cast(eekKey).getEcdsa256PublicKey(scratchPad, (short) 0);
      dataEntryIndex = createEntry(EEK_KEY, len);
      Util.arrayCopyNonAtomic(scratchPad, (short) 0, data, dataEntryIndex, len);
      // Update the state
      updateState(UPDATE);
      KMKeymasterApplet.sendResponse(apdu, KMError.OK);
    } catch (Exception e) {
      clearDataTable();
      releaseOperation();
      throw e;
    }
  }

  /**
   * This is the fourth command of generateCSR.
   * Input:
   *   Challenge
   * Process:
   *   1) Validate the phase of generateCSR. Prior state should be either UPDATE or BEGIN.
   *   2) Store the challenge in the data buffer.
   *   3) Update the phase of the generateCSR function to UPDATE.
   * Response:
   *   Send OK response.
   * @param apdu Input apdu.
   */
  public void processUpdateChallenge(APDU apdu) throws Exception {
    try {
      // The prior state can be BEGIN or UPDATE
      validateState((byte) (BEGIN | UPDATE));
      short arr = KMArray.instance((short) 1);
      KMArray.cast(arr).add((short) 0, KMByteBlob.exp());
      arr = KMKeymasterApplet.receiveIncoming(apdu, arr);
      // Store the challenge in the data table.
      short challenge = KMArray.cast(arr).get((short) 0);
      short challengeLen = KMByteBlob.cast(challenge).length();
      if (challengeLen > 64) {
        KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
      }
      short dataEntryIndex = createEntry(CHALLENGE, challengeLen);
      Util.arrayCopyNonAtomic(
          KMByteBlob.cast(challenge).getBuffer(),
          KMByteBlob.cast(challenge).getStartOff(),
          data,
          dataEntryIndex,
          challengeLen);
      // Update the state
      updateState(UPDATE);
      KMKeymasterApplet.sendResponse(apdu, KMError.OK);
    } catch (Exception e) {
      clearDataTable();
      releaseOperation();
      throw e;
    }
  }

  /**
   * This is the fifth command of generateCSR.
   * Input:
   *   No input data.
   * Process:
   *   1) Validate the phase of generateCSR. Prior state should be UPDATE.
   *   2) Check if all the RKP keys are received if not throw exception.
   *   3) Finalize the HMAC operation and get the signed Mac_Structure which is called as
   *      pubKeysToSignMac.
   *   4) Start constructing the partial protected data. Create a random
   *      nonce, initialize the AESGCM operation with the session key derived from
   *      HKDF(ECDH(EPHEMERAL_EC_KEY, EEK_KEY), KdfContext)
   *   5) Construct Encrypt_Structure which acts as AAD for AES-GCM operation.
   *   6) The payload for the Protected Data is [SignedMac, BCC, ACC]. Construct partial
   *      SignedMac structure.
   *   7) Note that the HAL has to construct the CoseEncrypt structure by collecting all
   *      the pieces returned from Applet.
   * Response:
   *   OK
   *   pubKeysToSignMac - Containes the maced RKP public keys.
   *   deviceInfo - CBOR encoded device info
   *   protectedHeader - CoseEncrypt protected header
   *   unProtectedHeader - CoseEncrypt unprotected header.
   *   ParitalCipherText - partial encrypted payload of CoseEncrypt structure.
   *   Flag to represent there is more data to retrieve.
   * @param apdu Input apdu.
   */
  public void processFinishSendData(APDU apdu) throws Exception {
    try {
      // The prior state should be UPDATE.
      validateState(UPDATE);
      byte[] scratchPad = apdu.getBuffer();
      if (data[getEntry(TOTAL_KEYS_TO_SIGN)] != data[getEntry(KEYS_TO_SIGN_COUNT)]) {
        // Mismatch in the number of keys sent.
        ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);
      }
      // PubKeysToSignMac
      short empty = repository.alloc((short) 0);
      short len =
          ((KMOperation) operation[0])
              .sign(repository.getHeap(), (short) empty, (short) 0, scratchPad, (short) 0);
      // release operation
      releaseOperation();
      short pubKeysToSignMac = KMByteBlob.instance(scratchPad, (short) 0, len);
      // Create DeviceInfo
      short deviceInfo = createDeviceInfo(scratchPad);
      // Generate Nonce for AES-GCM
      seProvider.newRandomNumber(scratchPad, (short) 0, KMKeymasterApplet.AES_GCM_NONCE_LENGTH);
      short nonce =
          KMByteBlob.instance(scratchPad, (short) 0, KMKeymasterApplet.AES_GCM_NONCE_LENGTH);
      // Initializes cipher instance.
      initAesGcmOperation(scratchPad, nonce);
      // Encode Enc_Structure as additional data for AES-GCM.
      processAesGcmUpdateAad(scratchPad);
      short partialPayloadLen = processSignedMac(scratchPad, pubKeysToSignMac, deviceInfo);
      short partialCipherText = KMByteBlob.instance(scratchPad, (short) 0, partialPayloadLen);
      short coseEncryptProtectedHeader = getCoseEncryptProtectedHeader(scratchPad);
      short coseEncryptUnProtectedHeader = getCoseEncryptUnprotectedHeader(scratchPad, nonce);
      len =
          KMKeymasterApplet.encodeToApduBuffer(
              deviceInfo, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
      short encodedDeviceInfo = KMByteBlob.instance(scratchPad, (short) 0, len);
      updateState(FINISH);
      short arr = KMArray.instance((short) 7);
      KMArray.cast(arr).add((short) 0, KMInteger.uint_16(KMError.OK));
      KMArray.cast(arr).add((short) 1, pubKeysToSignMac);
      KMArray.cast(arr).add((short) 2, encodedDeviceInfo);
      KMArray.cast(arr).add((short) 3, coseEncryptProtectedHeader);
      KMArray.cast(arr).add((short) 4, coseEncryptUnProtectedHeader);
      KMArray.cast(arr).add((short) 5, partialCipherText);
      KMArray.cast(arr).add((short) 6, KMInteger.uint_8(MORE_DATA));
      KMKeymasterApplet.sendOutgoing(apdu, arr);
    } catch (Exception e) {
      clearDataTable();
      releaseOperation();
      throw e;
    }
  }

  /**
   * This is the sixth and the last command of generateCSR. This command is called multiple
   * times by the HAL until all the cipher data and receipient structure is received.
   * Input:
   *   No input data.
   * Process:
   *   First the BootCertificateChain is processed: Encrypt the boot certificate chain and return
   *   the BCC. Mark the state as PROCESSING_BCC_COMPLETE.
   *   Next the AdditionalCertificateChain is processed: Incrementally encrypt ACC and send back
   *   a chunks of data. Each chunk is 512 bytes. if the processing of ACC is still in progress
   *   mark the state as PROCESSING_ACC_IN_PROGRESS otherwise mark the state as
   *   PROCESSING_ACC_COMPLETE.
   *   Finally construct and return the CoseReceipient structure.
   * Response:
   *   OK
   *   cipher text: It can be either encrypted bcc or encrypted acc
   *   Receipient structure: This will be empty will returning the encrypted acc or bcc.
   *   Flag to represent there is more data to retrieve.
   * @param apdu Input apdu.
   */
  public void processGetResponse(APDU apdu) throws Exception {
    try {
      // The prior state should be FINISH.
      validateState((byte) (FINISH | GET_RESPONSE));
      byte[] scratchPad = apdu.getBuffer();
      short len = 0;
      short recipientStructure = KMArray.instance((short) 0);
      byte moreData = MORE_DATA;
      byte state = getCurrentOutputProcessingState();
      switch (state) {
        case START_PROCESSING:
        case PROCESSING_BCC_IN_PROGRESS:
          len = processBcc(scratchPad);
          updateState(GET_RESPONSE);
          break;
        case PROCESSING_BCC_COMPLETE:
        case PROCESSING_ACC_IN_PROGRESS:
          len = processAdditionalCertificateChain(scratchPad);
          updateState(GET_RESPONSE);
          break;
        case PROCESSING_ACC_COMPLETE:
          recipientStructure = processRecipientStructure(scratchPad);
          len = processFinalData(scratchPad);
          moreData = NO_DATA;
          releaseOperation();
          clearDataTable();
          break;
        default:
          KMException.throwIt(KMError.INVALID_STATE);
      }
      short data = KMByteBlob.instance(scratchPad, (short) 0, len);
      short arr = KMArray.instance((short) 4);
      KMArray.cast(arr).add((short) 0, KMInteger.uint_16(KMError.OK));
      KMArray.cast(arr).add((short) 1, data);
      KMArray.cast(arr).add((short) 2, recipientStructure);
      // represents there is more output to retrieve
      KMArray.cast(arr).add((short) 3, KMInteger.uint_8(moreData));
      KMKeymasterApplet.sendOutgoing(apdu, arr);
    } catch (Exception e) {
      clearDataTable();
      releaseOperation();
      throw e;
    }
  }

  public void process(short ins, APDU apdu) throws Exception {
    switch (ins) {
      case KMKeymasterApplet.INS_GET_RKP_HARDWARE_INFO:
        processGetRkpHwInfoCmd(apdu);
        break;
      case KMKeymasterApplet.INS_GENERATE_RKP_KEY_CMD:
        processGenerateRkpKey(apdu);
        break;
      case KMKeymasterApplet.INS_BEGIN_SEND_DATA_CMD:
        processBeginSendData(apdu);
        break;
      case KMKeymasterApplet.INS_UPDATE_KEY_CMD:
        processUpdateKey(apdu);
        break;
      case KMKeymasterApplet.INS_UPDATE_EEK_CHAIN_CMD:
        processUpdateEekChain(apdu);
        break;
      case KMKeymasterApplet.INS_UPDATE_CHALLENGE_CMD:
        processUpdateChallenge(apdu);
        break;
      case KMKeymasterApplet.INS_FINISH_SEND_DATA_CMD:
        processFinishSendData(apdu);
        break;
      case KMKeymasterApplet.INS_GET_RESPONSE_CMD:
        processGetResponse(apdu);
        break;
      default:
        ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);
    }
  }

  private boolean isAdditionalCertificateChainPresent() {
    if (!IS_ACC_SUPPORTED_IN_RKP_SERVER || (TRUE == data[getEntry(TEST_MODE)])) {
      // Don't include AdditionalCertificateChain in ProtectedData if either
      // 1. RKP server does not support processing of X.509 Additional Certificate Chain.
      // 2. Requested CSR for test mode.
      return false;
    }
    return (storeDataInst.getAdditionalCertChainLength() == 0 ? false : true);
  }

  private short processFinalData(byte[] scratchPad) {
    // Call finish on AES GCM Cipher
    short empty = repository.alloc((short) 0);
    short len =
        ((KMOperation) operation[0])
            .finish(repository.getHeap(), (short) empty, (short) 0, scratchPad, (short) 0);
    return len;
  }

  private byte getCurrentOutputProcessingState() {
    short index = getEntry(RESPONSE_PROCESSING_STATE);
    if (index == 0) {
      return START_PROCESSING;
    }
    return data[index];
  }

  private void updateOutputProcessingState(byte state) {
    short dataEntryIndex = getEntry(RESPONSE_PROCESSING_STATE);
    data[dataEntryIndex] = state;
  }

  /**
   * Validates the CoseMac message and extracts the CoseKey from it.
   *
   * @param coseMacPtr CoseMac instance to be validated.
   * @param scratchPad Scratch buffer used to store temp results.
   * @return CoseKey instance.
   */
  private short validateAndExtractPublicKey(short coseMacPtr, byte[] scratchPad) {
    boolean testMode = (TRUE == data[getEntry(TEST_MODE)]) ? true : false;
    // Exp for KMCoseHeaders
    short coseHeadersExp = KMCoseHeaders.exp();
    // Exp for coseky
    short coseKeyExp = KMCoseKey.exp();

    // validate protected Headers
    short ptr = KMArray.cast(coseMacPtr).get(KMCose.COSE_MAC0_PROTECTED_PARAMS_OFFSET);
    ptr =
        decoder.decode(
            coseHeadersExp,
            KMByteBlob.cast(ptr).getBuffer(),
            KMByteBlob.cast(ptr).getStartOff(),
            KMByteBlob.cast(ptr).length());

    if (!KMCoseHeaders.cast(ptr)
        .isDataValid(rkpTmpVariables, KMCose.COSE_ALG_HMAC_256, KMType.INVALID_VALUE)) {
      KMException.throwIt(KMError.STATUS_FAILED);
    }

    // Validate payload.
    ptr = KMArray.cast(coseMacPtr).get(KMCose.COSE_MAC0_PAYLOAD_OFFSET);
    ptr =
        decoder.decode(
            coseKeyExp,
            KMByteBlob.cast(ptr).getBuffer(),
            KMByteBlob.cast(ptr).getStartOff(),
            KMByteBlob.cast(ptr).length());

    if (!KMCoseKey.cast(ptr)
        .isDataValid(
            rkpTmpVariables,
            KMCose.COSE_KEY_TYPE_EC2,
            KMType.INVALID_VALUE,
            KMCose.COSE_ALG_ES256,
            KMCose.COSE_ECCURVE_256)) {
      KMException.throwIt(KMError.STATUS_FAILED);
    }

    boolean isTestKey = KMCoseKey.cast(ptr).isTestKey();
    if (isTestKey && !testMode) {
      KMException.throwIt(KMError.STATUS_TEST_KEY_IN_PRODUCTION_REQUEST);
    } else if (!isTestKey && testMode) {
      KMException.throwIt(KMError.STATUS_PRODUCTION_KEY_IN_TEST_REQUEST);
    }

    // Compute CoseMac Structure and compare the macs.
    short macStructure =
        KMCose.constructCoseMacStructure(
            KMArray.cast(coseMacPtr).get(KMCose.COSE_MAC0_PROTECTED_PARAMS_OFFSET),
            KMByteBlob.instance((short) 0),
            KMArray.cast(coseMacPtr).get(KMCose.COSE_MAC0_PAYLOAD_OFFSET));
    short encodedLen =
        KMKeymasterApplet.encodeToApduBuffer(
            macStructure, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);

    short hmacLen =
        rkpHmacSign(testMode, scratchPad, (short) 0, encodedLen, scratchPad, encodedLen);

    if (hmacLen
        != KMByteBlob.cast(KMArray.cast(coseMacPtr).get(KMCose.COSE_MAC0_TAG_OFFSET)).length()) {
      KMException.throwIt(KMError.STATUS_INVALID_MAC);
    }

    if (0
        != Util.arrayCompare(
            scratchPad,
            encodedLen,
            KMByteBlob.cast(KMArray.cast(coseMacPtr).get(KMCose.COSE_MAC0_TAG_OFFSET)).getBuffer(),
            KMByteBlob.cast(KMArray.cast(coseMacPtr).get(KMCose.COSE_MAC0_TAG_OFFSET))
                .getStartOff(),
            hmacLen)) {
      KMException.throwIt(KMError.STATUS_INVALID_MAC);
    }
    return ptr;
  }

  /**
   * This function validates the EEK Chain and extracts the leaf public key, which is used to
   * generate shared secret using ECDH.
   *
   * @param eekArr EEK cert chain array pointer.
   * @param scratchPad Scratch buffer used to store temp results.
   * @return CoseKey instance.
   */
  private short validateAndExtractEekPub(short eekArr, byte[] scratchPad) {
    short leafPubKey = 0;
    try {
      leafPubKey =
          KMKeymasterApplet.validateCertChain(
              (TRUE == data[getEntry(TEST_MODE)]) ? false : true, // validate EEK root
              KMCose.COSE_ALG_ES256,
              KMCose.COSE_ALG_ECDH_ES_HKDF_256,
              eekArr,
              scratchPad,
              authorizedEekRoots);
    } catch (KMException e) {
      KMException.throwIt(KMError.STATUS_INVALID_EEK);
    }
    return leafPubKey;
  }

  private void validateKeysToSignCount() {
    short index = getEntry(KEYS_TO_SIGN_COUNT);
    short keysToSignCount = 0;
    if (index != 0) {
      keysToSignCount = Util.getShort(data, index);
    }
    if (Util.getShort(data, getEntry(TOTAL_KEYS_TO_SIGN)) <= keysToSignCount) {
      // Mismatch in the number of keys sent.
      ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);
    }
  }

  private void validateState(byte expectedState) {
    short dataEntryIndex = getEntry(GENERATE_CSR_PHASE);
    if (0 == (data[dataEntryIndex] & expectedState)) {
      KMException.throwIt(KMError.INVALID_STATE);
    }
  }

  private void updateState(byte state) {
    short dataEntryIndex = getEntry(GENERATE_CSR_PHASE);
    if (dataEntryIndex == 0) {
      KMException.throwIt(KMError.INVALID_STATE);
    }
    data[dataEntryIndex] = state;
  }

  /**
   * This function constructs a Mac Structure, encode it and signs the encoded buffer with the
   * ephemeral mac key.
   */
  private void constructPartialPubKeysToSignMac(
      byte[] scratchPad, short arrayLength, short encodedCoseKeysLen) {
    short ptr;
    short len;
    short headerPtr =
        KMCose.constructHeaders(
            rkpTmpVariables,
            KMInteger.uint_8(KMCose.COSE_ALG_HMAC_256),
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE);
    // Encode the protected header as byte blob.
    len =
        KMKeymasterApplet.encodeToApduBuffer(
            headerPtr, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    short protectedHeader = KMByteBlob.instance(scratchPad, (short) 0, len);
    // create MAC_Structure
    ptr =
        KMCose.constructCoseMacStructure(
            protectedHeader, KMByteBlob.instance((short) 0), KMType.INVALID_VALUE);
    // Encode the Mac_structure and do HMAC_Sign to produce the tag for COSE_MAC0
    len =
        KMKeymasterApplet.encodeToApduBuffer(
            ptr, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    // Construct partial payload - Bstr Header + Array Header
    // The maximum combined length of bstr header and array header length is 6 bytes.
    // The lengths will never exceed Max SHORT value.
    short arrPtr = KMArray.instance(arrayLength);
    for (short i = 0; i < arrayLength; i++) {
      KMArray.cast(arrPtr).add(i, KMType.INVALID_VALUE);
    }
    arrayLength = encoder.getEncodedLength(arrPtr);
    short bufIndex = repository.alloc((short) 6);
    short partialPayloadLen =
        encoder.encodeByteBlobHeader(
            (short) (arrayLength + encodedCoseKeysLen), repository.getHeap(), bufIndex, (short) 3);

    partialPayloadLen +=
        encoder.encode(
            arrPtr,
            repository.getHeap(),
            (short) (bufIndex + partialPayloadLen),
            repository.getHeapReclaimIndex());
    Util.arrayCopyNonAtomic(repository.getHeap(), bufIndex, scratchPad, len, partialPayloadLen);
    ((KMOperation) operation[0]).update(scratchPad, (short) 0, (short) (len + partialPayloadLen));
  }

  private short createSignedMac(
      KMKey deviceUniqueKeyPair, byte[] scratchPad, short deviceMapPtr, short pubKeysToSign) {
    // Challenge
    short dataEntryIndex = getEntry(CHALLENGE);
    short challengePtr = KMByteBlob.instance(data, dataEntryIndex, getEntryLength(CHALLENGE));
    // Ephemeral mac key
    dataEntryIndex = getEntry(EPHEMERAL_MAC_KEY);
    short ephmeralMacKey =
        KMByteBlob.instance(data, dataEntryIndex, getEntryLength(EPHEMERAL_MAC_KEY));

    /* Prepare AAD */
    short aad = KMArray.instance((short) 3);
    KMArray.cast(aad).add((short) 0, challengePtr);
    KMArray.cast(aad).add((short) 1, deviceMapPtr);
    KMArray.cast(aad).add((short) 2, pubKeysToSign);
    aad =
        KMKeymasterApplet.encodeToApduBuffer(
            aad, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    aad = KMByteBlob.instance(scratchPad, (short) 0, aad);

    /* construct protected header */
    short protectedHeaders =
        KMCose.constructHeaders(
            rkpTmpVariables,
            KMNInteger.uint_8(KMCose.COSE_ALG_ES256),
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE);
    protectedHeaders =
        KMKeymasterApplet.encodeToApduBuffer(
            protectedHeaders, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    protectedHeaders = KMByteBlob.instance(scratchPad, (short) 0, protectedHeaders);

    /* construct cose sign structure */
    short signStructure = KMCose.constructCoseSignStructure(protectedHeaders, aad, ephmeralMacKey);
    signStructure =
        KMKeymasterApplet.encodeToApduBuffer(
            signStructure, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    // 72 is the maximum ECDSA Signature length.
    short maxEcdsaSignLen = 72;
    short reclaimIndex = repository.allocReclaimableMemory(maxEcdsaSignLen);
    short len =
        seProvider.signWithDeviceUniqueKey(
            deviceUniqueKeyPair,
            scratchPad,
            (short) 0,
            signStructure,
            repository.getHeap(),
            reclaimIndex);
    Util.arrayCopyNonAtomic(repository.getHeap(), reclaimIndex, scratchPad, (short) 0, len);
    repository.reclaimMemory(maxEcdsaSignLen);
    len =
        KMAsn1Parser.instance()
            .decodeEcdsa256Signature(
                KMByteBlob.instance(scratchPad, (short) 0, len), scratchPad, (short) 0);
    signStructure = KMByteBlob.instance(scratchPad, (short) 0, len);

    /* Construct unprotected headers */
    short unprotectedHeader = KMArray.instance((short) 0);
    unprotectedHeader = KMCoseHeaders.instance(unprotectedHeader);

    /* construct Cose_Sign1 */
    return KMCose.constructCoseSign1(
        protectedHeaders, unprotectedHeader, ephmeralMacKey, signStructure);
  }

  private KMKey createDeviceUniqueKeyPair(boolean testMode, byte[] scratchPad) {
    KMKey deviceUniqueKeyPair;
    rkpTmpVariables[0] = 0;
    rkpTmpVariables[1] = 0;
    if (testMode) {
      seProvider.createAsymmetricKey(
          KMType.EC,
          scratchPad,
          (short) 0,
          (short) 128,
          scratchPad,
          (short) 128,
          (short) 128,
          rkpTmpVariables);
      deviceUniqueKeyPair =
          storeDataInst.createRkpTestDeviceUniqueKeyPair(
              scratchPad,
              (short) 128,
              rkpTmpVariables[1],
              scratchPad,
              (short) 0,
              rkpTmpVariables[0]);
    } else {
      deviceUniqueKeyPair = storeDataInst.getRkpDeviceUniqueKeyPair(false);
    }
    return deviceUniqueKeyPair;
  }

  /**
   * DeviceInfo is a CBOR Map structure described by the following CDDL.
   *
   * <p>DeviceInfo = { "brand" : tstr, "manufacturer" : tstr, "product" : tstr, "model" : tstr,
   * "device" : tstr, "vb_state" : "green" / "yellow" / "orange", // Taken from the AVB values
   * "bootloader_state" : "locked" / "unlocked", // Taken from the AVB values "vbmeta_digest": bstr,
   * // Taken from the AVB values ? "os_version" : tstr, // Same as android.os.Build.VERSION.release
   * "system_patch_level" : uint, // YYYYMMDD "boot_patch_level" : uint, //YYYYMMDD
   * "vendor_patch_level" : uint, // YYYYMMDD "version" : 2, // TheCDDL schema version
   * "security_level" : "tee" / "strongbox" "fused": 1 / 0, }
   */
  private short createDeviceInfo(byte[] scratchpad) {
    // Device Info Key Value pairs.
    for (short i = 0; i < 32; i++) {
      rkpTmpVariables[i] = KMType.INVALID_VALUE;
    }
    short dataOffset = 2;
    rkpTmpVariables[0] = dataOffset;
    rkpTmpVariables[1] = 0;
    short metaOffset = 0;
    updateItem(
        rkpTmpVariables,
        metaOffset,
        BRAND,
        getAttestationId(KMType.ATTESTATION_ID_BRAND, scratchpad));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        MANUFACTURER,
        getAttestationId(KMType.ATTESTATION_ID_MANUFACTURER, scratchpad));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        PRODUCT,
        getAttestationId(KMType.ATTESTATION_ID_PRODUCT, scratchpad));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        MODEL,
        getAttestationId(KMType.ATTESTATION_ID_MODEL, scratchpad));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        DEVICE,
        getAttestationId(KMType.ATTESTATION_ID_DEVICE, scratchpad));
    updateItem(rkpTmpVariables, metaOffset, VB_STATE, getVbState());
    updateItem(rkpTmpVariables, metaOffset, BOOTLOADER_STATE, getBootloaderState());
    updateItem(rkpTmpVariables, metaOffset, VB_META_DIGEST, getVerifiedBootHash(scratchpad));
    updateItem(rkpTmpVariables, metaOffset, OS_VERSION, getBootParams(OS_VERSION_ID, scratchpad));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        SYSTEM_PATCH_LEVEL,
        getBootParams(SYSTEM_PATCH_LEVEL_ID, scratchpad));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        BOOT_PATCH_LEVEL,
        getBootParams(BOOT_PATCH_LEVEL_ID, scratchpad));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        VENDOR_PATCH_LEVEL,
        getBootParams(VENDOR_PATCH_LEVEL_ID, scratchpad));
    updateItem(
        rkpTmpVariables, metaOffset, DEVICE_INFO_VERSION, KMInteger.uint_8(DI_SCHEMA_VERSION));
    updateItem(
        rkpTmpVariables,
        metaOffset,
        SECURITY_LEVEL,
        KMTextString.instance(DI_SECURITY_LEVEL, (short) 0, (short) DI_SECURITY_LEVEL.length));
    updateItem(rkpTmpVariables, metaOffset, FUSED, KMInteger.uint_8(storeDataInst.secureBootMode));
    // Create device info map.
    short map = KMMap.instance(rkpTmpVariables[1]);
    short mapIndex = 0;
    short index = 2;
    while (index < (short) 32) {
      if (rkpTmpVariables[index] != KMType.INVALID_VALUE) {
        KMMap.cast(map)
            .add(mapIndex++, rkpTmpVariables[index], rkpTmpVariables[(short) (index + 1)]);
      }
      index += 2;
    }
    KMMap.cast(map).canonicalize();
    return map;
  }

  // Below 6 methods are helper methods to create device info structure.
  // ----------------------------------------------------------------------------

  /**
   * Update the item inside the device info structure.
   *
   * @param deviceIds Device Info structure to be updated.
   * @param metaOffset Out parameter meta information. Offset 0 is index and Offset 1 is length.
   * @param item Key info to be updated.
   * @param value value to be updated.
   */
  private void updateItem(short[] deviceIds, short metaOffset, byte[] item, short value) {
    if (KMType.INVALID_VALUE != value) {
      deviceIds[deviceIds[metaOffset]++] =
          KMTextString.instance(item, (short) 0, (short) item.length);
      deviceIds[deviceIds[metaOffset]++] = value;
      deviceIds[(short) (metaOffset + 1)]++;
    }
  }

  private short getAttestationId(short attestId, byte[] scratchpad) {
    short attIdTagLen = storeDataInst.getAttestationId(attestId, scratchpad, (short) 0);
    if (attIdTagLen == 0) {
      KMException.throwIt(KMError.INVALID_STATE);
    }
    return KMTextString.instance(scratchpad, (short) 0, attIdTagLen);
  }

  private short getVerifiedBootHash(byte[] scratchPad) {
    short len = storeDataInst.getVerifiedBootHash(scratchPad, (short) 0);
    if (len == 0) {
      KMException.throwIt(KMError.INVALID_STATE);
    }
    return KMByteBlob.instance(scratchPad, (short) 0, len);
  }

  private short getBootloaderState() {
    short bootloaderState;
    if (storeDataInst.isDeviceBootLocked()) {
      bootloaderState = KMTextString.instance(LOCKED, (short) 0, (short) LOCKED.length);
    } else {
      bootloaderState = KMTextString.instance(UNLOCKED, (short) 0, (short) UNLOCKED.length);
    }
    return bootloaderState;
  }

  private short getVbState() {
    short state = storeDataInst.getBootState();
    short vbState = KMType.INVALID_VALUE;
    if (state == KMType.VERIFIED_BOOT) {
      vbState = KMTextString.instance(VB_STATE_GREEN, (short) 0, (short) VB_STATE_GREEN.length);
    } else if (state == KMType.SELF_SIGNED_BOOT) {
      vbState = KMTextString.instance(VB_STATE_YELLOW, (short) 0, (short) VB_STATE_YELLOW.length);
    } else if (state == KMType.UNVERIFIED_BOOT) {
      vbState = KMTextString.instance(VB_STATE_ORANGE, (short) 0, (short) VB_STATE_ORANGE.length);
    } else if (state == KMType.FAILED_BOOT) {
      vbState = KMTextString.instance(VB_STATE_RED, (short) 0, (short) VB_STATE_RED.length);
    }
    return vbState;
  }

  private short converIntegerToTextString(short intPtr, byte[] scratchPad) {
    // Prepare Hex Values
    short index = 1;
    scratchPad[0] = 0x30; // Ascii 0
    while (index < 10) {
      scratchPad[index] = (byte) (scratchPad[(short) (index - 1)] + 1);
      index++;
    }
    scratchPad[index++] = 0x41; // Ascii 'A'
    while (index < 16) {
      scratchPad[index] = (byte) (scratchPad[(short) (index - 1)] + 1);
      index++;
    }

    short intLen = KMInteger.cast(intPtr).length();
    short intOffset = KMInteger.cast(intPtr).getStartOff();
    byte[] buf = repository.getHeap();
    short tsPtr = KMTextString.instance((short) (intLen * 2));
    short tsStartOff = KMTextString.cast(tsPtr).getStartOff();
    index = 0;
    byte nibble;
    while (index < intLen) {
      nibble = (byte) ((byte) (buf[intOffset] >> 4) & (byte) 0x0F);
      buf[tsStartOff] = scratchPad[nibble];
      nibble = (byte) (buf[intOffset] & 0x0F);
      buf[(short) (tsStartOff + 1)] = scratchPad[nibble];
      index++;
      intOffset++;
      tsStartOff += 2;
    }
    return tsPtr;
  }

  private short getBootParams(byte bootParam, byte[] scratchPad) {
    short value = KMType.INVALID_VALUE;
    switch (bootParam) {
      case OS_VERSION_ID:
        value = storeDataInst.getOsVersion();
        break;
      case SYSTEM_PATCH_LEVEL_ID:
        value = storeDataInst.getOsPatch();
        break;
      case BOOT_PATCH_LEVEL_ID:
        value = storeDataInst.getBootPatchLevel();
        break;
      case VENDOR_PATCH_LEVEL_ID:
        value = storeDataInst.getVendorPatchLevel();
        break;
      default:
        KMException.throwIt(KMError.INVALID_ARGUMENT);
    }
    // Convert Integer to Text String for OS_VERSION.
    if (bootParam == OS_VERSION_ID) {
      value = converIntegerToTextString(value, scratchPad);
    }
    return value;
  }
  // ----------------------------------------------------------------------------

  // ----------------------------------------------------------------------------
  // ECDH HKDF
  private short ecdhHkdfDeriveKey(
      byte[] privKeyA,
      short privKeyAOff,
      short privKeyALen,
      byte[] pubKeyA,
      short pubKeyAOff,
      short pubKeyALen,
      byte[] pubKeyB,
      short pubKeyBOff,
      short pubKeyBLen,
      byte[] scratchPad) {
    short key =
        seProvider.ecdhKeyAgreement(
            privKeyA,
            privKeyAOff,
            privKeyALen,
            pubKeyB,
            pubKeyBOff,
            pubKeyBLen,
            scratchPad,
            (short) 0);
    key = KMByteBlob.instance(scratchPad, (short) 0, key);

    // ignore 0x04 for ephemerical public key as kdfContext should not include 0x04.
    pubKeyAOff += 1;
    pubKeyALen -= 1;
    pubKeyBOff += 1;
    pubKeyBLen -= 1;
    short kdfContext =
        KMCose.constructKdfContext(
            pubKeyA, pubKeyAOff, pubKeyALen, pubKeyB, pubKeyBOff, pubKeyBLen, true);
    kdfContext =
        KMKeymasterApplet.encodeToApduBuffer(
            kdfContext, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    kdfContext = KMByteBlob.instance(scratchPad, (short) 0, kdfContext);

    Util.arrayFillNonAtomic(scratchPad, (short) 0, (short) 32, (byte) 0);
    seProvider.hkdf(
        KMByteBlob.cast(key).getBuffer(),
        KMByteBlob.cast(key).getStartOff(),
        KMByteBlob.cast(key).length(),
        scratchPad,
        (short) 0,
        (short) 32,
        KMByteBlob.cast(kdfContext).getBuffer(),
        KMByteBlob.cast(kdfContext).getStartOff(),
        KMByteBlob.cast(kdfContext).length(),
        scratchPad,
        (short) 32, // offset
        (short) 32 // Length of expected output.
        );
    Util.arrayCopy(scratchPad, (short) 32, scratchPad, (short) 0, (short) 32);
    return (short) 32;
  }

  // ----------------------------------------------------------------------------
  // This function returns the instance of private key and It stores the public key in the
  // data table for later usage.
  private short generateEphemeralEcKey(byte[] scratchPad) {
    // Generate ephemeral ec key.
    rkpTmpVariables[0] = 0;
    rkpTmpVariables[1] = 0;
    seProvider.createAsymmetricKey(
        KMType.EC,
        scratchPad,
        (short) 0,
        (short) 128,
        scratchPad,
        (short) 128,
        (short) 128,
        rkpTmpVariables);
    // Copy the ephemeral private key from scratch pad
    short ptr = KMByteBlob.instance(rkpTmpVariables[0]);
    Util.arrayCopyNonAtomic(
        scratchPad,
        (short) 0,
        KMByteBlob.cast(ptr).getBuffer(),
        KMByteBlob.cast(ptr).getStartOff(),
        rkpTmpVariables[0]);
    // Store  ephemeral public key in data table for later usage.
    short dataEntryIndex = createEntry(EPHEMERAL_PUB_KEY, rkpTmpVariables[1]);
    Util.arrayCopyNonAtomic(scratchPad, (short) 128, data, dataEntryIndex, rkpTmpVariables[1]);
    return ptr;
  }

  private void initHmacOperation() {
    short dataEntryIndex = getEntry(EPHEMERAL_MAC_KEY);
    operation[0] =
        seProvider.getRkpOperation(
            KMType.SIGN,
            KMType.HMAC,
            KMType.SHA2_256,
            KMType.PADDING_NONE,
            (byte) 0,
            data,
            dataEntryIndex,
            getEntryLength(EPHEMERAL_MAC_KEY),
            null,
            (short) 0,
            (short) 0,
            (short) 0);
    if (operation[0] == null) {
      KMException.throwIt(KMError.STATUS_FAILED);
    }
  }

  private void initAesGcmOperation(byte[] scratchPad, short nonce) {
    // Generate Ephemeral mac key
    short privKey = generateEphemeralEcKey(scratchPad);
    short pubKeyIndex = getEntry(EPHEMERAL_PUB_KEY);
    // Generate session key
    short eekIndex = getEntry(EEK_KEY);
    // Generate session key
    short sessionKeyLen =
        ecdhHkdfDeriveKey(
            KMByteBlob.cast(privKey).getBuffer(), /* Ephemeral Private Key */
            KMByteBlob.cast(privKey).getStartOff(),
            KMByteBlob.cast(privKey).length(),
            data, /* Ephemeral Public key */
            pubKeyIndex,
            getEntryLength(EPHEMERAL_PUB_KEY),
            data, /* EEK Public key */
            eekIndex,
            getEntryLength(EEK_KEY),
            scratchPad /* scratchpad */);
    // Initialize the Cipher object.
    operation[0] =
        seProvider.getRkpOperation(
            KMType.ENCRYPT,
            KMType.AES,
            (byte) 0,
            KMType.PADDING_NONE,
            KMType.GCM,
            scratchPad, /* key */
            (short) 0,
            sessionKeyLen,
            KMByteBlob.cast(nonce).getBuffer(), /* nonce */
            KMByteBlob.cast(nonce).getStartOff(),
            KMByteBlob.cast(nonce).length(),
            (short) (KMKeymasterApplet.AES_GCM_AUTH_TAG_LENGTH * 8));
    if (operation[0] == null) {
      KMException.throwIt(KMError.STATUS_FAILED);
    }
  }

  private short processRecipientStructure(byte[] scratchPad) {
    short protectedHeaderRecipient =
        KMCose.constructHeaders(
            rkpTmpVariables,
            KMNInteger.uint_8(KMCose.COSE_ALG_ECDH_ES_HKDF_256),
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE);
    // Encode the protected header as byte blob.
    protectedHeaderRecipient =
        KMKeymasterApplet.encodeToApduBuffer(
            protectedHeaderRecipient, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    protectedHeaderRecipient = KMByteBlob.instance(scratchPad, (short) 0, protectedHeaderRecipient);

    /* Construct unprotected headers */
    short pubKeyIndex = getEntry(EPHEMERAL_PUB_KEY);
    // prepare cosekey
    short coseKey =
        KMCose.constructCoseKey(
            rkpTmpVariables,
            KMInteger.uint_8(KMCose.COSE_KEY_TYPE_EC2),
            KMType.INVALID_VALUE,
            KMNInteger.uint_8(KMCose.COSE_ALG_ES256),
            KMInteger.uint_8(KMCose.COSE_ECCURVE_256),
            data,
            pubKeyIndex,
            getEntryLength(EPHEMERAL_PUB_KEY),
            KMType.INVALID_VALUE,
            false);
    short keyIdentifierPtr =
        KMByteBlob.instance(data, getEntry(EEK_KEY_ID), getEntryLength(EEK_KEY_ID));
    short unprotectedHeaderRecipient =
        KMCose.constructHeaders(
            rkpTmpVariables, KMType.INVALID_VALUE, keyIdentifierPtr, KMType.INVALID_VALUE, coseKey);

    // Construct recipients structure.
    return KMCose.constructRecipientsStructure(
        protectedHeaderRecipient,
        unprotectedHeaderRecipient,
        KMSimpleValue.instance(KMSimpleValue.NULL));
  }

  private short getAdditionalCertChainProcessedLength() {
    short dataEntryIndex = getEntry(ACC_PROCESSED_LENGTH);
    if (dataEntryIndex == 0) {
      dataEntryIndex = createEntry(ACC_PROCESSED_LENGTH, SHORT_SIZE);
      Util.setShort(data, dataEntryIndex, (short) 0);
      return (short) 0;
    }
    return Util.getShort(data, dataEntryIndex);
  }

  private void updateAdditionalCertChainProcessedLength(short processedLen) {
    short dataEntryIndex = getEntry(ACC_PROCESSED_LENGTH);
    Util.setShort(data, dataEntryIndex, processedLen);
  }

  private short processAdditionalCertificateChain(byte[] scratchPad) {
    byte[] persistedData = storeDataInst.getAdditionalCertChain();
    short totalAccLen = Util.getShort(persistedData, (short) 0);
    if (totalAccLen == 0) {
      // No Additional certificate chain present.
      return 0;
    }
    short processedLen = getAdditionalCertChainProcessedLength();
    short lengthToSend = (short) (totalAccLen - processedLen);
    if (lengthToSend > MAX_SEND_DATA) {
      lengthToSend = MAX_SEND_DATA;
    }
    short cipherTextLen =
        ((KMOperation) operation[0])
            .update(persistedData, (short) (2 + processedLen), lengthToSend, scratchPad, (short) 0);
    processedLen += lengthToSend;
    updateAdditionalCertChainProcessedLength(processedLen);
    // Update the output processing state.
    updateOutputProcessingState(
        (processedLen == totalAccLen) ? PROCESSING_ACC_COMPLETE : PROCESSING_ACC_IN_PROGRESS);
    return cipherTextLen;
  }

  // BCC for STRONGBOX has chain length of 2. So it can be returned in a single go.
  private short processBcc(byte[] scratchPad) {
    // Construct BCC
    boolean testMode = (TRUE == data[getEntry(TEST_MODE)]) ? true : false;
    short len;
    if (testMode) {
      short bcc = KMKeymasterApplet.generateBcc(true, scratchPad);
      len =
          KMKeymasterApplet.encodeToApduBuffer(
              bcc, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    } else {
      byte[] bcc = storeDataInst.getBootCertificateChain();
      len = Util.getShort(bcc, (short) 0);
      Util.arrayCopyNonAtomic(bcc, (short) 2, scratchPad, (short) 0, len);
    }
    short cipherTextLen =
        ((KMOperation) operation[0]).update(scratchPad, (short) 0, len, scratchPad, len);
    // move cipher text on scratch pad from starting position.
    Util.arrayCopyNonAtomic(scratchPad, len, scratchPad, (short) 0, cipherTextLen);
    createEntry(RESPONSE_PROCESSING_STATE, BYTE_SIZE);
    // If there is no additional certificate chain present then put the state to
    // PROCESSING_ACC_COMPLETE.
    updateOutputProcessingState(
        isAdditionalCertificateChainPresent() ? PROCESSING_BCC_COMPLETE : PROCESSING_ACC_COMPLETE);
    return cipherTextLen;
  }

  // AAD is the CoseEncrypt structure
  private void processAesGcmUpdateAad(byte[] scratchPad) {
    short protectedHeader =
        KMCose.constructHeaders(
            rkpTmpVariables,
            KMInteger.uint_8(KMCose.COSE_ALG_AES_GCM_256),
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE);
    // Encode the protected header as byte blob.
    protectedHeader =
        KMKeymasterApplet.encodeToApduBuffer(
            protectedHeader, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    protectedHeader = KMByteBlob.instance(scratchPad, (short) 0, protectedHeader);
    short coseEncryptStr =
        KMCose.constructCoseEncryptStructure(protectedHeader, KMByteBlob.instance((short) 0));
    coseEncryptStr =
        KMKeymasterApplet.encodeToApduBuffer(
            coseEncryptStr, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    ((KMOperation) operation[0]).updateAAD(scratchPad, (short) 0, coseEncryptStr);
  }

  private short processSignedMac(byte[] scratchPad, short pubKeysToSignMac, short deviceInfo) {
    // Construct SignedMac
    KMKey deviceUniqueKeyPair =
        createDeviceUniqueKeyPair((TRUE == data[getEntry(TEST_MODE)]) ? true : false, scratchPad);
    // Create signedMac
    short signedMac =
        createSignedMac(deviceUniqueKeyPair, scratchPad, deviceInfo, pubKeysToSignMac);
    // Prepare partial data for encryption.
    short arrLength = (short) (isAdditionalCertificateChainPresent() ? 3 : 2);
    short arr = KMArray.instance(arrLength);
    KMArray.cast(arr).add((short) 0, signedMac);
    KMArray.cast(arr).add((short) 1, KMType.INVALID_VALUE);
    if (arrLength == 3) {
      KMArray.cast(arr).add((short) 2, KMType.INVALID_VALUE);
    }
    short len =
        KMKeymasterApplet.encodeToApduBuffer(
            arr, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    short cipherTextLen =
        ((KMOperation) operation[0]).update(scratchPad, (short) 0, len, scratchPad, len);
    Util.arrayCopyNonAtomic(scratchPad, len, scratchPad, (short) 0, cipherTextLen);
    return cipherTextLen;
  }

  private short getCoseEncryptProtectedHeader(byte[] scratchPad) {
    // CoseEncrypt protected headers.
    short protectedHeader =
        KMCose.constructHeaders(
            rkpTmpVariables,
            KMInteger.uint_8(KMCose.COSE_ALG_AES_GCM_256),
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE);
    // Encode the protected header as byte blob.
    protectedHeader =
        KMKeymasterApplet.encodeToApduBuffer(
            protectedHeader, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    return KMByteBlob.instance(scratchPad, (short) 0, protectedHeader);
  }

  private short getCoseEncryptUnprotectedHeader(byte[] scratchPad, short nonce) {
    /* CoseEncrypt unprotected headers */
    return KMCose.constructHeaders(
        rkpTmpVariables, KMType.INVALID_VALUE, KMType.INVALID_VALUE, nonce, KMType.INVALID_VALUE);
  }

  private short constructCoseMacForRkpKey(boolean testMode, byte[] scratchPad, short pubKey) {
    // prepare cosekey
    short coseKey =
        KMCose.constructCoseKey(
            rkpTmpVariables,
            KMInteger.uint_8(KMCose.COSE_KEY_TYPE_EC2),
            KMType.INVALID_VALUE,
            KMNInteger.uint_8(KMCose.COSE_ALG_ES256),
            KMInteger.uint_8(KMCose.COSE_ECCURVE_256),
            KMByteBlob.cast(pubKey).getBuffer(),
            KMByteBlob.cast(pubKey).getStartOff(),
            KMByteBlob.cast(pubKey).length(),
            KMType.INVALID_VALUE,
            testMode);
    // Encode the cose key and make it as payload.
    short len =
        KMKeymasterApplet.encodeToApduBuffer(
            coseKey, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    short payload = KMByteBlob.instance(scratchPad, (short) 0, len);
    // Prepare protected header, which is required to construct the COSE_MAC0
    short headerPtr =
        KMCose.constructHeaders(
            rkpTmpVariables,
            KMInteger.uint_8(KMCose.COSE_ALG_HMAC_256),
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE,
            KMType.INVALID_VALUE);
    // Encode the protected header as byte blob.
    len =
        KMKeymasterApplet.encodeToApduBuffer(
            headerPtr, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    short protectedHeader = KMByteBlob.instance(scratchPad, (short) 0, len);
    // create MAC_Structure
    short macStructure =
        KMCose.constructCoseMacStructure(protectedHeader, KMByteBlob.instance((short) 0), payload);
    // Encode the Mac_structure and do HMAC_Sign to produce the tag for COSE_MAC0
    len =
        KMKeymasterApplet.encodeToApduBuffer(
            macStructure, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    // HMAC Sign.
    short hmacLen = rkpHmacSign(testMode, scratchPad, (short) 0, len, scratchPad, len);
    // Create COSE_MAC0 object
    short coseMac0 =
        KMCose.constructCoseMac0(
            protectedHeader,
            KMCoseHeaders.instance(KMArray.instance((short) 0)),
            payload,
            KMByteBlob.instance(scratchPad, len, hmacLen));
    len =
        KMKeymasterApplet.encodeToApduBuffer(
            coseMac0, scratchPad, (short) 0, KMKeymasterApplet.MAX_COSE_BUF_SIZE);
    return KMByteBlob.instance(scratchPad, (short) 0, len);
  }

  private short getEcAttestKeyParameters() {
    short tagIndex = 0;
    short arrPtr = KMArray.instance((short) 6);
    // Key size - 256
    short keySize =
        KMIntegerTag.instance(KMType.UINT_TAG, KMType.KEYSIZE, KMInteger.uint_16((short) 256));
    // Digest - SHA256
    short byteBlob = KMByteBlob.instance((short) 1);
    KMByteBlob.cast(byteBlob).add((short) 0, KMType.SHA2_256);
    short digest = KMEnumArrayTag.instance(KMType.DIGEST, byteBlob);
    // Purpose - Attest
    byteBlob = KMByteBlob.instance((short) 1);
    KMByteBlob.cast(byteBlob).add((short) 0, KMType.ATTEST_KEY);
    short purpose = KMEnumArrayTag.instance(KMType.PURPOSE, byteBlob);

    KMArray.cast(arrPtr).add(tagIndex++, purpose);
    // Algorithm - EC
    KMArray.cast(arrPtr).add(tagIndex++, KMEnumTag.instance(KMType.ALGORITHM, KMType.EC));
    KMArray.cast(arrPtr).add(tagIndex++, keySize);
    KMArray.cast(arrPtr).add(tagIndex++, digest);
    // Curve - P256
    KMArray.cast(arrPtr).add(tagIndex++, KMEnumTag.instance(KMType.ECCURVE, KMType.P_256));
    // No Authentication is required to use this key.
    KMArray.cast(arrPtr).add(tagIndex, KMBoolTag.instance(KMType.NO_AUTH_REQUIRED));
    return KMKeyParameters.instance(arrPtr);
  }

  private boolean isSignedByte(byte b) {
    return ((b & 0x0080) != 0);
  }

  private short writeIntegerHeader(short valueLen, byte[] data, short offset) {
    // write length
    data[offset] = (byte) valueLen;
    // write INTEGER tag
    offset--;
    data[offset] = 0x02;
    return offset;
  }

  private short writeSequenceHeader(short valueLen, byte[] data, short offset) {
    // write length
    data[offset] = (byte) valueLen;
    // write INTEGER tag
    offset--;
    data[offset] = 0x30;
    return offset;
  }

  private short writeSignatureData(
      byte[] input, short inputOff, short inputlen, byte[] output, short offset) {
    Util.arrayCopyNonAtomic(input, inputOff, output, offset, inputlen);
    if (isSignedByte(input[inputOff])) {
      offset--;
      output[offset] = (byte) 0;
    }
    return offset;
  }

  public short encodeES256CoseSignSignature(
      byte[] input, short offset, short len, byte[] scratchPad, short scratchPadOff) {
    // SEQ [ INTEGER(r), INTEGER(s)]
    // write from bottom to the top
    if (len != 64) {
      KMException.throwIt(KMError.INVALID_DATA);
    }
    short maxTotalLen = 72;
    short end = (short) (scratchPadOff + maxTotalLen);
    // write s.
    short start = (short) (end - 32);
    start = writeSignatureData(input, (short) (offset + 32), (short) 32, scratchPad, start);
    // write length and header
    short length = (short) (end - start);
    start--;
    start = writeIntegerHeader(length, scratchPad, start);
    // write r
    short rEnd = start;
    start = (short) (start - 32);
    start = writeSignatureData(input, offset, (short) 32, scratchPad, start);
    // write length and header
    length = (short) (rEnd - start);
    start--;
    start = writeIntegerHeader(length, scratchPad, start);
    // write length and sequence header
    length = (short) (end - start);
    start--;
    start = writeSequenceHeader(length, scratchPad, start);
    length = (short) (end - start);
    if (start > scratchPadOff) {
      // re adjust the buffer
      Util.arrayCopyNonAtomic(scratchPad, start, scratchPad, scratchPadOff, length);
    }
    return length;
  }

  private short rkpHmacSign(
      boolean testMode,
      byte[] data,
      short dataStart,
      short dataLength,
      byte[] signature,
      short signatureStart) {
    short result;
    if (testMode) {
      short macKey = KMByteBlob.instance(EPHEMERAL_MAC_KEY_SIZE);
      Util.arrayFillNonAtomic(
          KMByteBlob.cast(macKey).getBuffer(),
          KMByteBlob.cast(macKey).getStartOff(),
          EPHEMERAL_MAC_KEY_SIZE,
          (byte) 0);
      result =
          seProvider.hmacSign(
              KMByteBlob.cast(macKey).getBuffer(),
              KMByteBlob.cast(macKey).getStartOff(),
              EPHEMERAL_MAC_KEY_SIZE,
              data,
              dataStart,
              dataLength,
              signature,
              signatureStart);
    } else {
      result =
          seProvider.hmacSign(
              storeDataInst.getRkpMacKey(), data, dataStart, dataLength, signature, signatureStart);
    }
    return result;
  }
}