1*789431f2SAndroid Build Coastguard Worker# Fuzzers for libkeymaster4 2*789431f2SAndroid Build Coastguard Worker 3*789431f2SAndroid Build Coastguard Worker## Plugin Design Considerations 4*789431f2SAndroid Build Coastguard WorkerThe fuzzer plugins for libkeymaster4 are designed based on the understanding of the 5*789431f2SAndroid Build Coastguard Workersource code and try to achieve the following: 6*789431f2SAndroid Build Coastguard Worker 7*789431f2SAndroid Build Coastguard Worker##### Maximize code coverage 8*789431f2SAndroid Build Coastguard WorkerThe configuration parameters are not hardcoded, but instead selected based on 9*789431f2SAndroid Build Coastguard Workerincoming data. This ensures more code paths are reached by the fuzzers. 10*789431f2SAndroid Build Coastguard Worker 11*789431f2SAndroid Build Coastguard Workerlibkeymaster4 supports the following parameters: 12*789431f2SAndroid Build Coastguard Worker1. Security Level (parameter name: `securityLevel`) 13*789431f2SAndroid Build Coastguard Worker2. Padding Mode (parameter name: `paddingMode`) 14*789431f2SAndroid Build Coastguard Worker3. Digest (parameter name: `digest`) 15*789431f2SAndroid Build Coastguard Worker4. Key Format (parameter name: `keyFormat`) 16*789431f2SAndroid Build Coastguard Worker5. Key Purpose (parameter name: `keyPurpose`) 17*789431f2SAndroid Build Coastguard Worker 18*789431f2SAndroid Build Coastguard Worker| Parameter| Valid Values| Configured Value| 19*789431f2SAndroid Build Coastguard Worker|------------- |-------------| ----- | 20*789431f2SAndroid Build Coastguard Worker| `securityLevel` | 0.`SecurityLevel::SOFTWARE` 1.`SecurityLevel::TRUSTED_ENVIRONMENT` 2.`SecurityLevel::STRONGBOX`| Value obtained from FuzzedDataProvider| 21*789431f2SAndroid Build Coastguard Worker| `paddingMode` | 0.`PaddingMode::NONE` 1.`PaddingMode::RSA_OAEP` 2.`PaddingMode::RSA_PSS` 3. `PaddingMode::RSA_PKCS1_1_5_ENCRYPT` 4.`PaddingMode::RSA_PKCS1_1_5_SIGN` 5.`PaddingMode::PKCS7`| Value obtained from FuzzedDataProvider| 22*789431f2SAndroid Build Coastguard Worker| `digest` | 1. `Digest::NONE` 2.`Digest::MD5` 3.`Digest::SHA1` 4.`Digest::SHA_2_224` 5.`Digest::SHA_2_256` 6.`Digest::SHA_2_384` 7.`Digest::SHA_2_512`| Value obtained from FuzzedDataProvider| 23*789431f2SAndroid Build Coastguard Worker| `keyFormat` | 1. `KeyFormat::X509` 2.`KeyFormat::PKCS8` 3.`KeyFormat::RAW`| Value obtained from FuzzedDataProvider| 24*789431f2SAndroid Build Coastguard Worker| `keyPurpose` | 1. `KeyPurpose::ENCRYPT` 2.`KeyPurpose::DECRYPT` 3.`KeyPurpose::SIGN` 4. `KeyPurpose::VERIFY` 5. `KeyPurpose::WRAP_KEY`| Value obtained from FuzzedDataProvider| 25*789431f2SAndroid Build Coastguard Worker 26*789431f2SAndroid Build Coastguard WorkerThis also ensures that the plugins are always deterministic for any given input. 27*789431f2SAndroid Build Coastguard Worker 28*789431f2SAndroid Build Coastguard Worker##### Maximize utilization of input data 29*789431f2SAndroid Build Coastguard WorkerThe plugins feed the entire input data to the module. 30*789431f2SAndroid Build Coastguard WorkerThis ensures that the plugins tolerate any kind of input (empty, huge, 31*789431f2SAndroid Build Coastguard Workermalformed, etc) and dont `exit()` on any input and thereby increasing the 32*789431f2SAndroid Build Coastguard Workerchance of identifying vulnerabilities. 33*789431f2SAndroid Build Coastguard Worker 34*789431f2SAndroid Build Coastguard Worker## Build 35*789431f2SAndroid Build Coastguard Worker 36*789431f2SAndroid Build Coastguard WorkerThis describes steps to build k4_AndroidKeymaster4Device_fuzzer binary 37*789431f2SAndroid Build Coastguard Worker 38*789431f2SAndroid Build Coastguard Worker### Android 39*789431f2SAndroid Build Coastguard Worker 40*789431f2SAndroid Build Coastguard Worker#### Steps to build 41*789431f2SAndroid Build Coastguard WorkerBuild the fuzzer 42*789431f2SAndroid Build Coastguard Worker``` 43*789431f2SAndroid Build Coastguard Worker $ mm k4_AndroidKeymaster4Device_fuzzer 44*789431f2SAndroid Build Coastguard Worker``` 45*789431f2SAndroid Build Coastguard Worker#### Steps to run 46*789431f2SAndroid Build Coastguard WorkerTo run on device 47*789431f2SAndroid Build Coastguard Worker``` 48*789431f2SAndroid Build Coastguard Worker $ adb sync data 49*789431f2SAndroid Build Coastguard Worker $ adb shell /data/fuzz/${TARGET_ARCH}/k4_AndroidKeymaster4Device_fuzzer/k4_AndroidKeymaster4Device_fuzzer 50*789431f2SAndroid Build Coastguard Worker``` 51*789431f2SAndroid Build Coastguard Worker 52*789431f2SAndroid Build Coastguard Worker## References: 53*789431f2SAndroid Build Coastguard Worker * http://llvm.org/docs/LibFuzzer.html 54*789431f2SAndroid Build Coastguard Worker * https://github.com/google/oss-fuzz 55