xref: /aosp_15_r20/system/keymaster/ng/KeyMintUtils.cpp (revision 789431f29546679ab5188a97751fb38e3018d44d)
1*789431f2SAndroid Build Coastguard Worker /*
2*789431f2SAndroid Build Coastguard Worker  * Copyright 2020, The Android Open Source Project
3*789431f2SAndroid Build Coastguard Worker  *
4*789431f2SAndroid Build Coastguard Worker  * Licensed under the Apache License, Version 2.0 (the "License");
5*789431f2SAndroid Build Coastguard Worker  * you may not use this file except in compliance with the License.
6*789431f2SAndroid Build Coastguard Worker  * You may obtain a copy of the License at
7*789431f2SAndroid Build Coastguard Worker  *
8*789431f2SAndroid Build Coastguard Worker  *     http://www.apache.org/licenses/LICENSE-2.0
9*789431f2SAndroid Build Coastguard Worker  *
10*789431f2SAndroid Build Coastguard Worker  * Unless required by applicable law or agreed to in writing, software
11*789431f2SAndroid Build Coastguard Worker  * distributed under the License is distributed on an "AS IS" BASIS,
12*789431f2SAndroid Build Coastguard Worker  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13*789431f2SAndroid Build Coastguard Worker  * See the License for the specific language governing permissions and
14*789431f2SAndroid Build Coastguard Worker  * limitations under the License.
15*789431f2SAndroid Build Coastguard Worker  */
16*789431f2SAndroid Build Coastguard Worker 
17*789431f2SAndroid Build Coastguard Worker #define LOG_TAG "android.hardware.security.keymint-impl"
18*789431f2SAndroid Build Coastguard Worker #include <android-base/logging.h>
19*789431f2SAndroid Build Coastguard Worker 
20*789431f2SAndroid Build Coastguard Worker #include "KeyMintUtils.h"
21*789431f2SAndroid Build Coastguard Worker 
22*789431f2SAndroid Build Coastguard Worker namespace aidl::android::hardware::security::keymint::km_utils {
23*789431f2SAndroid Build Coastguard Worker 
24*789431f2SAndroid Build Coastguard Worker namespace {
25*789431f2SAndroid Build Coastguard Worker 
26*789431f2SAndroid Build Coastguard Worker using keymaster::hton;
27*789431f2SAndroid Build Coastguard Worker 
kmEnumParam2Aidl(const keymaster_key_param_t & param)28*789431f2SAndroid Build Coastguard Worker KeyParameter kmEnumParam2Aidl(const keymaster_key_param_t& param) {
29*789431f2SAndroid Build Coastguard Worker     switch (param.tag) {
30*789431f2SAndroid Build Coastguard Worker     case KM_TAG_PURPOSE:
31*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::PURPOSE, KeyParameterValue::make<KeyParameterValue::keyPurpose>(
32*789431f2SAndroid Build Coastguard Worker                                               static_cast<KeyPurpose>(param.enumerated))};
33*789431f2SAndroid Build Coastguard Worker     case KM_TAG_ALGORITHM:
34*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::ALGORITHM, KeyParameterValue::make<KeyParameterValue::algorithm>(
35*789431f2SAndroid Build Coastguard Worker                                                 static_cast<Algorithm>(param.enumerated))};
36*789431f2SAndroid Build Coastguard Worker     case KM_TAG_BLOCK_MODE:
37*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::BLOCK_MODE, KeyParameterValue::make<KeyParameterValue::blockMode>(
38*789431f2SAndroid Build Coastguard Worker                                                  static_cast<BlockMode>(param.enumerated))};
39*789431f2SAndroid Build Coastguard Worker     case KM_TAG_DIGEST:
40*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::DIGEST, KeyParameterValue::make<KeyParameterValue::digest>(
41*789431f2SAndroid Build Coastguard Worker                                              static_cast<Digest>(param.enumerated))};
42*789431f2SAndroid Build Coastguard Worker 
43*789431f2SAndroid Build Coastguard Worker     case KM_TAG_RSA_OAEP_MGF_DIGEST:
44*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::RSA_OAEP_MGF_DIGEST,
45*789431f2SAndroid Build Coastguard Worker                             KeyParameterValue::make<KeyParameterValue::digest>(
46*789431f2SAndroid Build Coastguard Worker                                 static_cast<Digest>(param.enumerated))};
47*789431f2SAndroid Build Coastguard Worker 
48*789431f2SAndroid Build Coastguard Worker     case KM_TAG_PADDING:
49*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::PADDING, KeyParameterValue::make<KeyParameterValue::paddingMode>(
50*789431f2SAndroid Build Coastguard Worker                                               static_cast<PaddingMode>(param.enumerated))};
51*789431f2SAndroid Build Coastguard Worker     case KM_TAG_EC_CURVE:
52*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::EC_CURVE, KeyParameterValue::make<KeyParameterValue::ecCurve>(
53*789431f2SAndroid Build Coastguard Worker                                                static_cast<EcCurve>(param.enumerated))};
54*789431f2SAndroid Build Coastguard Worker     case KM_TAG_USER_AUTH_TYPE:
55*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::USER_AUTH_TYPE,
56*789431f2SAndroid Build Coastguard Worker                             KeyParameterValue::make<KeyParameterValue::hardwareAuthenticatorType>(
57*789431f2SAndroid Build Coastguard Worker                                 static_cast<HardwareAuthenticatorType>(param.enumerated))};
58*789431f2SAndroid Build Coastguard Worker     case KM_TAG_ORIGIN:
59*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::ORIGIN, KeyParameterValue::make<KeyParameterValue::origin>(
60*789431f2SAndroid Build Coastguard Worker                                              static_cast<KeyOrigin>(param.enumerated))};
61*789431f2SAndroid Build Coastguard Worker 
62*789431f2SAndroid Build Coastguard Worker     case KM_TAG_BLOB_USAGE_REQUIREMENTS:
63*789431f2SAndroid Build Coastguard Worker     case KM_TAG_KDF:
64*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::INVALID, false};
65*789431f2SAndroid Build Coastguard Worker 
66*789431f2SAndroid Build Coastguard Worker     default:
67*789431f2SAndroid Build Coastguard Worker         // Unknown tag.  We can't represent it properly because it's some unknown enum.  But KeyMint
68*789431f2SAndroid Build Coastguard Worker         // specs require us to return unknown tags.  Pretending it's an integer value is the best we
69*789431f2SAndroid Build Coastguard Worker         // can do.  Upstream will have to deal with it.
70*789431f2SAndroid Build Coastguard Worker         return KeyParameter{static_cast<Tag>(param.tag),
71*789431f2SAndroid Build Coastguard Worker                             KeyParameterValue::make<KeyParameterValue::integer>(param.enumerated)};
72*789431f2SAndroid Build Coastguard Worker     }
73*789431f2SAndroid Build Coastguard Worker }
74*789431f2SAndroid Build Coastguard Worker 
75*789431f2SAndroid Build Coastguard Worker keymaster_key_param_t kInvalidTag{.tag = KM_TAG_INVALID, .integer = 0};
76*789431f2SAndroid Build Coastguard Worker 
77*789431f2SAndroid Build Coastguard Worker template <KeyParameterValue::Tag aidl_tag>
aidlEnumVal2Km(keymaster_tag_t km_tag,const KeyParameterValue & value)78*789431f2SAndroid Build Coastguard Worker keymaster_key_param_t aidlEnumVal2Km(keymaster_tag_t km_tag, const KeyParameterValue& value) {
79*789431f2SAndroid Build Coastguard Worker     return value.getTag() == aidl_tag
80*789431f2SAndroid Build Coastguard Worker                ? keymaster_param_enum(km_tag, static_cast<uint32_t>(value.get<aidl_tag>()))
81*789431f2SAndroid Build Coastguard Worker                : kInvalidTag;
82*789431f2SAndroid Build Coastguard Worker }
83*789431f2SAndroid Build Coastguard Worker 
aidlEnumParam2Km(const KeyParameter & param)84*789431f2SAndroid Build Coastguard Worker keymaster_key_param_t aidlEnumParam2Km(const KeyParameter& param) {
85*789431f2SAndroid Build Coastguard Worker     auto tag = km_utils::legacy_enum_conversion(param.tag);
86*789431f2SAndroid Build Coastguard Worker     switch (tag) {
87*789431f2SAndroid Build Coastguard Worker     case KM_TAG_PURPOSE:
88*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::keyPurpose>(tag, param.value);
89*789431f2SAndroid Build Coastguard Worker     case KM_TAG_ALGORITHM:
90*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::algorithm>(tag, param.value);
91*789431f2SAndroid Build Coastguard Worker     case KM_TAG_BLOCK_MODE:
92*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::blockMode>(tag, param.value);
93*789431f2SAndroid Build Coastguard Worker     case KM_TAG_DIGEST:
94*789431f2SAndroid Build Coastguard Worker     case KM_TAG_RSA_OAEP_MGF_DIGEST:
95*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::digest>(tag, param.value);
96*789431f2SAndroid Build Coastguard Worker     case KM_TAG_PADDING:
97*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::paddingMode>(tag, param.value);
98*789431f2SAndroid Build Coastguard Worker     case KM_TAG_EC_CURVE:
99*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::ecCurve>(tag, param.value);
100*789431f2SAndroid Build Coastguard Worker     case KM_TAG_USER_AUTH_TYPE:
101*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::hardwareAuthenticatorType>(tag, param.value);
102*789431f2SAndroid Build Coastguard Worker     case KM_TAG_ORIGIN:
103*789431f2SAndroid Build Coastguard Worker         return aidlEnumVal2Km<KeyParameterValue::origin>(tag, param.value);
104*789431f2SAndroid Build Coastguard Worker     case KM_TAG_BLOB_USAGE_REQUIREMENTS:
105*789431f2SAndroid Build Coastguard Worker     case KM_TAG_KDF:
106*789431f2SAndroid Build Coastguard Worker         CHECK(false) << "Unused enum tag: Something is broken";
107*789431f2SAndroid Build Coastguard Worker         return keymaster_param_enum(KM_TAG_INVALID, false);
108*789431f2SAndroid Build Coastguard Worker     default:
109*789431f2SAndroid Build Coastguard Worker         // Unknown tag.  This can happen when system is newer than secure world.  Pass it through.
110*789431f2SAndroid Build Coastguard Worker         return keymaster_param_enum(tag, param.value.get<KeyParameterValue::integer>());
111*789431f2SAndroid Build Coastguard Worker     }
112*789431f2SAndroid Build Coastguard Worker }
113*789431f2SAndroid Build Coastguard Worker 
114*789431f2SAndroid Build Coastguard Worker }  // namespace
115*789431f2SAndroid Build Coastguard Worker 
authToken2AidlVec(const std::optional<HardwareAuthToken> & token)116*789431f2SAndroid Build Coastguard Worker vector<uint8_t> authToken2AidlVec(const std::optional<HardwareAuthToken>& token) {
117*789431f2SAndroid Build Coastguard Worker     static_assert(1 /* version size */ + sizeof(token->challenge) + sizeof(token->userId) +
118*789431f2SAndroid Build Coastguard Worker                           sizeof(token->authenticatorId) + sizeof(token->authenticatorType) +
119*789431f2SAndroid Build Coastguard Worker                           sizeof(token->timestamp) + 32 /* HMAC size */
120*789431f2SAndroid Build Coastguard Worker                       == sizeof(hw_auth_token_t),
121*789431f2SAndroid Build Coastguard Worker                   "HardwareAuthToken content size does not match hw_auth_token_t size");
122*789431f2SAndroid Build Coastguard Worker 
123*789431f2SAndroid Build Coastguard Worker     vector<uint8_t> result;
124*789431f2SAndroid Build Coastguard Worker 
125*789431f2SAndroid Build Coastguard Worker     if (!token.has_value()) return result;
126*789431f2SAndroid Build Coastguard Worker     if (token->mac.size() != 32) return result;
127*789431f2SAndroid Build Coastguard Worker 
128*789431f2SAndroid Build Coastguard Worker     result.resize(sizeof(hw_auth_token_t));
129*789431f2SAndroid Build Coastguard Worker     auto pos = result.begin();
130*789431f2SAndroid Build Coastguard Worker     *pos++ = 0;  // Version byte
131*789431f2SAndroid Build Coastguard Worker     pos = copy_bytes_to_iterator(token->challenge, pos);
132*789431f2SAndroid Build Coastguard Worker     pos = copy_bytes_to_iterator(token->userId, pos);
133*789431f2SAndroid Build Coastguard Worker     pos = copy_bytes_to_iterator(token->authenticatorId, pos);
134*789431f2SAndroid Build Coastguard Worker     pos = copy_bytes_to_iterator(hton(static_cast<uint32_t>(token->authenticatorType)), pos);
135*789431f2SAndroid Build Coastguard Worker     pos = copy_bytes_to_iterator(hton(token->timestamp.milliSeconds), pos);
136*789431f2SAndroid Build Coastguard Worker     pos = std::copy(token->mac.data(), token->mac.data() + token->mac.size(), pos);
137*789431f2SAndroid Build Coastguard Worker 
138*789431f2SAndroid Build Coastguard Worker     return result;
139*789431f2SAndroid Build Coastguard Worker }
140*789431f2SAndroid Build Coastguard Worker 
kmParam2Aidl(const keymaster_key_param_t & param)141*789431f2SAndroid Build Coastguard Worker KeyParameter kmParam2Aidl(const keymaster_key_param_t& param) {
142*789431f2SAndroid Build Coastguard Worker     auto tag = legacy_enum_conversion(param.tag);
143*789431f2SAndroid Build Coastguard Worker     switch (typeFromTag(param.tag)) {
144*789431f2SAndroid Build Coastguard Worker     case KM_ENUM:
145*789431f2SAndroid Build Coastguard Worker     case KM_ENUM_REP:
146*789431f2SAndroid Build Coastguard Worker         return kmEnumParam2Aidl(param);
147*789431f2SAndroid Build Coastguard Worker 
148*789431f2SAndroid Build Coastguard Worker     case KM_UINT:
149*789431f2SAndroid Build Coastguard Worker     case KM_UINT_REP:
150*789431f2SAndroid Build Coastguard Worker         return KeyParameter{tag,
151*789431f2SAndroid Build Coastguard Worker                             KeyParameterValue::make<KeyParameterValue::integer>(param.integer)};
152*789431f2SAndroid Build Coastguard Worker 
153*789431f2SAndroid Build Coastguard Worker     case KM_ULONG:
154*789431f2SAndroid Build Coastguard Worker     case KM_ULONG_REP:
155*789431f2SAndroid Build Coastguard Worker         return KeyParameter{
156*789431f2SAndroid Build Coastguard Worker             tag, KeyParameterValue::make<KeyParameterValue::longInteger>(param.long_integer)};
157*789431f2SAndroid Build Coastguard Worker 
158*789431f2SAndroid Build Coastguard Worker     case KM_DATE:
159*789431f2SAndroid Build Coastguard Worker         return KeyParameter{tag,
160*789431f2SAndroid Build Coastguard Worker                             KeyParameterValue::make<KeyParameterValue::dateTime>(param.date_time)};
161*789431f2SAndroid Build Coastguard Worker 
162*789431f2SAndroid Build Coastguard Worker     case KM_BOOL:
163*789431f2SAndroid Build Coastguard Worker         return KeyParameter{tag, param.boolean};
164*789431f2SAndroid Build Coastguard Worker 
165*789431f2SAndroid Build Coastguard Worker     case KM_BIGNUM:
166*789431f2SAndroid Build Coastguard Worker     case KM_BYTES:
167*789431f2SAndroid Build Coastguard Worker         return {tag, KeyParameterValue::make<KeyParameterValue::blob>(
168*789431f2SAndroid Build Coastguard Worker                          std::vector(param.blob.data, param.blob.data + param.blob.data_length))};
169*789431f2SAndroid Build Coastguard Worker 
170*789431f2SAndroid Build Coastguard Worker     case KM_INVALID:
171*789431f2SAndroid Build Coastguard Worker     default:
172*789431f2SAndroid Build Coastguard Worker         CHECK(false) << "Unknown or unused tag type: Something is broken";
173*789431f2SAndroid Build Coastguard Worker         return KeyParameter{Tag::INVALID, false};
174*789431f2SAndroid Build Coastguard Worker     }
175*789431f2SAndroid Build Coastguard Worker }
176*789431f2SAndroid Build Coastguard Worker 
kmParamSet2Aidl(const keymaster_key_param_set_t & set)177*789431f2SAndroid Build Coastguard Worker vector<KeyParameter> kmParamSet2Aidl(const keymaster_key_param_set_t& set) {
178*789431f2SAndroid Build Coastguard Worker     vector<KeyParameter> result;
179*789431f2SAndroid Build Coastguard Worker     if (set.length == 0 || set.params == nullptr) return result;
180*789431f2SAndroid Build Coastguard Worker 
181*789431f2SAndroid Build Coastguard Worker     result.reserve(set.length);
182*789431f2SAndroid Build Coastguard Worker     for (size_t i = 0; i < set.length; ++i) {
183*789431f2SAndroid Build Coastguard Worker         result.push_back(kmParam2Aidl(set.params[i]));
184*789431f2SAndroid Build Coastguard Worker     }
185*789431f2SAndroid Build Coastguard Worker     return result;
186*789431f2SAndroid Build Coastguard Worker }
187*789431f2SAndroid Build Coastguard Worker 
aidlKeyParams2Km(const vector<KeyParameter> & keyParams)188*789431f2SAndroid Build Coastguard Worker keymaster_key_param_set_t aidlKeyParams2Km(const vector<KeyParameter>& keyParams) {
189*789431f2SAndroid Build Coastguard Worker     keymaster_key_param_set_t set;
190*789431f2SAndroid Build Coastguard Worker 
191*789431f2SAndroid Build Coastguard Worker     set.params = static_cast<keymaster_key_param_t*>(
192*789431f2SAndroid Build Coastguard Worker         malloc(keyParams.size() * sizeof(keymaster_key_param_t)));
193*789431f2SAndroid Build Coastguard Worker     set.length = keyParams.size();
194*789431f2SAndroid Build Coastguard Worker 
195*789431f2SAndroid Build Coastguard Worker     for (size_t i = 0; i < keyParams.size(); ++i) {
196*789431f2SAndroid Build Coastguard Worker         const auto& param = keyParams[i];
197*789431f2SAndroid Build Coastguard Worker         auto tag = legacy_enum_conversion(param.tag);
198*789431f2SAndroid Build Coastguard Worker         switch (typeFromTag(tag)) {
199*789431f2SAndroid Build Coastguard Worker 
200*789431f2SAndroid Build Coastguard Worker         case KM_ENUM:
201*789431f2SAndroid Build Coastguard Worker         case KM_ENUM_REP:
202*789431f2SAndroid Build Coastguard Worker             set.params[i] = aidlEnumParam2Km(param);
203*789431f2SAndroid Build Coastguard Worker             break;
204*789431f2SAndroid Build Coastguard Worker 
205*789431f2SAndroid Build Coastguard Worker         case KM_UINT:
206*789431f2SAndroid Build Coastguard Worker         case KM_UINT_REP:
207*789431f2SAndroid Build Coastguard Worker             set.params[i] =
208*789431f2SAndroid Build Coastguard Worker                 param.value.getTag() == KeyParameterValue::integer
209*789431f2SAndroid Build Coastguard Worker                     ? keymaster_param_int(tag, param.value.get<KeyParameterValue::integer>())
210*789431f2SAndroid Build Coastguard Worker                     : kInvalidTag;
211*789431f2SAndroid Build Coastguard Worker             break;
212*789431f2SAndroid Build Coastguard Worker 
213*789431f2SAndroid Build Coastguard Worker         case KM_ULONG:
214*789431f2SAndroid Build Coastguard Worker         case KM_ULONG_REP:
215*789431f2SAndroid Build Coastguard Worker             set.params[i] =
216*789431f2SAndroid Build Coastguard Worker                 param.value.getTag() == KeyParameterValue::longInteger
217*789431f2SAndroid Build Coastguard Worker                     ? keymaster_param_long(tag, param.value.get<KeyParameterValue::longInteger>())
218*789431f2SAndroid Build Coastguard Worker                     : kInvalidTag;
219*789431f2SAndroid Build Coastguard Worker             break;
220*789431f2SAndroid Build Coastguard Worker 
221*789431f2SAndroid Build Coastguard Worker         case KM_DATE:
222*789431f2SAndroid Build Coastguard Worker             set.params[i] =
223*789431f2SAndroid Build Coastguard Worker                 param.value.getTag() == KeyParameterValue::dateTime
224*789431f2SAndroid Build Coastguard Worker                     ? keymaster_param_date(tag, param.value.get<KeyParameterValue::dateTime>())
225*789431f2SAndroid Build Coastguard Worker                     : kInvalidTag;
226*789431f2SAndroid Build Coastguard Worker             break;
227*789431f2SAndroid Build Coastguard Worker 
228*789431f2SAndroid Build Coastguard Worker         case KM_BOOL:
229*789431f2SAndroid Build Coastguard Worker             set.params[i] = keymaster_param_bool(tag);
230*789431f2SAndroid Build Coastguard Worker             break;
231*789431f2SAndroid Build Coastguard Worker 
232*789431f2SAndroid Build Coastguard Worker         case KM_BIGNUM:
233*789431f2SAndroid Build Coastguard Worker         case KM_BYTES:
234*789431f2SAndroid Build Coastguard Worker             if (param.value.getTag() == KeyParameterValue::blob) {
235*789431f2SAndroid Build Coastguard Worker                 const auto& value = param.value.get<KeyParameterValue::blob>();
236*789431f2SAndroid Build Coastguard Worker                 uint8_t* copy = static_cast<uint8_t*>(malloc(value.size()));
237*789431f2SAndroid Build Coastguard Worker                 std::copy(value.begin(), value.end(), copy);
238*789431f2SAndroid Build Coastguard Worker                 set.params[i] = keymaster_param_blob(tag, copy, value.size());
239*789431f2SAndroid Build Coastguard Worker             } else {
240*789431f2SAndroid Build Coastguard Worker                 set.params[i] = kInvalidTag;
241*789431f2SAndroid Build Coastguard Worker             }
242*789431f2SAndroid Build Coastguard Worker             break;
243*789431f2SAndroid Build Coastguard Worker 
244*789431f2SAndroid Build Coastguard Worker         case KM_INVALID:
245*789431f2SAndroid Build Coastguard Worker         default:
246*789431f2SAndroid Build Coastguard Worker             CHECK(false) << "Invalid tag: Something is broken";
247*789431f2SAndroid Build Coastguard Worker             set.params[i].tag = KM_TAG_INVALID;
248*789431f2SAndroid Build Coastguard Worker             /* just skip */
249*789431f2SAndroid Build Coastguard Worker             break;
250*789431f2SAndroid Build Coastguard Worker         }
251*789431f2SAndroid Build Coastguard Worker     }
252*789431f2SAndroid Build Coastguard Worker 
253*789431f2SAndroid Build Coastguard Worker     return set;
254*789431f2SAndroid Build Coastguard Worker }
255*789431f2SAndroid Build Coastguard Worker 
256*789431f2SAndroid Build Coastguard Worker }  // namespace aidl::android::hardware::security::keymint::km_utils
257