2 * Copyright (C) 2016 The Android Open Source Project
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
17 #include "Keymaster.h"
19 #include <android-base/logging.h>
20 #include <keystore/keymaster_tags.h>
21 #include <keystore/authorization_set.h>
22 #include <keystore/keystore_hidl_support.h>
24 using namespace ::keystore;
25 using android::hardware::hidl_string;
30 KeymasterOperation::~KeymasterOperation() {
31 if (mDevice.get()) mDevice->abort(mOpHandle);
34 bool KeymasterOperation::updateCompletely(const std::string& input, std::string* output) {
37 auto it = input.begin();
38 uint32_t inputConsumed;
41 auto hidlCB = [&] (ErrorCode ret, uint32_t _inputConsumed,
42 const hidl_vec<KeyParameter>& /*ignored*/, const hidl_vec<uint8_t>& _output) {
44 if (km_error != ErrorCode::OK) return;
45 inputConsumed = _inputConsumed;
47 output->append(reinterpret_cast<const char*>(&_output[0]), _output.size());
50 while (it != input.end()) {
51 size_t toRead = static_cast<size_t>(input.end() - it);
52 auto inputBlob = blob2hidlVec(reinterpret_cast<const uint8_t*>(&*it), toRead);
53 auto error = mDevice->update(mOpHandle, hidl_vec<KeyParameter>(), inputBlob, hidlCB);
55 LOG(ERROR) << "update failed: " << error.description();
59 if (km_error != ErrorCode::OK) {
60 LOG(ERROR) << "update failed, code " << int32_t(km_error);
64 if (inputConsumed > toRead) {
65 LOG(ERROR) << "update reported too much input consumed";
74 bool KeymasterOperation::finish(std::string* output) {
76 auto hidlCb = [&] (ErrorCode ret, const hidl_vec<KeyParameter>& /*ignored*/,
77 const hidl_vec<uint8_t>& _output) {
79 if (km_error != ErrorCode::OK) return;
81 output->assign(reinterpret_cast<const char*>(&_output[0]), _output.size());
83 auto error = mDevice->finish(mOpHandle, hidl_vec<KeyParameter>(), hidl_vec<uint8_t>(),
84 hidl_vec<uint8_t>(), hidlCb);
87 LOG(ERROR) << "finish failed: " << error.description();
90 if (km_error != ErrorCode::OK) {
91 LOG(ERROR) << "finish failed, code " << int32_t(km_error);
97 Keymaster::Keymaster() {
98 mDevice = ::android::hardware::keymaster::V3_0::IKeymasterDevice::getService();
101 bool Keymaster::generateKey(const AuthorizationSet& inParams, std::string* key) {
103 auto hidlCb = [&] (ErrorCode ret, const hidl_vec<uint8_t>& keyBlob,
104 const KeyCharacteristics& /*ignored*/) {
106 if (km_error != ErrorCode::OK) return;
108 key->assign(reinterpret_cast<const char*>(&keyBlob[0]), keyBlob.size());
111 auto error = mDevice->generateKey(inParams.hidl_data(), hidlCb);
113 LOG(ERROR) << "generate_key failed: " << error.description();
116 if (km_error != ErrorCode::OK) {
117 LOG(ERROR) << "generate_key failed, code " << int32_t(km_error);
123 bool Keymaster::deleteKey(const std::string& key) {
124 auto keyBlob = blob2hidlVec(key);
125 auto error = mDevice->deleteKey(keyBlob);
127 LOG(ERROR) << "delete_key failed: " << error.description();
130 if (ErrorCode(error) != ErrorCode::OK) {
131 LOG(ERROR) << "delete_key failed, code " << uint32_t(ErrorCode(error));
137 bool Keymaster::upgradeKey(const std::string& oldKey, const AuthorizationSet& inParams,
138 std::string* newKey) {
139 auto oldKeyBlob = blob2hidlVec(oldKey);
141 auto hidlCb = [&] (ErrorCode ret, const hidl_vec<uint8_t>& upgradedKeyBlob) {
143 if (km_error != ErrorCode::OK) return;
145 newKey->assign(reinterpret_cast<const char*>(&upgradedKeyBlob[0]),
146 upgradedKeyBlob.size());
148 auto error = mDevice->upgradeKey(oldKeyBlob, inParams.hidl_data(), hidlCb);
150 LOG(ERROR) << "upgrade_key failed: " << error.description();
153 if (km_error != ErrorCode::OK) {
154 LOG(ERROR) << "upgrade_key failed, code " << int32_t(km_error);
160 KeymasterOperation Keymaster::begin(KeyPurpose purpose, const std::string& key,
161 const AuthorizationSet& inParams,
162 AuthorizationSet* outParams) {
163 auto keyBlob = blob2hidlVec(key);
167 auto hidlCb = [&] (ErrorCode ret, const hidl_vec<KeyParameter>& _outParams,
168 uint64_t operationHandle) {
170 if (km_error != ErrorCode::OK) return;
172 *outParams = _outParams;
173 mOpHandle = operationHandle;
176 auto error = mDevice->begin(purpose, keyBlob, inParams.hidl_data(), hidlCb);
178 LOG(ERROR) << "begin failed: " << error.description();
179 return KeymasterOperation(ErrorCode::UNKNOWN_ERROR);
181 if (km_error != ErrorCode::OK) {
182 LOG(ERROR) << "begin failed, code " << int32_t(km_error);
183 return KeymasterOperation(km_error);
185 return KeymasterOperation(mDevice, mOpHandle);
187 bool Keymaster::isSecure() {
188 bool _isSecure = false;
189 auto rc = mDevice->getHardwareFeatures(
190 [&] (bool isSecure, bool, bool, bool, bool, const hidl_string&, const hidl_string&) {
191 _isSecure = isSecure; });
192 return rc.isOk() && _isSecure;
196 } // namespace android
198 using namespace ::android::vold;
200 int keymaster_compatibility_cryptfs_scrypt() {
203 LOG(ERROR) << "Failed to initiate keymaster session";
206 return dev.isSecure();
209 int keymaster_create_key_for_cryptfs_scrypt(uint32_t rsa_key_size,
210 uint64_t rsa_exponent,
213 uint32_t key_buffer_size,
214 uint32_t* key_out_size)
219 LOG(ERROR) << "Failed to initiate keymaster session";
222 if (!key_buffer || !key_out_size) {
223 LOG(ERROR) << __FILE__ << ":" << __LINE__ << ":Invalid argument";
230 auto paramBuilder = AuthorizationSetBuilder()
231 .Authorization(TAG_ALGORITHM, Algorithm::RSA)
232 .Authorization(TAG_KEY_SIZE, rsa_key_size)
233 .Authorization(TAG_RSA_PUBLIC_EXPONENT, rsa_exponent)
234 .Authorization(TAG_PURPOSE, KeyPurpose::SIGN)
235 .Authorization(TAG_PADDING, PaddingMode::NONE)
236 .Authorization(TAG_DIGEST, Digest::NONE)
237 .Authorization(TAG_BLOB_USAGE_REQUIREMENTS,
238 KeyBlobUsageRequirements::STANDALONE)
239 .Authorization(TAG_NO_AUTH_REQUIRED)
240 .Authorization(TAG_MIN_SECONDS_BETWEEN_OPS, ratelimit);
242 if (!dev.generateKey(paramBuilder, &key)) {
247 *key_out_size = key.size();
250 if (key_buffer_size < key.size()) {
254 std::copy(key.data(), key.data() + key.size(), key_buffer);
258 int keymaster_sign_object_for_cryptfs_scrypt(const uint8_t* key_blob,
259 size_t key_blob_size,
261 const uint8_t* object,
262 const size_t object_size,
263 uint8_t** signature_buffer,
264 size_t* signature_buffer_size)
268 LOG(ERROR) << "Failed to initiate keymaster session";
271 if (!key_blob || !object || !signature_buffer || !signature_buffer_size) {
272 LOG(ERROR) << __FILE__ << ":" << __LINE__ << ":Invalid argument";
276 AuthorizationSet outParams;
277 std::string key(reinterpret_cast<const char*>(key_blob), key_blob_size);
278 std::string input(reinterpret_cast<const char*>(object), object_size);
280 KeymasterOperation op;
282 auto paramBuilder = AuthorizationSetBuilder()
283 .Authorization(TAG_PADDING, PaddingMode::NONE)
284 .Authorization(TAG_DIGEST, Digest::NONE);
287 op = dev.begin(KeyPurpose::SIGN, key, paramBuilder, &outParams);
288 if (op.errorCode() == ErrorCode::KEY_RATE_LIMIT_EXCEEDED) {
294 if (op.errorCode() != ErrorCode::OK) {
295 LOG(ERROR) << "Error starting keymaster signature transaction: " << int32_t(op.errorCode());
299 if (!op.updateCompletely(input, &output)) {
300 LOG(ERROR) << "Error sending data to keymaster signature transaction: "
301 << uint32_t(op.errorCode());
305 if (!op.finish(&output)) {
306 LOG(ERROR) << "Error finalizing keymaster signature transaction: " << int32_t(op.errorCode());
310 *signature_buffer = reinterpret_cast<uint8_t*>(malloc(output.size()));
311 if (*signature_buffer == nullptr) {
312 LOG(ERROR) << "Error allocation buffer for keymaster signature";
315 *signature_buffer_size = output.size();
316 std::copy(output.data(), output.data() + output.size(), *signature_buffer);