package android.security.keystore;
/* @hide */
-parcelable RecoveryData;
+parcelable KeychainProtectionParameter;
import java.util.Arrays;
/**
- * Helper class with data necessary to recover Keystore on a new device.
- * It defines UI shown to the user and a way to derive a cryptographic key from user output.
+ * A {@link KeychainSnapshot} is protected with a key derived from the user's lock screen. This
+ * class wraps all the data necessary to derive the same key on a recovering device:
+ *
+ * <ul>
+ * <li>UI parameters for the user's lock screen - so that if e.g., the user was using a pattern,
+ * the recovering device can display the pattern UI to the user when asking them to enter
+ * the lock screen from their previous device.
+ * <li>The algorithm used to derive a key from the user's lock screen, e.g. SHA-256 with a salt.
+ * </ul>
+ *
+ * <p>As such, this data is sent along with the {@link KeychainSnapshot} when syncing the current
+ * version of the keychain.
+ *
+ * <p>For now, the recoverable keychain only supports a single layer of protection, which is the
+ * user's lock screen. In the future, the keychain will support multiple layers of protection
+ * (e.g. an additional keychain password, along with the lock screen).
*
* @hide
*/
-public final class RecoveryMetadata implements Parcelable {
+public final class KeychainProtectionParameter implements Parcelable {
/** @hide */
@Retention(RetentionPolicy.SOURCE)
@IntDef({TYPE_LOCKSCREEN, TYPE_CUSTOM_PASSWORD})
* @link {#clearSecret} to overwrite its value in memory.
* @hide
*/
- public RecoveryMetadata(@UserSecretType int userSecretType,
+ public KeychainProtectionParameter(@UserSecretType int userSecretType,
@LockScreenUiFormat int lockScreenUiFormat,
@NonNull KeyDerivationParams keyDerivationParams,
@NonNull byte[] secret) {
mSecret = Preconditions.checkNotNull(secret);
}
- private RecoveryMetadata() {
+ private KeychainProtectionParameter() {
}
}
/**
- * Builder for creating {@link RecoveryMetadata}.
+ * Builder for creating {@link KeychainProtectionParameter}.
*/
public static class Builder {
- private RecoveryMetadata mInstance = new RecoveryMetadata();
+ private KeychainProtectionParameter mInstance = new KeychainProtectionParameter();
/**
* Sets user secret type.
/**
- * Creates a new {@link RecoveryMetadata} instance.
+ * Creates a new {@link KeychainProtectionParameter} instance.
* The instance will include default values, if {@link setSecret}
* or {@link setUserSecretType} were not called.
*
* @return new instance
* @throws NullPointerException if some required fields were not set.
*/
- public @NonNull RecoveryMetadata build() {
+ @NonNull public KeychainProtectionParameter build() {
if (mInstance.mUserSecretType == null) {
mInstance.mUserSecretType = TYPE_LOCKSCREEN;
}
Arrays.fill(mSecret, (byte) 0);
}
- public static final Parcelable.Creator<RecoveryMetadata> CREATOR =
- new Parcelable.Creator<RecoveryMetadata>() {
- public RecoveryMetadata createFromParcel(Parcel in) {
- return new RecoveryMetadata(in);
+ public static final Parcelable.Creator<KeychainProtectionParameter> CREATOR =
+ new Parcelable.Creator<KeychainProtectionParameter>() {
+ public KeychainProtectionParameter createFromParcel(Parcel in) {
+ return new KeychainProtectionParameter(in);
}
- public RecoveryMetadata[] newArray(int length) {
- return new RecoveryMetadata[length];
+ public KeychainProtectionParameter[] newArray(int length) {
+ return new KeychainProtectionParameter[length];
}
};
/**
* @hide
*/
- protected RecoveryMetadata(Parcel in) {
+ protected KeychainProtectionParameter(Parcel in) {
mUserSecretType = in.readInt();
mLockScreenUiFormat = in.readInt();
mKeyDerivationParams = in.readTypedObject(KeyDerivationParams.CREATOR);
package android.security.keystore;
/* @hide */
-parcelable RecoveryMetadata;
+parcelable KeychainSnapshot;
import java.util.List;
/**
- * Helper class which returns data necessary to recover keys.
- * Contains
+ * A snapshot of a version of the keystore. Two events can trigger the generation of a new snapshot:
*
* <ul>
- * <li>Snapshot version.
- * <li>Recovery metadata with UI and key derivation parameters.
- * <li>List of application keys encrypted by recovery key.
- * <li>Encrypted recovery key.
+ * <li>The user's lock screen changes. (A key derived from the user's lock screen is used to
+ * protected the keychain, which is why this forces a new snapshot.)
+ * <li>A key is added to or removed from the recoverable keychain.
* </ul>
*
+ * <p>The snapshot data is also encrypted with the remote trusted hardware's public key, so even
+ * the recovery agent itself should not be able to decipher the data. The recovery agent sends an
+ * instance of this to the remote trusted hardware whenever a new snapshot is generated. During a
+ * recovery flow, the recovery agent retrieves a snapshot from the remote trusted hardware. It then
+ * sends it to the framework, where it is decrypted using the user's lock screen from their previous
+ * device.
+ *
* @hide
*/
-public final class RecoveryData implements Parcelable {
+public final class KeychainSnapshot implements Parcelable {
private int mSnapshotVersion;
- private List<RecoveryMetadata> mRecoveryMetadata;
- private List<EntryRecoveryData> mEntryRecoveryData;
+ private List<KeychainProtectionParameter> mKeychainProtectionParams;
+ private List<WrappedApplicationKey> mEntryRecoveryData;
private byte[] mEncryptedRecoveryKeyBlob;
/**
* @hide
* Deprecated, consider using builder.
*/
- public RecoveryData(
+ public KeychainSnapshot(
int snapshotVersion,
- @NonNull List<RecoveryMetadata> recoveryMetadata,
- @NonNull List<EntryRecoveryData> entryRecoveryData,
+ @NonNull List<KeychainProtectionParameter> keychainProtectionParams,
+ @NonNull List<WrappedApplicationKey> wrappedApplicationKeys,
@NonNull byte[] encryptedRecoveryKeyBlob) {
mSnapshotVersion = snapshotVersion;
- mRecoveryMetadata =
- Preconditions.checkCollectionElementsNotNull(recoveryMetadata, "recoveryMetadata");
- mEntryRecoveryData = Preconditions.checkCollectionElementsNotNull(entryRecoveryData,
- "entryRecoveryData");
+ mKeychainProtectionParams =
+ Preconditions.checkCollectionElementsNotNull(keychainProtectionParams,
+ "keychainProtectionParams");
+ mEntryRecoveryData = Preconditions.checkCollectionElementsNotNull(wrappedApplicationKeys,
+ "wrappedApplicationKeys");
mEncryptedRecoveryKeyBlob = Preconditions.checkNotNull(encryptedRecoveryKeyBlob);
}
- private RecoveryData() {
+ private KeychainSnapshot() {
}
/**
* UI and key derivation parameters. Note that combination of secrets may be used.
*/
- public @NonNull List<RecoveryMetadata> getRecoveryMetadata() {
- return mRecoveryMetadata;
+ public @NonNull List<KeychainProtectionParameter> getKeychainProtectionParams() {
+ return mKeychainProtectionParams;
}
/**
* List of application keys, with key material encrypted by
* the recovery key ({@link #getEncryptedRecoveryKeyBlob}).
*/
- public @NonNull List<EntryRecoveryData> getEntryRecoveryData() {
+ public @NonNull List<WrappedApplicationKey> getWrappedApplicationKeys() {
return mEntryRecoveryData;
}
return mEncryptedRecoveryKeyBlob;
}
- public static final Parcelable.Creator<RecoveryData> CREATOR =
- new Parcelable.Creator<RecoveryData>() {
- public RecoveryData createFromParcel(Parcel in) {
- return new RecoveryData(in);
+ public static final Parcelable.Creator<KeychainSnapshot> CREATOR =
+ new Parcelable.Creator<KeychainSnapshot>() {
+ public KeychainSnapshot createFromParcel(Parcel in) {
+ return new KeychainSnapshot(in);
}
- public RecoveryData[] newArray(int length) {
- return new RecoveryData[length];
+ public KeychainSnapshot[] newArray(int length) {
+ return new KeychainSnapshot[length];
}
};
/**
- * Builder for creating {@link RecoveryData}.
+ * Builder for creating {@link KeychainSnapshot}.
*/
public static class Builder {
- private RecoveryData mInstance = new RecoveryData();
+ private KeychainSnapshot mInstance = new KeychainSnapshot();
/**
* Snapshot version for given account.
* @param recoveryMetadata The UI and key derivation parameters
* @return This builder.
*/
- public Builder setRecoveryMetadata(@NonNull List<RecoveryMetadata> recoveryMetadata) {
- mInstance.mRecoveryMetadata = recoveryMetadata;
+ public Builder setKeychainProtectionParams(
+ @NonNull List<KeychainProtectionParameter> recoveryMetadata) {
+ mInstance.mKeychainProtectionParams = recoveryMetadata;
return this;
}
* @param entryRecoveryData List of application keys
* @return This builder.
*/
- public Builder setEntryRecoveryData(List<EntryRecoveryData> entryRecoveryData) {
+ public Builder setWrappedApplicationKeys(List<WrappedApplicationKey> entryRecoveryData) {
mInstance.mEntryRecoveryData = entryRecoveryData;
return this;
}
/**
- * Creates a new {@link RecoveryData} instance.
+ * Creates a new {@link KeychainSnapshot} instance.
*
* @return new instance
* @throws NullPointerException if some required fields were not set.
*/
- public @NonNull RecoveryData build() {
- Preconditions.checkCollectionElementsNotNull(mInstance.mRecoveryMetadata,
+ @NonNull public KeychainSnapshot build() {
+ Preconditions.checkCollectionElementsNotNull(mInstance.mKeychainProtectionParams,
"recoveryMetadata");
Preconditions.checkCollectionElementsNotNull(mInstance.mEntryRecoveryData,
"entryRecoveryData");
@Override
public void writeToParcel(Parcel out, int flags) {
out.writeInt(mSnapshotVersion);
- out.writeTypedList(mRecoveryMetadata);
+ out.writeTypedList(mKeychainProtectionParams);
out.writeByteArray(mEncryptedRecoveryKeyBlob);
out.writeTypedList(mEntryRecoveryData);
}
/**
* @hide
*/
- protected RecoveryData(Parcel in) {
+ protected KeychainSnapshot(Parcel in) {
mSnapshotVersion = in.readInt();
- mRecoveryMetadata = in.createTypedArrayList(RecoveryMetadata.CREATOR);
+ mKeychainProtectionParams = in.createTypedArrayList(KeychainProtectionParameter.CREATOR);
mEncryptedRecoveryKeyBlob = in.createByteArray();
- mEntryRecoveryData = in.createTypedArrayList(EntryRecoveryData.CREATOR);
+ mEntryRecoveryData = in.createTypedArrayList(WrappedApplicationKey.CREATOR);
}
@Override
* @return Data necessary to recover keystore.
* @hide
*/
- public @NonNull RecoveryData getRecoveryData(@NonNull byte[] account)
+ @NonNull public KeychainSnapshot getRecoveryData(@NonNull byte[] account)
throws RecoveryManagerException {
try {
- RecoveryData recoveryData = mBinder.getRecoveryData(account);
- return recoveryData;
+ KeychainSnapshot keychainSnapshot = mBinder.getRecoveryData(account);
+ return keychainSnapshot;
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
} catch (ServiceSpecificException e) {
* version. Version zero is used, if no snapshots were created for the account.
*
* @return Map from recovery agent accounts to snapshot versions.
- * @see RecoveryData#getSnapshotVersion
+ * @see KeychainSnapshot#getSnapshotVersion
* @hide
*/
public @NonNull Map<byte[], Integer> getRecoverySnapshotVersions()
/**
* Server parameters used to generate new recovery key blobs. This value will be included in
- * {@code RecoveryData.getEncryptedRecoveryKeyBlob()}. The same value must be included
+ * {@code KeychainSnapshot.getEncryptedRecoveryKeyBlob()}. The same value must be included
* in vaultParams {@link #startRecoverySession}
*
* @param serverParams included in recovery key blob.
* Specifies a set of secret types used for end-to-end keystore encryption. Knowing all of them
* is necessary to recover data.
*
- * @param secretTypes {@link RecoveryMetadata#TYPE_LOCKSCREEN} or {@link
- * RecoveryMetadata#TYPE_CUSTOM_PASSWORD}
+ * @param secretTypes {@link KeychainProtectionParameter#TYPE_LOCKSCREEN} or {@link
+ * KeychainProtectionParameter#TYPE_CUSTOM_PASSWORD}
*/
public void setRecoverySecretTypes(
- @NonNull @RecoveryMetadata.UserSecretType int[] secretTypes)
+ @NonNull @KeychainProtectionParameter.UserSecretType int[] secretTypes)
throws RecoveryManagerException {
try {
mBinder.setRecoverySecretTypes(secretTypes);
/**
* Defines a set of secret types used for end-to-end keystore encryption. Knowing all of them is
- * necessary to generate RecoveryData.
+ * necessary to generate KeychainSnapshot.
*
* @return list of recovery secret types
- * @see RecoveryData
+ * @see KeychainSnapshot
*/
- public @NonNull @RecoveryMetadata.UserSecretType int[] getRecoverySecretTypes()
+ @NonNull public @KeychainProtectionParameter.UserSecretType int[] getRecoverySecretTypes()
throws RecoveryManagerException {
try {
return mBinder.getRecoverySecretTypes();
* @return list of recovery secret types
* @hide
*/
- public @NonNull @RecoveryMetadata.UserSecretType int[] getPendingRecoverySecretTypes()
+ @NonNull
+ public @KeychainProtectionParameter.UserSecretType int[] getPendingRecoverySecretTypes()
throws RecoveryManagerException {
try {
return mBinder.getPendingRecoverySecretTypes();
/**
* Method notifies KeyStore that a user-generated secret is available. This method generates a
* symmetric session key which a trusted remote device can use to return a recovery key. Caller
- * should use {@link RecoveryMetadata#clearSecret} to override the secret value in
+ * should use {@link KeychainProtectionParameter#clearSecret} to override the secret value in
* memory.
*
* @param recoverySecret user generated secret together with parameters necessary to regenerate
* it on a new device.
* @hide
*/
- public void recoverySecretAvailable(@NonNull RecoveryMetadata recoverySecret)
+ public void recoverySecretAvailable(@NonNull KeychainProtectionParameter recoverySecret)
throws RecoveryManagerException {
try {
mBinder.recoverySecretAvailable(recoverySecret);
@NonNull byte[] verifierPublicKey,
@NonNull byte[] vaultParams,
@NonNull byte[] vaultChallenge,
- @NonNull List<RecoveryMetadata> secrets)
+ @NonNull List<KeychainProtectionParameter> secrets)
throws RecoveryManagerException {
try {
byte[] recoveryClaim =
* @param recoveryKeyBlob Recovery blob encrypted by symmetric key generated for this session.
* @param applicationKeys Application keys. Key material can be decrypted using recoveryKeyBlob
* and session. KeyStore only uses package names from the application info in {@link
- * EntryRecoveryData}. Caller is responsibility to perform certificates check.
+ * WrappedApplicationKey}. Caller is responsibility to perform certificates check.
* @return Map from alias to raw key material.
*/
public Map<String, byte[]> recoverKeys(
@NonNull String sessionId,
@NonNull byte[] recoveryKeyBlob,
- @NonNull List<EntryRecoveryData> applicationKeys)
+ @NonNull List<WrappedApplicationKey> applicationKeys)
throws RecoveryManagerException {
try {
return (Map<String, byte[]>) mBinder.recoverKeys(
package android.security.keystore;
/* @hide */
-parcelable EntryRecoveryData;
+parcelable WrappedApplicationKey;
*
* @hide
*/
-public final class EntryRecoveryData implements Parcelable {
+public final class WrappedApplicationKey implements Parcelable {
private String mAlias;
// The only supported format is AES-256 symmetric key.
private byte[] mEncryptedKeyMaterial;
/**
- * Builder for creating {@link EntryRecoveryData}.
+ * Builder for creating {@link WrappedApplicationKey}.
*/
public static class Builder {
- private EntryRecoveryData mInstance = new EntryRecoveryData();
+ private WrappedApplicationKey mInstance = new WrappedApplicationKey();
/**
* Sets Application-specific alias of the key.
}
/**
- * Creates a new {@link EntryRecoveryData} instance.
+ * Creates a new {@link WrappedApplicationKey} instance.
*
* @return new instance
* @throws NullPointerException if some required fields were not set.
*/
- public @NonNull EntryRecoveryData build() {
+ @NonNull public WrappedApplicationKey build() {
Preconditions.checkNotNull(mInstance.mAlias);
Preconditions.checkNotNull(mInstance.mEncryptedKeyMaterial);
return mInstance;
}
}
- private EntryRecoveryData() {
+ private WrappedApplicationKey() {
}
* Deprecated - consider using Builder.
* @hide
*/
- public EntryRecoveryData(@NonNull String alias, @NonNull byte[] encryptedKeyMaterial) {
+ public WrappedApplicationKey(@NonNull String alias, @NonNull byte[] encryptedKeyMaterial) {
mAlias = Preconditions.checkNotNull(alias);
mEncryptedKeyMaterial = Preconditions.checkNotNull(encryptedKeyMaterial);
}
return mEncryptedKeyMaterial;
}
- public static final Parcelable.Creator<EntryRecoveryData> CREATOR =
- new Parcelable.Creator<EntryRecoveryData>() {
- public EntryRecoveryData createFromParcel(Parcel in) {
- return new EntryRecoveryData(in);
+ public static final Parcelable.Creator<WrappedApplicationKey> CREATOR =
+ new Parcelable.Creator<WrappedApplicationKey>() {
+ public WrappedApplicationKey createFromParcel(Parcel in) {
+ return new WrappedApplicationKey(in);
}
- public EntryRecoveryData[] newArray(int length) {
- return new EntryRecoveryData[length];
+ public WrappedApplicationKey[] newArray(int length) {
+ return new WrappedApplicationKey[length];
}
};
/**
* @hide
*/
- protected EntryRecoveryData(Parcel in) {
+ protected WrappedApplicationKey(Parcel in) {
mAlias = in.readString();
mEncryptedKeyMaterial = in.createByteArray();
}
import android.app.PendingIntent;
import android.app.trust.IStrongAuthTracker;
import android.os.Bundle;
-import android.security.keystore.EntryRecoveryData;
-import android.security.keystore.RecoveryData;
-import android.security.keystore.RecoveryMetadata;
+import android.security.keystore.WrappedApplicationKey;
+import android.security.keystore.KeychainSnapshot;
+import android.security.keystore.KeychainProtectionParameter;
import com.android.internal.widget.ICheckCredentialProgressCallback;
import com.android.internal.widget.VerifyCredentialResponse;
// {@code ServiceSpecificException} may be thrown to signal an error, which caller can
// convert to {@code RecoveryManagerException}.
void initRecoveryService(in String rootCertificateAlias, in byte[] signedPublicKeyList);
- RecoveryData getRecoveryData(in byte[] account);
+ KeychainSnapshot getRecoveryData(in byte[] account);
byte[] generateAndStoreKey(String alias);
void removeKey(String alias);
void setSnapshotCreatedPendingIntent(in PendingIntent intent);
void setRecoverySecretTypes(in int[] secretTypes);
int[] getRecoverySecretTypes();
int[] getPendingRecoverySecretTypes();
- void recoverySecretAvailable(in RecoveryMetadata recoverySecret);
+ void recoverySecretAvailable(in KeychainProtectionParameter recoverySecret);
byte[] startRecoverySession(in String sessionId,
in byte[] verifierPublicKey, in byte[] vaultParams, in byte[] vaultChallenge,
- in List<RecoveryMetadata> secrets);
+ in List<KeychainProtectionParameter> secrets);
Map/*<String, byte[]>*/ recoverKeys(in String sessionId, in byte[] recoveryKeyBlob,
- in List<EntryRecoveryData> applicationKeys);
+ in List<WrappedApplicationKey> applicationKeys);
}
import android.os.RemoteException;
import android.os.ResultReceiver;
import android.os.ServiceManager;
-import android.os.ServiceSpecificException;
import android.os.ShellCallback;
import android.os.StrictMode;
import android.os.SystemProperties;
import android.security.keystore.AndroidKeyStoreProvider;
import android.security.keystore.KeyProperties;
import android.security.keystore.KeyProtection;
+import android.security.keystore.KeychainProtectionParameter;
import android.security.keystore.UserNotAuthenticatedException;
-import android.security.keystore.EntryRecoveryData;
-import android.security.keystore.RecoveryData;
-import android.security.keystore.RecoveryMetadata;
-import android.security.keystore.RecoveryManagerException;
+import android.security.keystore.WrappedApplicationKey;
+import android.security.keystore.KeychainSnapshot;
import android.service.gatekeeper.GateKeeperResponse;
import android.service.gatekeeper.IGateKeeperService;
import android.text.TextUtils;
}
@Override
- public RecoveryData getRecoveryData(@NonNull byte[] account) throws RemoteException {
+ public KeychainSnapshot getRecoveryData(@NonNull byte[] account) throws RemoteException {
return mRecoverableKeyStoreManager.getRecoveryData(account);
}
}
@Override
- public void setRecoverySecretTypes(@NonNull @RecoveryMetadata.UserSecretType
+ public void setRecoverySecretTypes(@NonNull @KeychainProtectionParameter.UserSecretType
int[] secretTypes) throws RemoteException {
mRecoverableKeyStoreManager.setRecoverySecretTypes(secretTypes);
}
}
@Override
- public void recoverySecretAvailable(@NonNull RecoveryMetadata recoverySecret)
+ public void recoverySecretAvailable(@NonNull KeychainProtectionParameter recoverySecret)
throws RemoteException {
mRecoverableKeyStoreManager.recoverySecretAvailable(recoverySecret);
}
@Override
public byte[] startRecoverySession(@NonNull String sessionId,
@NonNull byte[] verifierPublicKey, @NonNull byte[] vaultParams,
- @NonNull byte[] vaultChallenge, @NonNull List<RecoveryMetadata> secrets)
+ @NonNull byte[] vaultChallenge, @NonNull List<KeychainProtectionParameter> secrets)
throws RemoteException {
return mRecoverableKeyStoreManager.startRecoverySession(sessionId, verifierPublicKey,
vaultParams, vaultChallenge, secrets);
@Override
public Map<String, byte[]> recoverKeys(@NonNull String sessionId,
- @NonNull byte[] recoveryKeyBlob, @NonNull List<EntryRecoveryData> applicationKeys)
+ @NonNull byte[] recoveryKeyBlob, @NonNull List<WrappedApplicationKey> applicationKeys)
throws RemoteException {
return mRecoverableKeyStoreManager.recoverKeys(
sessionId, recoveryKeyBlob, applicationKeys);
package com.android.server.locksettings.recoverablekeystore;
-import static android.security.keystore.RecoveryMetadata.TYPE_LOCKSCREEN;
+import static android.security.keystore.KeychainProtectionParameter.TYPE_LOCKSCREEN;
-import android.annotation.NonNull;
import android.annotation.Nullable;
import android.content.Context;
import android.security.keystore.KeyDerivationParams;
-import android.security.keystore.EntryRecoveryData;
-import android.security.keystore.RecoveryData;
-import android.security.keystore.RecoveryMetadata;
+import android.security.keystore.KeychainProtectionParameter;
+import android.security.keystore.KeychainSnapshot;
+import android.security.keystore.WrappedApplicationKey;
import android.util.Log;
import com.android.internal.annotations.VisibleForTesting;
}
// TODO: store raw data in RecoveryServiceMetadataEntry and generate Parcelables later
// TODO: use Builder.
- RecoveryMetadata metadata = new RecoveryMetadata(
+ KeychainProtectionParameter metadata = new KeychainProtectionParameter(
/*userSecretType=*/ TYPE_LOCKSCREEN,
/*lockScreenUiFormat=*/ getUiFormat(mCredentialType, mCredential),
/*keyDerivationParams=*/ KeyDerivationParams.createSha256Params(salt),
/*secret=*/ new byte[0]);
- ArrayList<RecoveryMetadata> metadataList = new ArrayList<>();
+ ArrayList<KeychainProtectionParameter> metadataList = new ArrayList<>();
metadataList.add(metadata);
int snapshotVersion = incrementSnapshotVersion(recoveryAgentUid);
mRecoverableKeyStoreDb.setShouldCreateSnapshot(mUserId, recoveryAgentUid, false);
// TODO: use Builder.
- mRecoverySnapshotStorage.put(recoveryAgentUid, new RecoveryData(
+ mRecoverySnapshotStorage.put(recoveryAgentUid, new KeychainSnapshot(
snapshotVersion,
/*recoveryMetadata=*/ metadataList,
/*applicationKeyBlobs=*/ createApplicationKeyEntries(encryptedApplicationKeys),
*/
private boolean shoudCreateSnapshot(int recoveryAgentUid) {
int[] types = mRecoverableKeyStoreDb.getRecoverySecretTypes(mUserId, recoveryAgentUid);
- if (!ArrayUtils.contains(types, RecoveryMetadata.TYPE_LOCKSCREEN)) {
+ if (!ArrayUtils.contains(types, KeychainProtectionParameter.TYPE_LOCKSCREEN)) {
// Only lockscreen type is supported.
// We will need to pass extra argument to KeySyncTask to support custom pass phrase.
return false;
* @return The format - either pattern, pin, or password.
*/
@VisibleForTesting
- @RecoveryMetadata.LockScreenUiFormat static int getUiFormat(
+ @KeychainProtectionParameter.LockScreenUiFormat static int getUiFormat(
int credentialType, String credential) {
if (credentialType == LockPatternUtils.CREDENTIAL_TYPE_PATTERN) {
- return RecoveryMetadata.TYPE_PATTERN;
+ return KeychainProtectionParameter.TYPE_PATTERN;
} else if (isPin(credential)) {
- return RecoveryMetadata.TYPE_PIN;
+ return KeychainProtectionParameter.TYPE_PIN;
} else {
- return RecoveryMetadata.TYPE_PASSWORD;
+ return KeychainProtectionParameter.TYPE_PASSWORD;
}
}
return keyGenerator.generateKey();
}
- private static List<EntryRecoveryData> createApplicationKeyEntries(
+ private static List<WrappedApplicationKey> createApplicationKeyEntries(
Map<String, byte[]> encryptedApplicationKeys) {
- ArrayList<EntryRecoveryData> keyEntries = new ArrayList<>();
+ ArrayList<WrappedApplicationKey> keyEntries = new ArrayList<>();
for (String alias : encryptedApplicationKeys.keySet()) {
keyEntries.add(
- new EntryRecoveryData(
+ new WrappedApplicationKey(
alias,
encryptedApplicationKeys.get(alias)));
}
import android.os.ServiceSpecificException;
import android.os.UserHandle;
-import android.security.keystore.EntryRecoveryData;
-import android.security.keystore.RecoveryData;
-import android.security.keystore.RecoveryMetadata;
+import android.security.keystore.KeychainProtectionParameter;
+import android.security.keystore.KeychainSnapshot;
+import android.security.keystore.WrappedApplicationKey;
import android.security.keystore.RecoveryManager;
import android.util.Log;
import com.android.server.locksettings.recoverablekeystore.storage.RecoverySessionStorage;
import com.android.server.locksettings.recoverablekeystore.storage.RecoverySnapshotStorage;
-import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.KeyStoreException;
import java.security.KeyFactory;
* @return recovery data
* @hide
*/
- public @NonNull RecoveryData getRecoveryData(@NonNull byte[] account)
+ public @NonNull
+ KeychainSnapshot getRecoveryData(@NonNull byte[] account)
throws RemoteException {
checkRecoverKeyStorePermission();
int uid = Binder.getCallingUid();
- RecoveryData snapshot = mSnapshotStorage.get(uid);
+ KeychainSnapshot snapshot = mSnapshotStorage.get(uid);
if (snapshot == null) {
throw new ServiceSpecificException(ERROR_NO_SNAPSHOT_PENDING);
}
* @hide
*/
public void setRecoverySecretTypes(
- @NonNull @RecoveryMetadata.UserSecretType int[] secretTypes)
+ @NonNull @KeychainProtectionParameter.UserSecretType int[] secretTypes)
throws RemoteException {
checkRecoverKeyStorePermission();
int userId = UserHandle.getCallingUserId();
}
public void recoverySecretAvailable(
- @NonNull RecoveryMetadata recoverySecret) throws RemoteException {
+ @NonNull KeychainProtectionParameter recoverySecret) throws RemoteException {
int uid = Binder.getCallingUid();
- if (recoverySecret.getLockScreenUiFormat() == RecoveryMetadata.TYPE_LOCKSCREEN) {
+ if (recoverySecret.getLockScreenUiFormat() == KeychainProtectionParameter.TYPE_LOCKSCREEN) {
throw new SecurityException(
"Caller " + uid + " is not allowed to set lock screen secret");
}
@NonNull byte[] verifierPublicKey,
@NonNull byte[] vaultParams,
@NonNull byte[] vaultChallenge,
- @NonNull List<RecoveryMetadata> secrets)
+ @NonNull List<KeychainProtectionParameter> secrets)
throws RemoteException {
checkRecoverKeyStorePermission();
int uid = Binder.getCallingUid();
if (secrets.size() != 1) {
- throw new UnsupportedOperationException("Only a single RecoveryMetadata is supported");
+ throw new UnsupportedOperationException("Only a single KeychainProtectionParameter is supported");
}
PublicKey publicKey;
public Map<String, byte[]> recoverKeys(
@NonNull String sessionId,
@NonNull byte[] encryptedRecoveryKey,
- @NonNull List<EntryRecoveryData> applicationKeys)
+ @NonNull List<WrappedApplicationKey> applicationKeys)
throws RemoteException {
checkRecoverKeyStorePermission();
int uid = Binder.getCallingUid();
*/
private Map<String, byte[]> recoverApplicationKeys(
@NonNull byte[] recoveryKey,
- @NonNull List<EntryRecoveryData> applicationKeys) throws RemoteException {
+ @NonNull List<WrappedApplicationKey> applicationKeys) throws RemoteException {
HashMap<String, byte[]> keyMaterialByAlias = new HashMap<>();
- for (EntryRecoveryData applicationKey : applicationKeys) {
+ for (WrappedApplicationKey applicationKey : applicationKeys) {
String alias = applicationKey.getAlias();
byte[] encryptedKeyMaterial = applicationKey.getEncryptedKeyMaterial();
/**
* Updates the list of user secret types used for end-to-end encryption.
* If no secret types are set, recovery snapshot will not be created.
- * See {@code RecoveryMetadata}
+ * See {@code KeychainProtectionParameter}
*
* @param userId The userId of the profile the application is running under.
* @param uid The uid of the application.
package com.android.server.locksettings.recoverablekeystore.storage;
import android.annotation.Nullable;
-import android.security.keystore.RecoveryData;
+import android.security.keystore.KeychainSnapshot;
import android.util.SparseArray;
import com.android.internal.annotations.GuardedBy;
*/
public class RecoverySnapshotStorage {
@GuardedBy("this")
- private final SparseArray<RecoveryData> mSnapshotByUid = new SparseArray<>();
+ private final SparseArray<KeychainSnapshot> mSnapshotByUid = new SparseArray<>();
/**
* Sets the latest {@code snapshot} for the recovery agent {@code uid}.
*/
- public synchronized void put(int uid, RecoveryData snapshot) {
+ public synchronized void put(int uid, KeychainSnapshot snapshot) {
mSnapshotByUid.put(uid, snapshot);
}
* Returns the latest snapshot for the recovery agent {@code uid}, or null if none exists.
*/
@Nullable
- public synchronized RecoveryData get(int uid) {
+ public synchronized KeychainSnapshot get(int uid) {
return mSnapshotByUid.get(uid);
}
package com.android.server.locksettings.recoverablekeystore;
-import static android.security.keystore.RecoveryMetadata.TYPE_LOCKSCREEN;
+import static android.security.keystore.KeychainProtectionParameter.TYPE_LOCKSCREEN;
-import static android.security.keystore.RecoveryMetadata.TYPE_PASSWORD;
-import static android.security.keystore.RecoveryMetadata.TYPE_PATTERN;
-import static android.security.keystore.RecoveryMetadata.TYPE_PIN;
+import static android.security.keystore.KeychainProtectionParameter.TYPE_PASSWORD;
+import static android.security.keystore.KeychainProtectionParameter.TYPE_PATTERN;
+import static android.security.keystore.KeychainProtectionParameter.TYPE_PIN;
import static com.android.internal.widget.LockPatternUtils.CREDENTIAL_TYPE_PASSWORD;
import static com.android.internal.widget.LockPatternUtils.CREDENTIAL_TYPE_PATTERN;
import android.security.keystore.KeyGenParameterSpec;
import android.security.keystore.KeyProperties;
import android.security.keystore.KeyDerivationParams;
-import android.security.keystore.EntryRecoveryData;
-import android.security.keystore.RecoveryData;
+import android.security.keystore.KeychainSnapshot;
+import android.security.keystore.WrappedApplicationKey;
import android.support.test.InstrumentationRegistry;
import android.support.test.filters.SmallTest;
import android.support.test.runner.AndroidJUnit4;
addApplicationKey(TEST_USER_ID, TEST_RECOVERY_AGENT_UID, TEST_APP_KEY_ALIAS);
mKeySyncTask.run();
- RecoveryData recoveryData = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
+ KeychainSnapshot keychainSnapshot = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
KeyDerivationParams KeyDerivationParams =
- recoveryData.getRecoveryMetadata().get(0).getKeyDerivationParams();
+ keychainSnapshot.getKeychainProtectionParams().get(0).getKeyDerivationParams();
assertThat(KeyDerivationParams.getAlgorithm()).isEqualTo(
KeyDerivationParams.ALGORITHM_SHA256);
verify(mSnapshotListenersStorage).recoverySnapshotAvailable(TEST_RECOVERY_AGENT_UID);
assertThat(counterId).isNotNull();
byte[] recoveryKey = decryptThmEncryptedKey(
lockScreenHash,
- recoveryData.getEncryptedRecoveryKeyBlob(),
+ keychainSnapshot.getEncryptedRecoveryKeyBlob(),
/*vaultParams=*/ KeySyncUtils.packVaultParams(
mKeyPair.getPublic(),
counterId,
TEST_DEVICE_ID,
/*maxAttempts=*/ 10));
- List<EntryRecoveryData> applicationKeys = recoveryData.getEntryRecoveryData();
+ List<WrappedApplicationKey> applicationKeys = keychainSnapshot.getWrappedApplicationKeys();
assertThat(applicationKeys).hasSize(1);
- EntryRecoveryData keyData = applicationKeys.get(0);
+ WrappedApplicationKey keyData = applicationKeys.get(0);
assertEquals(TEST_APP_KEY_ALIAS, keyData.getAlias());
assertThat(keyData.getAlias()).isEqualTo(keyData.getAlias());
byte[] appKey = KeySyncUtils.decryptApplicationKey(
mKeySyncTask.run();
- RecoveryData recoveryData = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
- assertThat(recoveryData.getSnapshotVersion()).isEqualTo(1); // default value;
+ KeychainSnapshot keychainSnapshot = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
+ assertThat(keychainSnapshot.getSnapshotVersion()).isEqualTo(1); // default value;
mRecoverableKeyStoreDb.setShouldCreateSnapshot(TEST_USER_ID, TEST_RECOVERY_AGENT_UID, true);
mKeySyncTask.run();
- recoveryData = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
- assertThat(recoveryData.getSnapshotVersion()).isEqualTo(2); // Updated
+ keychainSnapshot = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
+ assertThat(keychainSnapshot.getSnapshotVersion()).isEqualTo(2); // Updated
}
@Test
mKeySyncTask.run();
- RecoveryData recoveryData = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
- assertThat(recoveryData.getRecoveryMetadata()).hasSize(1);
- assertThat(recoveryData.getRecoveryMetadata().get(0).getLockScreenUiFormat()).
+ KeychainSnapshot keychainSnapshot = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
+ assertThat(keychainSnapshot.getKeychainProtectionParams()).hasSize(1);
+ assertThat(keychainSnapshot.getKeychainProtectionParams().get(0).getLockScreenUiFormat()).
isEqualTo(TYPE_PASSWORD);
}
mKeySyncTask.run();
- RecoveryData recoveryData = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
- assertThat(recoveryData.getRecoveryMetadata()).hasSize(1);
+ KeychainSnapshot keychainSnapshot = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
+ assertThat(keychainSnapshot.getKeychainProtectionParams()).hasSize(1);
// Password with only digits is changed to pin.
- assertThat(recoveryData.getRecoveryMetadata().get(0).getLockScreenUiFormat()).
+ assertThat(keychainSnapshot.getKeychainProtectionParams().get(0).getLockScreenUiFormat()).
isEqualTo(TYPE_PIN);
}
mKeySyncTask.run();
- RecoveryData recoveryData = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
- assertThat(recoveryData.getRecoveryMetadata()).hasSize(1);
- assertThat(recoveryData.getRecoveryMetadata().get(0).getLockScreenUiFormat()).
+ KeychainSnapshot keychainSnapshot = mRecoverySnapshotStorage.get(TEST_RECOVERY_AGENT_UID);
+ assertThat(keychainSnapshot.getKeychainProtectionParams()).hasSize(1);
+ assertThat(keychainSnapshot.getKeychainProtectionParams().get(0).getLockScreenUiFormat()).
isEqualTo(TYPE_PATTERN);
}
package com.android.server.locksettings.recoverablekeystore;
-import static android.security.keystore.RecoveryMetadata.TYPE_LOCKSCREEN;
-import static android.security.keystore.RecoveryMetadata.TYPE_PASSWORD;
+import static android.security.keystore.KeychainProtectionParameter.TYPE_LOCKSCREEN;
+import static android.security.keystore.KeychainProtectionParameter.TYPE_PASSWORD;
import static com.google.common.truth.Truth.assertThat;
import static org.junit.Assert.assertArrayEquals;
import android.security.keystore.KeyGenParameterSpec;
import android.security.keystore.KeyProperties;
import android.security.keystore.KeyDerivationParams;
-import android.security.keystore.EntryRecoveryData;
-import android.security.keystore.RecoveryMetadata;
-import android.security.keystore.RecoveryManager;
+import android.security.keystore.KeychainProtectionParameter;
+import android.security.keystore.WrappedApplicationKey;
import android.support.test.filters.SmallTest;
import android.support.test.InstrumentationRegistry;
import android.support.test.runner.AndroidJUnit4;
TEST_VAULT_PARAMS,
TEST_VAULT_CHALLENGE,
ImmutableList.of(
- new RecoveryMetadata(
+ new KeychainProtectionParameter(
TYPE_LOCKSCREEN,
TYPE_PASSWORD,
KeyDerivationParams.createSha256Params(TEST_SALT),
TEST_VAULT_PARAMS,
TEST_VAULT_CHALLENGE,
ImmutableList.of(
- new RecoveryMetadata(
+ new KeychainProtectionParameter(
TYPE_LOCKSCREEN,
TYPE_PASSWORD,
KeyDerivationParams.createSha256Params(TEST_SALT),
fail("should have thrown");
} catch (ServiceSpecificException e) {
assertThat(e.getMessage()).startsWith(
- "Only a single RecoveryMetadata is supported");
+ "Only a single KeychainProtectionParameter is supported");
}
}
TEST_VAULT_PARAMS,
TEST_VAULT_CHALLENGE,
ImmutableList.of(
- new RecoveryMetadata(
+ new KeychainProtectionParameter(
TYPE_LOCKSCREEN,
TYPE_PASSWORD,
KeyDerivationParams.createSha256Params(TEST_SALT),
vaultParams,
TEST_VAULT_CHALLENGE,
ImmutableList.of(
- new RecoveryMetadata(
+ new KeychainProtectionParameter(
TYPE_LOCKSCREEN,
TYPE_PASSWORD,
KeyDerivationParams.createSha256Params(TEST_SALT),
TEST_SESSION_ID,
/*recoveryKeyBlob=*/ randomBytes(32),
/*applicationKeys=*/ ImmutableList.of(
- new EntryRecoveryData("alias", randomBytes(32))
+ new WrappedApplicationKey("alias", randomBytes(32))
));
fail("should have thrown");
} catch (ServiceSpecificException e) {
TEST_PUBLIC_KEY,
TEST_VAULT_PARAMS,
TEST_VAULT_CHALLENGE,
- ImmutableList.of(new RecoveryMetadata(
+ ImmutableList.of(new KeychainProtectionParameter(
TYPE_LOCKSCREEN,
TYPE_PASSWORD,
KeyDerivationParams.createSha256Params(TEST_SALT),
TEST_PUBLIC_KEY,
TEST_VAULT_PARAMS,
TEST_VAULT_CHALLENGE,
- ImmutableList.of(new RecoveryMetadata(
+ ImmutableList.of(new KeychainProtectionParameter(
TYPE_LOCKSCREEN,
TYPE_PASSWORD,
KeyDerivationParams.createSha256Params(TEST_SALT),
SecretKey recoveryKey = randomRecoveryKey();
byte[] encryptedClaimResponse = encryptClaimResponse(
keyClaimant, TEST_SECRET, TEST_VAULT_PARAMS, recoveryKey);
- EntryRecoveryData badApplicationKey = new EntryRecoveryData(
+ WrappedApplicationKey badApplicationKey = new WrappedApplicationKey(
TEST_ALIAS,
randomBytes(32));
TEST_PUBLIC_KEY,
TEST_VAULT_PARAMS,
TEST_VAULT_CHALLENGE,
- ImmutableList.of(new RecoveryMetadata(
+ ImmutableList.of(new KeychainProtectionParameter(
TYPE_LOCKSCREEN,
TYPE_PASSWORD,
KeyDerivationParams.createSha256Params(TEST_SALT),
byte[] encryptedClaimResponse = encryptClaimResponse(
keyClaimant, TEST_SECRET, TEST_VAULT_PARAMS, recoveryKey);
byte[] applicationKeyBytes = randomBytes(32);
- EntryRecoveryData applicationKey = new EntryRecoveryData(
+ WrappedApplicationKey applicationKey = new WrappedApplicationKey(
TEST_ALIAS,
encryptedApplicationKey(recoveryKey, applicationKeyBytes));
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNull;
-import android.security.keystore.RecoveryData;
+import android.security.keystore.KeychainSnapshot;
import android.support.test.filters.SmallTest;
import android.support.test.runner.AndroidJUnit4;
@Test
public void get_returnsSetSnapshot() {
int userId = 1000;
- RecoveryData recoveryData = new RecoveryData(
+ KeychainSnapshot keychainSnapshot = new KeychainSnapshot(
/*snapshotVersion=*/ 1,
new ArrayList<>(),
new ArrayList<>(),
new byte[0]);
- mRecoverySnapshotStorage.put(userId, recoveryData);
+ mRecoverySnapshotStorage.put(userId, keychainSnapshot);
- assertEquals(recoveryData, mRecoverySnapshotStorage.get(userId));
+ assertEquals(keychainSnapshot, mRecoverySnapshotStorage.get(userId));
}
@Test
public void remove_removesSnapshots() {
int userId = 1000;
- RecoveryData recoveryData = new RecoveryData(
+ KeychainSnapshot keychainSnapshot = new KeychainSnapshot(
/*snapshotVersion=*/ 1,
new ArrayList<>(),
new ArrayList<>(),
new byte[0]);
- mRecoverySnapshotStorage.put(userId, recoveryData);
+ mRecoverySnapshotStorage.put(userId, keychainSnapshot);
mRecoverySnapshotStorage.remove(userId);
OSDN Git Service
