From 459ef1e7ce2a128f194087f9689df830b7870884 Mon Sep 17 00:00:00 2001 From: Alex Klyubin Date: Wed, 29 Apr 2015 20:28:41 -0700 Subject: [PATCH] Surface KeyPermanentlyInvalidatedException for per-op auth keys. Bug: 20642549 Change-Id: Ibda270921f13a1fd695264583b0e4bd255f63aed --- keystore/java/android/security/KeyStoreCipherSpi.java | 10 ++++++++++ keystore/java/android/security/KeyStoreHmacSpi.java | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/keystore/java/android/security/KeyStoreCipherSpi.java b/keystore/java/android/security/KeyStoreCipherSpi.java index 125ca418c32e..917f71678e41 100644 --- a/keystore/java/android/security/KeyStoreCipherSpi.java +++ b/keystore/java/android/security/KeyStoreCipherSpi.java @@ -320,6 +320,16 @@ public abstract class KeyStoreCipherSpi extends CipherSpi implements KeyStoreCry mMainDataStreamer = new KeyStoreCryptoOperationChunkedStreamer( new KeyStoreCryptoOperationChunkedStreamer.MainDataStream( mKeyStore, opResult.token)); + + if (opResult.resultCode != KeyStore.NO_ERROR) { + // The operation requires user authentication. Check whether such authentication is + // possible (e.g., the key may have been permanently invalidated). + InvalidKeyException e = + mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode); + if (!(e instanceof UserNotAuthenticatedException)) { + throw e; + } + } } @Override diff --git a/keystore/java/android/security/KeyStoreHmacSpi.java b/keystore/java/android/security/KeyStoreHmacSpi.java index 2a3372143e2c..4590b9ce8f0e 100644 --- a/keystore/java/android/security/KeyStoreHmacSpi.java +++ b/keystore/java/android/security/KeyStoreHmacSpi.java @@ -183,6 +183,16 @@ public abstract class KeyStoreHmacSpi extends MacSpi implements KeyStoreCryptoOp mChunkedStreamer = new KeyStoreCryptoOperationChunkedStreamer( new KeyStoreCryptoOperationChunkedStreamer.MainDataStream( mKeyStore, mOperationToken)); + + if (opResult.resultCode != KeyStore.NO_ERROR) { + // The operation requires user authentication. Check whether such authentication is + // possible (e.g., the key may have been permanently invalidated). + InvalidKeyException e = + mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode); + if (!(e instanceof UserNotAuthenticatedException)) { + throw e; + } + } } @Override -- 2.11.0