KeymasterDefs.java revision a95550f8016bbb0dba086dbd73eec63e6cdbbe98 
1/*
2 * Copyright (C) 2015 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17package android.security.keymaster;
18
19import java.util.HashMap;
20import java.util.Map;
21
22/**
23 * Class tracking all the keymaster enum values needed for the binder API to keystore.
24 * This must be kept in sync with hardware/libhardware/include/hardware/keymaster_defs.h
25 * See keymaster_defs.h for detailed descriptions of each constant.
26 * @hide
27 */
28public final class KeymasterDefs {
29
30    private KeymasterDefs() {}
31
32    // Tag types.
33    public static final int KM_INVALID = 0 << 28;
34    public static final int KM_ENUM = 1 << 28;
35    public static final int KM_ENUM_REP = 2 << 28;
36    public static final int KM_UINT = 3 << 28;
37    public static final int KM_UINT_REP = 4 << 28;
38    public static final int KM_ULONG = 5 << 28;
39    public static final int KM_DATE = 6 << 28;
40    public static final int KM_BOOL = 7 << 28;
41    public static final int KM_BIGNUM = 8 << 28;
42    public static final int KM_BYTES = 9 << 28;
43    public static final int KM_ULONG_REP = 10 << 28;
44
45    // Tag values.
46    public static final int KM_TAG_INVALID = KM_INVALID | 0;
47    public static final int KM_TAG_PURPOSE = KM_ENUM_REP | 1;
48    public static final int KM_TAG_ALGORITHM = KM_ENUM | 2;
49    public static final int KM_TAG_KEY_SIZE = KM_UINT | 3;
50    public static final int KM_TAG_BLOCK_MODE = KM_ENUM_REP | 4;
51    public static final int KM_TAG_DIGEST = KM_ENUM_REP | 5;
52    public static final int KM_TAG_PADDING = KM_ENUM_REP | 6;
53    public static final int KM_TAG_CALLER_NONCE = KM_BOOL | 7;
54    public static final int KM_TAG_MIN_MAC_LENGTH = KM_UINT | 8;
55
56    public static final int KM_TAG_RESCOPING_ADD = KM_ENUM_REP | 101;
57    public static final int KM_TAG_RESCOPING_DEL = KM_ENUM_REP | 102;
58    public static final int KM_TAG_BLOB_USAGE_REQUIREMENTS = KM_ENUM | 705;
59
60    public static final int KM_TAG_RSA_PUBLIC_EXPONENT = KM_ULONG | 200;
61    public static final int KM_TAG_ACTIVE_DATETIME = KM_DATE | 400;
62    public static final int KM_TAG_ORIGINATION_EXPIRE_DATETIME = KM_DATE | 401;
63    public static final int KM_TAG_USAGE_EXPIRE_DATETIME = KM_DATE | 402;
64    public static final int KM_TAG_MIN_SECONDS_BETWEEN_OPS = KM_UINT | 403;
65    public static final int KM_TAG_MAX_USES_PER_BOOT = KM_UINT | 404;
66
67    public static final int KM_TAG_ALL_USERS = KM_BOOL | 500;
68    public static final int KM_TAG_USER_ID = KM_UINT | 501;
69    public static final int KM_TAG_USER_SECURE_ID = KM_ULONG_REP | 502;
70    public static final int KM_TAG_NO_AUTH_REQUIRED = KM_BOOL | 503;
71    public static final int KM_TAG_USER_AUTH_TYPE = KM_ENUM | 504;
72    public static final int KM_TAG_AUTH_TIMEOUT = KM_UINT | 505;
73
74    public static final int KM_TAG_ALL_APPLICATIONS = KM_BOOL | 600;
75    public static final int KM_TAG_APPLICATION_ID = KM_BYTES | 601;
76
77    public static final int KM_TAG_APPLICATION_DATA = KM_BYTES | 700;
78    public static final int KM_TAG_CREATION_DATETIME = KM_DATE | 701;
79    public static final int KM_TAG_ORIGIN = KM_ENUM | 702;
80    public static final int KM_TAG_ROLLBACK_RESISTANT = KM_BOOL | 703;
81    public static final int KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704;
82
83    public static final int KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000;
84    public static final int KM_TAG_NONCE = KM_BYTES | 1001;
85    public static final int KM_TAG_AUTH_TOKEN = KM_BYTES | 1002;
86    public static final int KM_TAG_MAC_LENGTH = KM_UINT | 1003;
87
88    // Algorithm values.
89    public static final int KM_ALGORITHM_RSA = 1;
90    public static final int KM_ALGORITHM_EC = 3;
91    public static final int KM_ALGORITHM_AES = 32;
92    public static final int KM_ALGORITHM_HMAC = 128;
93
94    // Block modes.
95    public static final int KM_MODE_ECB = 1;
96    public static final int KM_MODE_CBC = 2;
97    public static final int KM_MODE_CTR = 3;
98    public static final int KM_MODE_GCM = 32;
99
100    // Padding modes.
101    public static final int KM_PAD_NONE = 1;
102    public static final int KM_PAD_RSA_OAEP = 2;
103    public static final int KM_PAD_RSA_PSS = 3;
104    public static final int KM_PAD_RSA_PKCS1_1_5_ENCRYPT = 4;
105    public static final int KM_PAD_RSA_PKCS1_1_5_SIGN = 5;
106    public static final int KM_PAD_PKCS7 = 64;
107
108    // Digest modes.
109    public static final int KM_DIGEST_NONE = 0;
110    public static final int KM_DIGEST_MD5 = 1;
111    public static final int KM_DIGEST_SHA1 = 2;
112    public static final int KM_DIGEST_SHA_2_224 = 3;
113    public static final int KM_DIGEST_SHA_2_256 = 4;
114    public static final int KM_DIGEST_SHA_2_384 = 5;
115    public static final int KM_DIGEST_SHA_2_512 = 6;
116
117    // Key origins.
118    public static final int KM_ORIGIN_GENERATED = 0;
119    public static final int KM_ORIGIN_IMPORTED = 2;
120    public static final int KM_ORIGIN_UNKNOWN = 3;
121
122    // Key usability requirements.
123    public static final int KM_BLOB_STANDALONE = 0;
124    public static final int KM_BLOB_REQUIRES_FILE_SYSTEM = 1;
125
126    // Operation Purposes.
127    public static final int KM_PURPOSE_ENCRYPT = 0;
128    public static final int KM_PURPOSE_DECRYPT = 1;
129    public static final int KM_PURPOSE_SIGN = 2;
130    public static final int KM_PURPOSE_VERIFY = 3;
131
132    // Key formats.
133    public static final int KM_KEY_FORMAT_X509 = 0;
134    public static final int KM_KEY_FORMAT_PKCS8 = 1;
135    public static final int KM_KEY_FORMAT_RAW = 3;
136
137    // User authenticators.
138    public static final int HW_AUTH_PASSWORD = 1 << 0;
139    public static final int HW_AUTH_FINGERPRINT = 1 << 1;
140
141    // Error codes.
142    public static final int KM_ERROR_OK = 0;
143    public static final int KM_ERROR_ROOT_OF_TRUST_ALREADY_SET = -1;
144    public static final int KM_ERROR_UNSUPPORTED_PURPOSE = -2;
145    public static final int KM_ERROR_INCOMPATIBLE_PURPOSE = -3;
146    public static final int KM_ERROR_UNSUPPORTED_ALGORITHM = -4;
147    public static final int KM_ERROR_INCOMPATIBLE_ALGORITHM = -5;
148    public static final int KM_ERROR_UNSUPPORTED_KEY_SIZE = -6;
149    public static final int KM_ERROR_UNSUPPORTED_BLOCK_MODE = -7;
150    public static final int KM_ERROR_INCOMPATIBLE_BLOCK_MODE = -8;
151    public static final int KM_ERROR_UNSUPPORTED_MAC_LENGTH = -9;
152    public static final int KM_ERROR_UNSUPPORTED_PADDING_MODE = -10;
153    public static final int KM_ERROR_INCOMPATIBLE_PADDING_MODE = -11;
154    public static final int KM_ERROR_UNSUPPORTED_DIGEST = -12;
155    public static final int KM_ERROR_INCOMPATIBLE_DIGEST = -13;
156    public static final int KM_ERROR_INVALID_EXPIRATION_TIME = -14;
157    public static final int KM_ERROR_INVALID_USER_ID = -15;
158    public static final int KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT = -16;
159    public static final int KM_ERROR_UNSUPPORTED_KEY_FORMAT = -17;
160    public static final int KM_ERROR_INCOMPATIBLE_KEY_FORMAT = -18;
161    public static final int KM_ERROR_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = -19;
162    public static final int KM_ERROR_UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = -20;
163    public static final int KM_ERROR_INVALID_INPUT_LENGTH = -21;
164    public static final int KM_ERROR_KEY_EXPORT_OPTIONS_INVALID = -22;
165    public static final int KM_ERROR_DELEGATION_NOT_ALLOWED = -23;
166    public static final int KM_ERROR_KEY_NOT_YET_VALID = -24;
167    public static final int KM_ERROR_KEY_EXPIRED = -25;
168    public static final int KM_ERROR_KEY_USER_NOT_AUTHENTICATED = -26;
169    public static final int KM_ERROR_OUTPUT_PARAMETER_NULL = -27;
170    public static final int KM_ERROR_INVALID_OPERATION_HANDLE = -28;
171    public static final int KM_ERROR_INSUFFICIENT_BUFFER_SPACE = -29;
172    public static final int KM_ERROR_VERIFICATION_FAILED = -30;
173    public static final int KM_ERROR_TOO_MANY_OPERATIONS = -31;
174    public static final int KM_ERROR_UNEXPECTED_NULL_POINTER = -32;
175    public static final int KM_ERROR_INVALID_KEY_BLOB = -33;
176    public static final int KM_ERROR_IMPORTED_KEY_NOT_ENCRYPTED = -34;
177    public static final int KM_ERROR_IMPORTED_KEY_DECRYPTION_FAILED = -35;
178    public static final int KM_ERROR_IMPORTED_KEY_NOT_SIGNED = -36;
179    public static final int KM_ERROR_IMPORTED_KEY_VERIFICATION_FAILED = -37;
180    public static final int KM_ERROR_INVALID_ARGUMENT = -38;
181    public static final int KM_ERROR_UNSUPPORTED_TAG = -39;
182    public static final int KM_ERROR_INVALID_TAG = -40;
183    public static final int KM_ERROR_MEMORY_ALLOCATION_FAILED = -41;
184    public static final int KM_ERROR_INVALID_RESCOPING = -42;
185    public static final int KM_ERROR_IMPORT_PARAMETER_MISMATCH = -44;
186    public static final int KM_ERROR_SECURE_HW_ACCESS_DENIED = -45;
187    public static final int KM_ERROR_OPERATION_CANCELLED = -46;
188    public static final int KM_ERROR_CONCURRENT_ACCESS_CONFLICT = -47;
189    public static final int KM_ERROR_SECURE_HW_BUSY = -48;
190    public static final int KM_ERROR_SECURE_HW_COMMUNICATION_FAILED = -49;
191    public static final int KM_ERROR_UNSUPPORTED_EC_FIELD = -50;
192    public static final int KM_ERROR_MISSING_NONCE = -51;
193    public static final int KM_ERROR_INVALID_NONCE = -52;
194    public static final int KM_ERROR_MISSING_MAC_LENGTH = -53;
195    public static final int KM_ERROR_KEY_RATE_LIMIT_EXCEEDED = -54;
196    public static final int KM_ERROR_CALLER_NONCE_PROHIBITED = -55;
197    public static final int KM_ERROR_KEY_MAX_OPS_EXCEEDED = -56;
198    public static final int KM_ERROR_INVALID_MAC_LENGTH = -57;
199    public static final int KM_ERROR_MISSING_MIN_MAC_LENGTH = -58;
200    public static final int KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH = -59;
201    public static final int KM_ERROR_UNIMPLEMENTED = -100;
202    public static final int KM_ERROR_VERSION_MISMATCH = -101;
203    public static final int KM_ERROR_UNKNOWN_ERROR = -1000;
204
205    public static final Map<Integer, String> sErrorCodeToString = new HashMap<Integer, String>();
206    static {
207        sErrorCodeToString.put(KM_ERROR_OK, "OK");
208        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_PURPOSE, "Unsupported purpose");
209        sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_PURPOSE, "Incompatible purpose");
210        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_ALGORITHM, "Unsupported algorithm");
211        sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_ALGORITHM, "Incompatible algorithm");
212        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_KEY_SIZE, "Unsupported key size");
213        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_BLOCK_MODE, "Unsupported block mode");
214        sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_BLOCK_MODE, "Incompatible block mode");
215        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_MAC_LENGTH,
216                "Unsupported MAC or authentication tag length");
217        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_PADDING_MODE, "Unsupported padding mode");
218        sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_PADDING_MODE, "Incompatible padding mode");
219        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_DIGEST, "Unsupported digest");
220        sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_DIGEST, "Incompatible digest");
221        sErrorCodeToString.put(KM_ERROR_INVALID_EXPIRATION_TIME, "Invalid expiration time");
222        sErrorCodeToString.put(KM_ERROR_INVALID_USER_ID, "Invalid user ID");
223        sErrorCodeToString.put(KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT,
224                "Invalid user authorization timeout");
225        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_KEY_FORMAT, "Unsupported key format");
226        sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_KEY_FORMAT, "Incompatible key format");
227        sErrorCodeToString.put(KM_ERROR_INVALID_INPUT_LENGTH, "Invalid input length");
228        sErrorCodeToString.put(KM_ERROR_KEY_NOT_YET_VALID, "Key not yet valid");
229        sErrorCodeToString.put(KM_ERROR_KEY_EXPIRED, "Key expired");
230        sErrorCodeToString.put(KM_ERROR_KEY_USER_NOT_AUTHENTICATED, "Key user not authenticated");
231        sErrorCodeToString.put(KM_ERROR_INVALID_OPERATION_HANDLE, "Invalid operation handle");
232        sErrorCodeToString.put(KM_ERROR_VERIFICATION_FAILED, "Signature/MAC verification failed");
233        sErrorCodeToString.put(KM_ERROR_TOO_MANY_OPERATIONS, "Too many operations");
234        sErrorCodeToString.put(KM_ERROR_INVALID_KEY_BLOB, "Invalid key blob");
235        sErrorCodeToString.put(KM_ERROR_INVALID_ARGUMENT, "Invalid argument");
236        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_TAG, "Unsupported tag");
237        sErrorCodeToString.put(KM_ERROR_INVALID_TAG, "Invalid tag");
238        sErrorCodeToString.put(KM_ERROR_MEMORY_ALLOCATION_FAILED, "Memory allocation failed");
239        sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_EC_FIELD, "Unsupported EC field");
240        sErrorCodeToString.put(KM_ERROR_MISSING_NONCE, "Required IV missing");
241        sErrorCodeToString.put(KM_ERROR_INVALID_NONCE, "Invalid IV");
242        sErrorCodeToString.put(KM_ERROR_CALLER_NONCE_PROHIBITED,
243                "Caller-provided IV not permitted");
244        sErrorCodeToString.put(KM_ERROR_INVALID_MAC_LENGTH,
245                "Invalid MAC or authentication tag length");
246        sErrorCodeToString.put(KM_ERROR_UNIMPLEMENTED, "Not implemented");
247        sErrorCodeToString.put(KM_ERROR_UNKNOWN_ERROR, "Unknown error");
248    }
249
250    public static int getTagType(int tag) {
251        return tag & (0xF << 28);
252    }
253
254    public static String getErrorMessage(int errorCode) {
255        String result = sErrorCodeToString.get(errorCode);
256        if (result != null) {
257            return result;
258        }
259        return String.valueOf(errorCode);
260    }
261}
262