AndroidKeyStoreKeyPairGeneratorSpi.java revision fdbc02a433e87da7bc730bd2e773e6d1c84d4e99 
1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17package android.security.keystore;
18
19import android.annotation.Nullable;
20import android.security.Credentials;
21import android.security.KeyPairGeneratorSpec;
22import android.security.KeyStore;
23import android.security.keymaster.KeyCharacteristics;
24import android.security.keymaster.KeymasterArguments;
25import android.security.keymaster.KeymasterDefs;
26
27import com.android.org.bouncycastle.asn1.ASN1EncodableVector;
28import com.android.org.bouncycastle.asn1.ASN1InputStream;
29import com.android.org.bouncycastle.asn1.ASN1Integer;
30import com.android.org.bouncycastle.asn1.ASN1ObjectIdentifier;
31import com.android.org.bouncycastle.asn1.DERBitString;
32import com.android.org.bouncycastle.asn1.DERInteger;
33import com.android.org.bouncycastle.asn1.DERNull;
34import com.android.org.bouncycastle.asn1.DERSequence;
35import com.android.org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
36import com.android.org.bouncycastle.asn1.x509.AlgorithmIdentifier;
37import com.android.org.bouncycastle.asn1.x509.Certificate;
38import com.android.org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
39import com.android.org.bouncycastle.asn1.x509.TBSCertificate;
40import com.android.org.bouncycastle.asn1.x509.Time;
41import com.android.org.bouncycastle.asn1.x509.V3TBSCertificateGenerator;
42import com.android.org.bouncycastle.asn1.x9.X9ObjectIdentifiers;
43import com.android.org.bouncycastle.jce.X509Principal;
44import com.android.org.bouncycastle.jce.provider.X509CertificateObject;
45import com.android.org.bouncycastle.x509.X509V3CertificateGenerator;
46
47import libcore.util.EmptyArray;
48
49import java.math.BigInteger;
50import java.security.InvalidAlgorithmParameterException;
51import java.security.KeyPair;
52import java.security.KeyPairGenerator;
53import java.security.KeyPairGeneratorSpi;
54import java.security.PrivateKey;
55import java.security.ProviderException;
56import java.security.PublicKey;
57import java.security.SecureRandom;
58import java.security.UnrecoverableKeyException;
59import java.security.cert.CertificateEncodingException;
60import java.security.cert.X509Certificate;
61import java.security.spec.AlgorithmParameterSpec;
62import java.security.spec.ECGenParameterSpec;
63import java.security.spec.RSAKeyGenParameterSpec;
64import java.util.ArrayList;
65import java.util.Collections;
66import java.util.Date;
67import java.util.HashMap;
68import java.util.HashSet;
69import java.util.List;
70import java.util.Locale;
71import java.util.Map;
72import java.util.Set;
73
74/**
75 * Provides a way to create instances of a KeyPair which will be placed in the
76 * Android keystore service usable only by the application that called it. This
77 * can be used in conjunction with
78 * {@link java.security.KeyStore#getInstance(String)} using the
79 * {@code "AndroidKeyStore"} type.
80 * <p>
81 * This class can not be directly instantiated and must instead be used via the
82 * {@link KeyPairGenerator#getInstance(String)
83 * KeyPairGenerator.getInstance("AndroidKeyStore")} API.
84 *
85 * @hide
86 */
87public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGeneratorSpi {
88
89    public static class RSA extends AndroidKeyStoreKeyPairGeneratorSpi {
90        public RSA() {
91            super(KeymasterDefs.KM_ALGORITHM_RSA);
92        }
93    }
94
95    public static class EC extends AndroidKeyStoreKeyPairGeneratorSpi {
96        public EC() {
97            super(KeymasterDefs.KM_ALGORITHM_EC);
98        }
99    }
100
101    /*
102     * These must be kept in sync with system/security/keystore/defaults.h
103     */
104
105    /* EC */
106    private static final int EC_DEFAULT_KEY_SIZE = 256;
107
108    /* RSA */
109    private static final int RSA_DEFAULT_KEY_SIZE = 2048;
110    private static final int RSA_MIN_KEY_SIZE = 512;
111    private static final int RSA_MAX_KEY_SIZE = 8192;
112
113    private static final Map<String, Integer> SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE =
114            new HashMap<String, Integer>();
115    private static final List<String> SUPPORTED_EC_NIST_CURVE_NAMES = new ArrayList<String>();
116    private static final List<Integer> SUPPORTED_EC_NIST_CURVE_SIZES = new ArrayList<Integer>();
117    static {
118        // Aliases for NIST P-224
119        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("p-224", 224);
120        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("secp224r1", 224);
121
122
123        // Aliases for NIST P-256
124        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("p-256", 256);
125        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("secp256r1", 256);
126        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("prime256v1", 256);
127
128        // Aliases for NIST P-384
129        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("p-384", 384);
130        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("secp384r1", 384);
131
132        // Aliases for NIST P-521
133        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("p-521", 521);
134        SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.put("secp521r1", 521);
135
136        SUPPORTED_EC_NIST_CURVE_NAMES.addAll(SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.keySet());
137        Collections.sort(SUPPORTED_EC_NIST_CURVE_NAMES);
138
139        SUPPORTED_EC_NIST_CURVE_SIZES.addAll(
140                new HashSet<Integer>(SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.values()));
141        Collections.sort(SUPPORTED_EC_NIST_CURVE_SIZES);
142    }
143
144    private final int mOriginalKeymasterAlgorithm;
145
146    private KeyStore mKeyStore;
147
148    private KeyGenParameterSpec mSpec;
149
150    private String mEntryAlias;
151    private boolean mEncryptionAtRestRequired;
152    private @KeyProperties.KeyAlgorithmEnum String mJcaKeyAlgorithm;
153    private int mKeymasterAlgorithm = -1;
154    private int mKeySizeBits;
155    private SecureRandom mRng;
156
157    private int[] mKeymasterPurposes;
158    private int[] mKeymasterBlockModes;
159    private int[] mKeymasterEncryptionPaddings;
160    private int[] mKeymasterSignaturePaddings;
161    private int[] mKeymasterDigests;
162
163    private BigInteger mRSAPublicExponent;
164
165    protected AndroidKeyStoreKeyPairGeneratorSpi(int keymasterAlgorithm) {
166        mOriginalKeymasterAlgorithm = keymasterAlgorithm;
167    }
168
169    @Override
170    public void initialize(int keysize, SecureRandom random) {
171        throw new IllegalArgumentException(
172                KeyGenParameterSpec.class.getName() + " or " + KeyPairGeneratorSpec.class.getName()
173                + " required to initialize this KeyPairGenerator");
174    }
175
176    @Override
177    public void initialize(AlgorithmParameterSpec params, SecureRandom random)
178            throws InvalidAlgorithmParameterException {
179        resetAll();
180
181        boolean success = false;
182        try {
183            if (params == null) {
184                throw new InvalidAlgorithmParameterException(
185                        "Must supply params of type " + KeyGenParameterSpec.class.getName()
186                        + " or " + KeyPairGeneratorSpec.class.getName());
187            }
188
189            KeyGenParameterSpec spec;
190            boolean encryptionAtRestRequired = false;
191            int keymasterAlgorithm = mOriginalKeymasterAlgorithm;
192            if (params instanceof KeyGenParameterSpec) {
193                spec = (KeyGenParameterSpec) params;
194            } else if (params instanceof KeyPairGeneratorSpec) {
195                // Legacy/deprecated spec
196                KeyPairGeneratorSpec legacySpec = (KeyPairGeneratorSpec) params;
197                try {
198                    KeyGenParameterSpec.Builder specBuilder;
199                    String specKeyAlgorithm = legacySpec.getKeyType();
200                    if (specKeyAlgorithm != null) {
201                        // Spec overrides the generator's default key algorithm
202                        try {
203                            keymasterAlgorithm =
204                                    KeyProperties.KeyAlgorithm.toKeymasterAsymmetricKeyAlgorithm(
205                                            specKeyAlgorithm);
206                        } catch (IllegalArgumentException e) {
207                            throw new InvalidAlgorithmParameterException(
208                                    "Invalid key type in parameters", e);
209                        }
210                    }
211                    switch (keymasterAlgorithm) {
212                        case KeymasterDefs.KM_ALGORITHM_EC:
213                            specBuilder = new KeyGenParameterSpec.Builder(
214                                    legacySpec.getKeystoreAlias(),
215                                    KeyProperties.PURPOSE_SIGN
216                                    | KeyProperties.PURPOSE_VERIFY);
217                            // Authorized to be used with any digest (including no digest).
218                            specBuilder.setDigests(KeyProperties.DIGEST_NONE);
219                            break;
220                        case KeymasterDefs.KM_ALGORITHM_RSA:
221                            specBuilder = new KeyGenParameterSpec.Builder(
222                                    legacySpec.getKeystoreAlias(),
223                                    KeyProperties.PURPOSE_ENCRYPT
224                                    | KeyProperties.PURPOSE_DECRYPT
225                                    | KeyProperties.PURPOSE_SIGN
226                                    | KeyProperties.PURPOSE_VERIFY);
227                            // Authorized to be used with any digest (including no digest).
228                            specBuilder.setDigests(KeyProperties.DIGEST_NONE);
229                            // Authorized to be used with any encryption and signature padding
230                            // scheme (including no padding).
231                            specBuilder.setEncryptionPaddings(
232                                    KeyProperties.ENCRYPTION_PADDING_NONE);
233                            // Disable randomized encryption requirement to support encryption
234                            // padding NONE above.
235                            specBuilder.setRandomizedEncryptionRequired(false);
236                            break;
237                        default:
238                            throw new ProviderException(
239                                    "Unsupported algorithm: " + mKeymasterAlgorithm);
240                    }
241
242                    if (legacySpec.getKeySize() != -1) {
243                        specBuilder.setKeySize(legacySpec.getKeySize());
244                    }
245                    if (legacySpec.getAlgorithmParameterSpec() != null) {
246                        specBuilder.setAlgorithmParameterSpec(
247                                legacySpec.getAlgorithmParameterSpec());
248                    }
249                    specBuilder.setCertificateSubject(legacySpec.getSubjectDN());
250                    specBuilder.setCertificateSerialNumber(legacySpec.getSerialNumber());
251                    specBuilder.setCertificateNotBefore(legacySpec.getStartDate());
252                    specBuilder.setCertificateNotAfter(legacySpec.getEndDate());
253                    encryptionAtRestRequired = legacySpec.isEncryptionRequired();
254                    specBuilder.setUserAuthenticationRequired(false);
255
256                    spec = specBuilder.build();
257                } catch (NullPointerException | IllegalArgumentException e) {
258                    throw new InvalidAlgorithmParameterException(e);
259                }
260            } else {
261                throw new InvalidAlgorithmParameterException(
262                        "Unsupported params class: " + params.getClass().getName()
263                        + ". Supported: " + KeyGenParameterSpec.class.getName()
264                        + ", " + KeyPairGeneratorSpec.class.getName());
265            }
266
267            mEntryAlias = spec.getKeystoreAlias();
268            mSpec = spec;
269            mKeymasterAlgorithm = keymasterAlgorithm;
270            mEncryptionAtRestRequired = encryptionAtRestRequired;
271            mKeySizeBits = spec.getKeySize();
272            initAlgorithmSpecificParameters();
273            if (mKeySizeBits == -1) {
274                mKeySizeBits = getDefaultKeySize(keymasterAlgorithm);
275            }
276            checkValidKeySize(keymasterAlgorithm, mKeySizeBits);
277
278            if (spec.getKeystoreAlias() == null) {
279                throw new InvalidAlgorithmParameterException("KeyStore entry alias not provided");
280            }
281
282            String jcaKeyAlgorithm;
283            try {
284                jcaKeyAlgorithm = KeyProperties.KeyAlgorithm.fromKeymasterAsymmetricKeyAlgorithm(
285                        keymasterAlgorithm);
286                mKeymasterPurposes = KeyProperties.Purpose.allToKeymaster(spec.getPurposes());
287                mKeymasterBlockModes = KeyProperties.BlockMode.allToKeymaster(spec.getBlockModes());
288                mKeymasterEncryptionPaddings = KeyProperties.EncryptionPadding.allToKeymaster(
289                        spec.getEncryptionPaddings());
290                if (((spec.getPurposes() & KeyProperties.PURPOSE_ENCRYPT) != 0)
291                        && (spec.isRandomizedEncryptionRequired())) {
292                    for (int keymasterPadding : mKeymasterEncryptionPaddings) {
293                        if (!KeymasterUtils
294                                .isKeymasterPaddingSchemeIndCpaCompatibleWithAsymmetricCrypto(
295                                        keymasterPadding)) {
296                            throw new InvalidAlgorithmParameterException(
297                                    "Randomized encryption (IND-CPA) required but may be violated"
298                                    + " by padding scheme: "
299                                    + KeyProperties.EncryptionPadding.fromKeymaster(
300                                            keymasterPadding)
301                                    + ". See " + KeyGenParameterSpec.class.getName()
302                                    + " documentation.");
303                        }
304                    }
305                }
306                mKeymasterSignaturePaddings = KeyProperties.SignaturePadding.allToKeymaster(
307                        spec.getSignaturePaddings());
308                if (spec.isDigestsSpecified()) {
309                    mKeymasterDigests = KeyProperties.Digest.allToKeymaster(spec.getDigests());
310                } else {
311                    mKeymasterDigests = EmptyArray.INT;
312                }
313            } catch (IllegalArgumentException e) {
314                throw new InvalidAlgorithmParameterException(e);
315            }
316
317            mJcaKeyAlgorithm = jcaKeyAlgorithm;
318            mRng = random;
319            mKeyStore = KeyStore.getInstance();
320            success = true;
321        } finally {
322            if (!success) {
323                resetAll();
324            }
325        }
326    }
327
328    private void resetAll() {
329        mEntryAlias = null;
330        mJcaKeyAlgorithm = null;
331        mKeymasterAlgorithm = -1;
332        mKeymasterPurposes = null;
333        mKeymasterBlockModes = null;
334        mKeymasterEncryptionPaddings = null;
335        mKeymasterSignaturePaddings = null;
336        mKeymasterDigests = null;
337        mKeySizeBits = 0;
338        mSpec = null;
339        mRSAPublicExponent = null;
340        mEncryptionAtRestRequired = false;
341        mRng = null;
342        mKeyStore = null;
343    }
344
345    private void initAlgorithmSpecificParameters() throws InvalidAlgorithmParameterException {
346        AlgorithmParameterSpec algSpecificSpec = mSpec.getAlgorithmParameterSpec();
347        switch (mKeymasterAlgorithm) {
348            case KeymasterDefs.KM_ALGORITHM_RSA:
349            {
350                BigInteger publicExponent = null;
351                if (algSpecificSpec instanceof RSAKeyGenParameterSpec) {
352                    RSAKeyGenParameterSpec rsaSpec = (RSAKeyGenParameterSpec) algSpecificSpec;
353                    if (mKeySizeBits == -1) {
354                        mKeySizeBits = rsaSpec.getKeysize();
355                    } else if (mKeySizeBits != rsaSpec.getKeysize()) {
356                        throw new InvalidAlgorithmParameterException("RSA key size must match "
357                                + " between " + mSpec + " and " + algSpecificSpec
358                                + ": " + mKeySizeBits + " vs " + rsaSpec.getKeysize());
359                    }
360                    publicExponent = rsaSpec.getPublicExponent();
361                } else if (algSpecificSpec != null) {
362                    throw new InvalidAlgorithmParameterException(
363                        "RSA may only use RSAKeyGenParameterSpec");
364                }
365                if (publicExponent == null) {
366                    publicExponent = RSAKeyGenParameterSpec.F4;
367                }
368                if (publicExponent.compareTo(BigInteger.ZERO) < 1) {
369                    throw new InvalidAlgorithmParameterException(
370                            "RSA public exponent must be positive: " + publicExponent);
371                }
372                if (publicExponent.compareTo(KeymasterArguments.UINT64_MAX_VALUE) > 0) {
373                    throw new InvalidAlgorithmParameterException(
374                            "Unsupported RSA public exponent: " + publicExponent
375                            + ". Maximum supported value: " + KeymasterArguments.UINT64_MAX_VALUE);
376                }
377                mRSAPublicExponent = publicExponent;
378                break;
379            }
380            case KeymasterDefs.KM_ALGORITHM_EC:
381                if (algSpecificSpec instanceof ECGenParameterSpec) {
382                    ECGenParameterSpec ecSpec = (ECGenParameterSpec) algSpecificSpec;
383                    String curveName = ecSpec.getName();
384                    Integer ecSpecKeySizeBits = SUPPORTED_EC_NIST_CURVE_NAME_TO_SIZE.get(
385                            curveName.toLowerCase(Locale.US));
386                    if (ecSpecKeySizeBits == null) {
387                        throw new InvalidAlgorithmParameterException(
388                                "Unsupported EC curve name: " + curveName
389                                + ". Supported: " + SUPPORTED_EC_NIST_CURVE_NAMES);
390                    }
391                    if (mKeySizeBits == -1) {
392                        mKeySizeBits = ecSpecKeySizeBits;
393                    } else if (mKeySizeBits != ecSpecKeySizeBits) {
394                        throw new InvalidAlgorithmParameterException("EC key size must match "
395                                + " between " + mSpec + " and " + algSpecificSpec
396                                + ": " + mKeySizeBits + " vs " + ecSpecKeySizeBits);
397                    }
398                } else if (algSpecificSpec != null) {
399                    throw new InvalidAlgorithmParameterException(
400                        "EC may only use ECGenParameterSpec");
401                }
402                break;
403            default:
404                throw new ProviderException("Unsupported algorithm: " + mKeymasterAlgorithm);
405        }
406    }
407
408    @Override
409    public KeyPair generateKeyPair() {
410        if (mKeyStore == null || mSpec == null) {
411            throw new IllegalStateException("Not initialized");
412        }
413
414        final int flags = (mEncryptionAtRestRequired) ? KeyStore.FLAG_ENCRYPTED : 0;
415        if (((flags & KeyStore.FLAG_ENCRYPTED) != 0)
416                && (mKeyStore.state() != KeyStore.State.UNLOCKED)) {
417            throw new IllegalStateException(
418                    "Encryption at rest using secure lock screen credential requested for key pair"
419                    + ", but the user has not yet entered the credential");
420        }
421
422        KeymasterArguments args = new KeymasterArguments();
423        args.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, mKeySizeBits);
424        args.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, mKeymasterAlgorithm);
425        args.addEnums(KeymasterDefs.KM_TAG_PURPOSE, mKeymasterPurposes);
426        args.addEnums(KeymasterDefs.KM_TAG_BLOCK_MODE, mKeymasterBlockModes);
427        args.addEnums(KeymasterDefs.KM_TAG_PADDING, mKeymasterEncryptionPaddings);
428        args.addEnums(KeymasterDefs.KM_TAG_PADDING, mKeymasterSignaturePaddings);
429        args.addEnums(KeymasterDefs.KM_TAG_DIGEST, mKeymasterDigests);
430
431        KeymasterUtils.addUserAuthArgs(args,
432                mSpec.isUserAuthenticationRequired(),
433                mSpec.getUserAuthenticationValidityDurationSeconds());
434        args.addDateIfNotNull(KeymasterDefs.KM_TAG_ACTIVE_DATETIME, mSpec.getKeyValidityStart());
435        args.addDateIfNotNull(KeymasterDefs.KM_TAG_ORIGINATION_EXPIRE_DATETIME,
436                mSpec.getKeyValidityForOriginationEnd());
437        args.addDateIfNotNull(KeymasterDefs.KM_TAG_USAGE_EXPIRE_DATETIME,
438                mSpec.getKeyValidityForConsumptionEnd());
439        addAlgorithmSpecificParameters(args);
440
441        byte[] additionalEntropy =
442                KeyStoreCryptoOperationUtils.getRandomBytesToMixIntoKeystoreRng(
443                        mRng, (mKeySizeBits + 7) / 8);
444
445        final String privateKeyAlias = Credentials.USER_PRIVATE_KEY + mEntryAlias;
446        boolean success = false;
447        try {
448            Credentials.deleteAllTypesForAlias(mKeyStore, mEntryAlias);
449            KeyCharacteristics resultingKeyCharacteristics = new KeyCharacteristics();
450            int errorCode = mKeyStore.generateKey(
451                    privateKeyAlias,
452                    args,
453                    additionalEntropy,
454                    flags,
455                    resultingKeyCharacteristics);
456            if (errorCode != KeyStore.NO_ERROR) {
457                throw new ProviderException(
458                        "Failed to generate key pair", KeyStore.getKeyStoreException(errorCode));
459            }
460
461            KeyPair result;
462            try {
463                result = AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(
464                        mKeyStore, privateKeyAlias);
465            } catch (UnrecoverableKeyException e) {
466                throw new ProviderException("Failed to load generated key pair from keystore", e);
467            }
468
469            if (!mJcaKeyAlgorithm.equalsIgnoreCase(result.getPrivate().getAlgorithm())) {
470                throw new ProviderException(
471                        "Generated key pair algorithm does not match requested algorithm: "
472                        + result.getPrivate().getAlgorithm() + " vs " + mJcaKeyAlgorithm);
473            }
474
475            final X509Certificate cert;
476            try {
477                cert = generateSelfSignedCertificate(result.getPrivate(), result.getPublic());
478            } catch (Exception e) {
479                throw new ProviderException("Failed to generate self-signed certificate", e);
480            }
481
482            byte[] certBytes;
483            try {
484                certBytes = cert.getEncoded();
485            } catch (CertificateEncodingException e) {
486                throw new ProviderException(
487                        "Failed to obtain encoded form of self-signed certificate", e);
488            }
489
490            int insertErrorCode = mKeyStore.insert(
491                    Credentials.USER_CERTIFICATE + mEntryAlias,
492                    certBytes,
493                    KeyStore.UID_SELF,
494                    flags);
495            if (insertErrorCode != KeyStore.NO_ERROR) {
496                throw new ProviderException("Failed to store self-signed certificate",
497                        KeyStore.getKeyStoreException(insertErrorCode));
498            }
499
500            success = true;
501            return result;
502        } finally {
503            if (!success) {
504                Credentials.deleteAllTypesForAlias(mKeyStore, mEntryAlias);
505            }
506        }
507    }
508
509    private void addAlgorithmSpecificParameters(KeymasterArguments keymasterArgs) {
510        switch (mKeymasterAlgorithm) {
511            case KeymasterDefs.KM_ALGORITHM_RSA:
512                keymasterArgs.addUnsignedLong(
513                        KeymasterDefs.KM_TAG_RSA_PUBLIC_EXPONENT, mRSAPublicExponent);
514                break;
515            case KeymasterDefs.KM_ALGORITHM_EC:
516                break;
517            default:
518                throw new ProviderException("Unsupported algorithm: " + mKeymasterAlgorithm);
519        }
520    }
521
522    private X509Certificate generateSelfSignedCertificate(
523            PrivateKey privateKey, PublicKey publicKey) throws Exception {
524        String signatureAlgorithm =
525                getCertificateSignatureAlgorithm(mKeymasterAlgorithm, mKeySizeBits, mSpec);
526        if (signatureAlgorithm == null) {
527            // Key cannot be used to sign a certificate
528            return generateSelfSignedCertificateWithFakeSignature(publicKey);
529        } else {
530            // Key can be used to sign a certificate
531            try {
532                return generateSelfSignedCertificateWithValidSignature(
533                        privateKey, publicKey, signatureAlgorithm);
534            } catch (Exception e) {
535                // Failed to generate the self-signed certificate with valid signature. Fall back
536                // to generating a self-signed certificate with a fake signature. This is done for
537                // all exception types because we prefer key pair generation to succeed and end up
538                // producing a self-signed certificate with an invalid signature to key pair
539                // generation failing.
540                return generateSelfSignedCertificateWithFakeSignature(publicKey);
541            }
542        }
543    }
544
545    @SuppressWarnings("deprecation")
546    private X509Certificate generateSelfSignedCertificateWithValidSignature(
547            PrivateKey privateKey, PublicKey publicKey, String signatureAlgorithm) throws Exception {
548        final X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
549        certGen.setPublicKey(publicKey);
550        certGen.setSerialNumber(mSpec.getCertificateSerialNumber());
551        certGen.setSubjectDN(mSpec.getCertificateSubject());
552        certGen.setIssuerDN(mSpec.getCertificateSubject());
553        certGen.setNotBefore(mSpec.getCertificateNotBefore());
554        certGen.setNotAfter(mSpec.getCertificateNotAfter());
555        certGen.setSignatureAlgorithm(signatureAlgorithm);
556        return certGen.generate(privateKey);
557    }
558
559    @SuppressWarnings("deprecation")
560    private X509Certificate generateSelfSignedCertificateWithFakeSignature(
561            PublicKey publicKey) throws Exception {
562        V3TBSCertificateGenerator tbsGenerator = new V3TBSCertificateGenerator();
563        ASN1ObjectIdentifier sigAlgOid;
564        AlgorithmIdentifier sigAlgId;
565        byte[] signature;
566        switch (mKeymasterAlgorithm) {
567            case KeymasterDefs.KM_ALGORITHM_EC:
568                sigAlgOid = X9ObjectIdentifiers.ecdsa_with_SHA256;
569                sigAlgId = new AlgorithmIdentifier(sigAlgOid);
570                ASN1EncodableVector v = new ASN1EncodableVector();
571                v.add(new DERInteger(0));
572                v.add(new DERInteger(0));
573                signature = new DERSequence().getEncoded();
574                break;
575            case KeymasterDefs.KM_ALGORITHM_RSA:
576                sigAlgOid = PKCSObjectIdentifiers.sha256WithRSAEncryption;
577                sigAlgId = new AlgorithmIdentifier(sigAlgOid, DERNull.INSTANCE);
578                signature = new byte[1];
579                break;
580            default:
581                throw new ProviderException("Unsupported key algorithm: " + mKeymasterAlgorithm);
582        }
583
584        try (ASN1InputStream publicKeyInfoIn = new ASN1InputStream(publicKey.getEncoded())) {
585            tbsGenerator.setSubjectPublicKeyInfo(
586                    SubjectPublicKeyInfo.getInstance(publicKeyInfoIn.readObject()));
587        }
588        tbsGenerator.setSerialNumber(new ASN1Integer(mSpec.getCertificateSerialNumber()));
589        X509Principal subject =
590                new X509Principal(mSpec.getCertificateSubject().getEncoded());
591        tbsGenerator.setSubject(subject);
592        tbsGenerator.setIssuer(subject);
593        tbsGenerator.setStartDate(new Time(mSpec.getCertificateNotBefore()));
594        tbsGenerator.setEndDate(new Time(mSpec.getCertificateNotAfter()));
595        tbsGenerator.setSignature(sigAlgId);
596        TBSCertificate tbsCertificate = tbsGenerator.generateTBSCertificate();
597
598        ASN1EncodableVector result = new ASN1EncodableVector();
599        result.add(tbsCertificate);
600        result.add(sigAlgId);
601        result.add(new DERBitString(signature));
602        return new X509CertificateObject(Certificate.getInstance(new DERSequence(result)));
603    }
604
605    private static int getDefaultKeySize(int keymasterAlgorithm) {
606        switch (keymasterAlgorithm) {
607            case KeymasterDefs.KM_ALGORITHM_EC:
608                return EC_DEFAULT_KEY_SIZE;
609            case KeymasterDefs.KM_ALGORITHM_RSA:
610                return RSA_DEFAULT_KEY_SIZE;
611            default:
612                throw new ProviderException("Unsupported algorithm: " + keymasterAlgorithm);
613        }
614    }
615
616    private static void checkValidKeySize(int keymasterAlgorithm, int keySize)
617            throws InvalidAlgorithmParameterException {
618        switch (keymasterAlgorithm) {
619            case KeymasterDefs.KM_ALGORITHM_EC:
620                if (!SUPPORTED_EC_NIST_CURVE_SIZES.contains(keySize)) {
621                    throw new InvalidAlgorithmParameterException("Unsupported EC key size: "
622                            + keySize + " bits. Supported: " + SUPPORTED_EC_NIST_CURVE_SIZES);
623                }
624                break;
625            case KeymasterDefs.KM_ALGORITHM_RSA:
626                if (keySize < RSA_MIN_KEY_SIZE || keySize > RSA_MAX_KEY_SIZE) {
627                    throw new InvalidAlgorithmParameterException("RSA key size must be >= "
628                            + RSA_MIN_KEY_SIZE + " and <= " + RSA_MAX_KEY_SIZE);
629                }
630                break;
631            default:
632                throw new ProviderException("Unsupported algorithm: " + keymasterAlgorithm);
633        }
634    }
635
636    /**
637     * Returns the {@code Signature} algorithm to be used for signing a certificate using the
638     * specified key or {@code null} if the key cannot be used for signing a certificate.
639     */
640    @Nullable
641    private static String getCertificateSignatureAlgorithm(
642            int keymasterAlgorithm,
643            int keySizeBits,
644            KeyGenParameterSpec spec) {
645        // Constraints:
646        // 1. Key must be authorized for signing without user authentication.
647        // 2. Signature digest must be one of key's authorized digests.
648        // 3. For RSA keys, the digest output size must not exceed modulus size minus space overhead
649        //    of RSA PKCS#1 signature padding scheme (about 30 bytes).
650        // 4. For EC keys, the there is no point in using a digest whose output size is longer than
651        //    key/field size because the digest will be truncated to that size.
652
653        if ((spec.getPurposes() & KeyProperties.PURPOSE_SIGN) == 0) {
654            // Key not authorized for signing
655            return null;
656        }
657        if (spec.isUserAuthenticationRequired()) {
658            // Key not authorized for use without user authentication
659            return null;
660        }
661        if (!spec.isDigestsSpecified()) {
662            // Key not authorized for any digests -- can't sign
663            return null;
664        }
665        switch (keymasterAlgorithm) {
666            case KeymasterDefs.KM_ALGORITHM_EC:
667            {
668                Set<Integer> availableKeymasterDigests = getAvailableKeymasterSignatureDigests(
669                        spec.getDigests(),
670                        AndroidKeyStoreBCWorkaroundProvider.getSupportedEcdsaSignatureDigests());
671
672                int bestKeymasterDigest = -1;
673                int bestDigestOutputSizeBits = -1;
674                for (int keymasterDigest : availableKeymasterDigests) {
675                    int outputSizeBits = KeymasterUtils.getDigestOutputSizeBits(keymasterDigest);
676                    if (outputSizeBits == keySizeBits) {
677                        // Perfect match -- use this digest
678                        bestKeymasterDigest = keymasterDigest;
679                        bestDigestOutputSizeBits = outputSizeBits;
680                        break;
681                    }
682                    // Not a perfect match -- check against the best digest so far
683                    if (bestKeymasterDigest == -1) {
684                        // First digest tested -- definitely the best so far
685                        bestKeymasterDigest = keymasterDigest;
686                        bestDigestOutputSizeBits = outputSizeBits;
687                    } else {
688                        // Prefer output size to be as close to key size as possible, with output
689                        // sizes larger than key size preferred to those smaller than key size.
690                        if (bestDigestOutputSizeBits < keySizeBits) {
691                            // Output size of the best digest so far is smaller than key size.
692                            // Anything larger is a win.
693                            if (outputSizeBits > bestDigestOutputSizeBits) {
694                                bestKeymasterDigest = keymasterDigest;
695                                bestDigestOutputSizeBits = outputSizeBits;
696                            }
697                        } else {
698                            // Output size of the best digest so far is larger than key size.
699                            // Anything smaller is a win, as long as it's not smaller than key size.
700                            if ((outputSizeBits < bestDigestOutputSizeBits)
701                                    && (outputSizeBits >= keySizeBits)) {
702                                bestKeymasterDigest = keymasterDigest;
703                                bestDigestOutputSizeBits = outputSizeBits;
704                            }
705                        }
706                    }
707                }
708                if (bestKeymasterDigest == -1) {
709                    return null;
710                }
711                return KeyProperties.Digest.fromKeymasterToSignatureAlgorithmDigest(
712                        bestKeymasterDigest) + "WithECDSA";
713            }
714            case KeymasterDefs.KM_ALGORITHM_RSA:
715            {
716                // Check whether this key is authorized for PKCS#1 signature padding.
717                // We use Bouncy Castle to generate self-signed RSA certificates. Bouncy Castle
718                // only supports RSA certificates signed using PKCS#1 padding scheme. The key needs
719                // to be authorized for PKCS#1 padding or padding NONE which means any padding.
720                boolean pkcs1SignaturePaddingSupported = false;
721                for (int keymasterPadding : KeyProperties.SignaturePadding.allToKeymaster(
722                        spec.getSignaturePaddings())) {
723                    if ((keymasterPadding == KeymasterDefs.KM_PAD_RSA_PKCS1_1_5_SIGN)
724                            || (keymasterPadding == KeymasterDefs.KM_PAD_NONE)) {
725                        pkcs1SignaturePaddingSupported = true;
726                        break;
727                    }
728                }
729                if (!pkcs1SignaturePaddingSupported) {
730                    // Keymaster doesn't distinguish between encryption padding NONE and signature
731                    // padding NONE. In the Android Keystore API only encryption padding NONE is
732                    // exposed.
733                    for (int keymasterPadding : KeyProperties.EncryptionPadding.allToKeymaster(
734                            spec.getEncryptionPaddings())) {
735                        if (keymasterPadding == KeymasterDefs.KM_PAD_NONE) {
736                            pkcs1SignaturePaddingSupported = true;
737                            break;
738                        }
739                    }
740                }
741                if (!pkcs1SignaturePaddingSupported) {
742                    // Key not authorized for PKCS#1 signature padding -- can't sign
743                    return null;
744                }
745
746                Set<Integer> availableKeymasterDigests = getAvailableKeymasterSignatureDigests(
747                        spec.getDigests(),
748                        AndroidKeyStoreBCWorkaroundProvider.getSupportedEcdsaSignatureDigests());
749
750                // The amount of space available for the digest is less than modulus size by about
751                // 30 bytes because padding must be at least 11 bytes long (00 || 01 || PS || 00,
752                // where PS must be at least 8 bytes long), and then there's also the 15--19 bytes
753                // overhead (depending the on chosen digest) for encoding digest OID and digest
754                // value in DER.
755                int maxDigestOutputSizeBits = keySizeBits - 30 * 8;
756                int bestKeymasterDigest = -1;
757                int bestDigestOutputSizeBits = -1;
758                for (int keymasterDigest : availableKeymasterDigests) {
759                    int outputSizeBits = KeymasterUtils.getDigestOutputSizeBits(keymasterDigest);
760                    if (outputSizeBits > maxDigestOutputSizeBits) {
761                        // Digest too long (signature generation will fail) -- skip
762                        continue;
763                    }
764                    if (bestKeymasterDigest == -1) {
765                        // First digest tested -- definitely the best so far
766                        bestKeymasterDigest = keymasterDigest;
767                        bestDigestOutputSizeBits = outputSizeBits;
768                    } else {
769                        // The longer the better
770                        if (outputSizeBits > bestDigestOutputSizeBits) {
771                            bestKeymasterDigest = keymasterDigest;
772                            bestDigestOutputSizeBits = outputSizeBits;
773                        }
774                    }
775                }
776                if (bestKeymasterDigest == -1) {
777                    return null;
778                }
779                return KeyProperties.Digest.fromKeymasterToSignatureAlgorithmDigest(
780                        bestKeymasterDigest) + "WithRSA";
781            }
782            default:
783                throw new ProviderException("Unsupported algorithm: " + keymasterAlgorithm);
784        }
785    }
786
787    private static Set<Integer> getAvailableKeymasterSignatureDigests(
788            @KeyProperties.DigestEnum String[] authorizedKeyDigests,
789            @KeyProperties.DigestEnum String[] supportedSignatureDigests) {
790        Set<Integer> authorizedKeymasterKeyDigests = new HashSet<Integer>();
791        for (int keymasterDigest : KeyProperties.Digest.allToKeymaster(authorizedKeyDigests)) {
792            authorizedKeymasterKeyDigests.add(keymasterDigest);
793        }
794        Set<Integer> supportedKeymasterSignatureDigests = new HashSet<Integer>();
795        for (int keymasterDigest
796                : KeyProperties.Digest.allToKeymaster(supportedSignatureDigests)) {
797            supportedKeymasterSignatureDigests.add(keymasterDigest);
798        }
799        if (authorizedKeymasterKeyDigests.contains(KeymasterDefs.KM_DIGEST_NONE)) {
800            // Key is authorized to be used with any digest
801            return supportedKeymasterSignatureDigests;
802        } else {
803            // Key is authorized to be used only with specific digests.
804            Set<Integer> result = new HashSet<Integer>(supportedKeymasterSignatureDigests);
805            result.retainAll(authorizedKeymasterKeyDigests);
806            return result;
807        }
808    }
809}
810