1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#include <errno.h>
17#include <string.h>
18#include <stdint.h>
19
20#include <keystore/keystore.h>
21#include <keymaster/softkeymaster.h>
22
23#include <hardware/hardware.h>
24#include <hardware/keymaster0.h>
25
26#include <openssl/evp.h>
27#include <openssl/bio.h>
28#include <openssl/rsa.h>
29#include <openssl/err.h>
30#include <openssl/x509.h>
31
32#include <UniquePtr.h>
33
34// For debugging
35// #define LOG_NDEBUG 0
36
37#define LOG_TAG "OpenSSLKeyMaster"
38#include <cutils/log.h>
39
40struct BIGNUM_Delete {
41    void operator()(BIGNUM* p) const { BN_free(p); }
42};
43typedef UniquePtr<BIGNUM, BIGNUM_Delete> Unique_BIGNUM;
44
45struct EVP_PKEY_Delete {
46    void operator()(EVP_PKEY* p) const { EVP_PKEY_free(p); }
47};
48typedef UniquePtr<EVP_PKEY, EVP_PKEY_Delete> Unique_EVP_PKEY;
49
50struct PKCS8_PRIV_KEY_INFO_Delete {
51    void operator()(PKCS8_PRIV_KEY_INFO* p) const { PKCS8_PRIV_KEY_INFO_free(p); }
52};
53typedef UniquePtr<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_Delete> Unique_PKCS8_PRIV_KEY_INFO;
54
55struct DSA_Delete {
56    void operator()(DSA* p) const { DSA_free(p); }
57};
58typedef UniquePtr<DSA, DSA_Delete> Unique_DSA;
59
60struct EC_KEY_Delete {
61    void operator()(EC_KEY* p) const { EC_KEY_free(p); }
62};
63typedef UniquePtr<EC_KEY, EC_KEY_Delete> Unique_EC_KEY;
64
65struct EC_GROUP_Delete {
66    void operator()(EC_GROUP* p) const { EC_GROUP_free(p); }
67};
68typedef UniquePtr<EC_GROUP, EC_GROUP_Delete> Unique_EC_GROUP;
69
70struct RSA_Delete {
71    void operator()(RSA* p) const { RSA_free(p); }
72};
73typedef UniquePtr<RSA, RSA_Delete> Unique_RSA;
74
75struct Malloc_Free {
76    void operator()(void* p) const { free(p); }
77};
78
79typedef UniquePtr<keymaster0_device_t> Unique_keymaster_device_t;
80
81/**
82 * Many OpenSSL APIs take ownership of an argument on success but
83 * don't free the argument on failure. This means we need to tell our
84 * scoped pointers when we've transferred ownership, without
85 * triggering a warning by not using the result of release().
86 */
87template <typename T, typename Delete_T>
88inline void release_because_ownership_transferred(UniquePtr<T, Delete_T>& p) {
89    T* val __attribute__((unused)) = p.release();
90}
91
92/*
93 * Checks this thread's OpenSSL error queue and logs if
94 * necessary.
95 */
96static void logOpenSSLError(const char* location) {
97    int error = ERR_get_error();
98
99    if (error != 0) {
100        char message[256];
101        ERR_error_string_n(error, message, sizeof(message));
102        ALOGE("OpenSSL error in %s %d: %s", location, error, message);
103    }
104
105    ERR_clear_error();
106    ERR_remove_thread_state(NULL);
107}
108
109static int wrap_key(EVP_PKEY* pkey, int type, uint8_t** keyBlob, size_t* keyBlobLength) {
110    /*
111     * Find the length of each size. Public key is not needed anymore
112     * but must be kept for alignment purposes.
113     */
114    int publicLen = 0;
115    int privateLen = i2d_PrivateKey(pkey, NULL);
116
117    if (privateLen <= 0) {
118        ALOGE("private key size was too big");
119        return -1;
120    }
121
122    /* int type + int size + private key data + int size + public key data */
123    *keyBlobLength = get_softkey_header_size() + sizeof(type) + sizeof(publicLen) + privateLen +
124                     sizeof(privateLen) + publicLen;
125
126    // derData will be returned to the caller, so allocate it with malloc.
127    UniquePtr<unsigned char, Malloc_Free> derData(
128        static_cast<unsigned char*>(malloc(*keyBlobLength)));
129    if (derData.get() == NULL) {
130        ALOGE("could not allocate memory for key blob");
131        return -1;
132    }
133    unsigned char* p = derData.get();
134
135    /* Write the magic value for software keys. */
136    p = add_softkey_header(p, *keyBlobLength);
137
138    /* Write key type to allocated buffer */
139    for (int i = sizeof(type) - 1; i >= 0; i--) {
140        *p++ = (type >> (8 * i)) & 0xFF;
141    }
142
143    /* Write public key to allocated buffer */
144    for (int i = sizeof(publicLen) - 1; i >= 0; i--) {
145        *p++ = (publicLen >> (8 * i)) & 0xFF;
146    }
147
148    /* Write private key to allocated buffer */
149    for (int i = sizeof(privateLen) - 1; i >= 0; i--) {
150        *p++ = (privateLen >> (8 * i)) & 0xFF;
151    }
152    if (i2d_PrivateKey(pkey, &p) != privateLen) {
153        logOpenSSLError("wrap_key");
154        return -1;
155    }
156
157    *keyBlob = derData.release();
158
159    return 0;
160}
161
162static EVP_PKEY* unwrap_key(const uint8_t* keyBlob, const size_t keyBlobLength) {
163    long publicLen = 0;
164    long privateLen = 0;
165    const uint8_t* p = keyBlob;
166    const uint8_t* const end = keyBlob + keyBlobLength;
167
168    if (keyBlob == NULL) {
169        ALOGE("supplied key blob was NULL");
170        return NULL;
171    }
172
173    int type = 0;
174    if (keyBlobLength < (get_softkey_header_size() + sizeof(type) + sizeof(publicLen) + 1 +
175                         sizeof(privateLen) + 1)) {
176        ALOGE("key blob appears to be truncated");
177        return NULL;
178    }
179
180    if (!is_softkey(p, keyBlobLength)) {
181        ALOGE("cannot read key; it was not made by this keymaster");
182        return NULL;
183    }
184    p += get_softkey_header_size();
185
186    for (size_t i = 0; i < sizeof(type); i++) {
187        type = (type << 8) | *p++;
188    }
189
190    for (size_t i = 0; i < sizeof(type); i++) {
191        publicLen = (publicLen << 8) | *p++;
192    }
193    if (p + publicLen > end) {
194        ALOGE("public key length encoding error: size=%ld, end=%td", publicLen, end - p);
195        return NULL;
196    }
197
198    p += publicLen;
199    if (end - p < 2) {
200        ALOGE("private key truncated");
201        return NULL;
202    }
203    for (size_t i = 0; i < sizeof(type); i++) {
204        privateLen = (privateLen << 8) | *p++;
205    }
206    if (p + privateLen > end) {
207        ALOGE("private key length encoding error: size=%ld, end=%td", privateLen, end - p);
208        return NULL;
209    }
210
211    Unique_EVP_PKEY pkey(EVP_PKEY_new());
212    if (pkey.get() == NULL) {
213        logOpenSSLError("unwrap_key");
214        return NULL;
215    }
216    EVP_PKEY* tmp = pkey.get();
217
218    if (d2i_PrivateKey(type, &tmp, &p, privateLen) == NULL) {
219        logOpenSSLError("unwrap_key");
220        return NULL;
221    }
222
223    return pkey.release();
224}
225
226static int generate_dsa_keypair(EVP_PKEY* pkey, const keymaster_dsa_keygen_params_t* dsa_params) {
227    if (dsa_params->key_size < 512) {
228        ALOGI("Requested DSA key size is too small (<512)");
229        return -1;
230    }
231
232    Unique_DSA dsa(DSA_new());
233
234    if (dsa_params->generator_len == 0 || dsa_params->prime_p_len == 0 ||
235        dsa_params->prime_q_len == 0 || dsa_params->generator == NULL ||
236        dsa_params->prime_p == NULL || dsa_params->prime_q == NULL) {
237        if (DSA_generate_parameters_ex(dsa.get(), dsa_params->key_size, NULL, 0, NULL, NULL,
238                                       NULL) != 1) {
239            logOpenSSLError("generate_dsa_keypair");
240            return -1;
241        }
242    } else {
243        dsa->g = BN_bin2bn(dsa_params->generator, dsa_params->generator_len, NULL);
244        if (dsa->g == NULL) {
245            logOpenSSLError("generate_dsa_keypair");
246            return -1;
247        }
248
249        dsa->p = BN_bin2bn(dsa_params->prime_p, dsa_params->prime_p_len, NULL);
250        if (dsa->p == NULL) {
251            logOpenSSLError("generate_dsa_keypair");
252            return -1;
253        }
254
255        dsa->q = BN_bin2bn(dsa_params->prime_q, dsa_params->prime_q_len, NULL);
256        if (dsa->q == NULL) {
257            logOpenSSLError("generate_dsa_keypair");
258            return -1;
259        }
260    }
261
262    if (DSA_generate_key(dsa.get()) != 1) {
263        logOpenSSLError("generate_dsa_keypair");
264        return -1;
265    }
266
267    if (EVP_PKEY_assign_DSA(pkey, dsa.get()) == 0) {
268        logOpenSSLError("generate_dsa_keypair");
269        return -1;
270    }
271    release_because_ownership_transferred(dsa);
272
273    return 0;
274}
275
276static int generate_ec_keypair(EVP_PKEY* pkey, const keymaster_ec_keygen_params_t* ec_params) {
277    Unique_EC_GROUP group;
278    switch (ec_params->field_size) {
279    case 224:
280        group.reset(EC_GROUP_new_by_curve_name(NID_secp224r1));
281        break;
282    case 256:
283        group.reset(EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
284        break;
285    case 384:
286        group.reset(EC_GROUP_new_by_curve_name(NID_secp384r1));
287        break;
288    case 521:
289        group.reset(EC_GROUP_new_by_curve_name(NID_secp521r1));
290        break;
291    default:
292        break;
293    }
294
295    if (group.get() == NULL) {
296        logOpenSSLError("generate_ec_keypair");
297        return -1;
298    }
299
300#if !defined(OPENSSL_IS_BORINGSSL)
301    EC_GROUP_set_point_conversion_form(group.get(), POINT_CONVERSION_UNCOMPRESSED);
302    EC_GROUP_set_asn1_flag(group.get(), OPENSSL_EC_NAMED_CURVE);
303#endif
304
305    /* initialize EC key */
306    Unique_EC_KEY eckey(EC_KEY_new());
307    if (eckey.get() == NULL) {
308        logOpenSSLError("generate_ec_keypair");
309        return -1;
310    }
311
312    if (EC_KEY_set_group(eckey.get(), group.get()) != 1) {
313        logOpenSSLError("generate_ec_keypair");
314        return -1;
315    }
316
317    if (EC_KEY_generate_key(eckey.get()) != 1 || EC_KEY_check_key(eckey.get()) < 0) {
318        logOpenSSLError("generate_ec_keypair");
319        return -1;
320    }
321
322    if (EVP_PKEY_assign_EC_KEY(pkey, eckey.get()) == 0) {
323        logOpenSSLError("generate_ec_keypair");
324        return -1;
325    }
326    release_because_ownership_transferred(eckey);
327
328    return 0;
329}
330
331static int generate_rsa_keypair(EVP_PKEY* pkey, const keymaster_rsa_keygen_params_t* rsa_params) {
332    Unique_BIGNUM bn(BN_new());
333    if (bn.get() == NULL) {
334        logOpenSSLError("generate_rsa_keypair");
335        return -1;
336    }
337
338    if (BN_set_word(bn.get(), rsa_params->public_exponent) == 0) {
339        logOpenSSLError("generate_rsa_keypair");
340        return -1;
341    }
342
343    /* initialize RSA */
344    Unique_RSA rsa(RSA_new());
345    if (rsa.get() == NULL) {
346        logOpenSSLError("generate_rsa_keypair");
347        return -1;
348    }
349
350    if (!RSA_generate_key_ex(rsa.get(), rsa_params->modulus_size, bn.get(), NULL) ||
351        RSA_check_key(rsa.get()) < 0) {
352        logOpenSSLError("generate_rsa_keypair");
353        return -1;
354    }
355
356    if (EVP_PKEY_assign_RSA(pkey, rsa.get()) == 0) {
357        logOpenSSLError("generate_rsa_keypair");
358        return -1;
359    }
360    release_because_ownership_transferred(rsa);
361
362    return 0;
363}
364
365__attribute__((visibility("default"))) int openssl_generate_keypair(
366    const keymaster0_device_t*, const keymaster_keypair_t key_type, const void* key_params,
367    uint8_t** keyBlob, size_t* keyBlobLength) {
368    Unique_EVP_PKEY pkey(EVP_PKEY_new());
369    if (pkey.get() == NULL) {
370        logOpenSSLError("openssl_generate_keypair");
371        return -1;
372    }
373
374    if (key_params == NULL) {
375        ALOGW("key_params == null");
376        return -1;
377    } else if (key_type == TYPE_DSA) {
378        const keymaster_dsa_keygen_params_t* dsa_params =
379            (const keymaster_dsa_keygen_params_t*)key_params;
380        generate_dsa_keypair(pkey.get(), dsa_params);
381    } else if (key_type == TYPE_EC) {
382        const keymaster_ec_keygen_params_t* ec_params =
383            (const keymaster_ec_keygen_params_t*)key_params;
384        generate_ec_keypair(pkey.get(), ec_params);
385    } else if (key_type == TYPE_RSA) {
386        const keymaster_rsa_keygen_params_t* rsa_params =
387            (const keymaster_rsa_keygen_params_t*)key_params;
388        generate_rsa_keypair(pkey.get(), rsa_params);
389    } else {
390        ALOGW("Unsupported key type %d", key_type);
391        return -1;
392    }
393
394    if (wrap_key(pkey.get(), EVP_PKEY_type(pkey->type), keyBlob, keyBlobLength)) {
395        return -1;
396    }
397
398    return 0;
399}
400
401__attribute__((visibility("default"))) int openssl_import_keypair(const keymaster0_device_t*,
402                                                                  const uint8_t* key,
403                                                                  const size_t key_length,
404                                                                  uint8_t** key_blob,
405                                                                  size_t* key_blob_length) {
406    if (key == NULL) {
407        ALOGW("input key == NULL");
408        return -1;
409    } else if (key_blob == NULL || key_blob_length == NULL) {
410        ALOGW("output key blob or length == NULL");
411        return -1;
412    }
413
414    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(NULL, &key, key_length));
415    if (pkcs8.get() == NULL) {
416        logOpenSSLError("openssl_import_keypair");
417        return -1;
418    }
419
420    /* assign to EVP */
421    Unique_EVP_PKEY pkey(EVP_PKCS82PKEY(pkcs8.get()));
422    if (pkey.get() == NULL) {
423        logOpenSSLError("openssl_import_keypair");
424        return -1;
425    }
426
427    if (wrap_key(pkey.get(), EVP_PKEY_type(pkey->type), key_blob, key_blob_length)) {
428        return -1;
429    }
430
431    return 0;
432}
433
434__attribute__((visibility("default"))) int openssl_get_keypair_public(const keymaster0_device_t*,
435                                                                      const uint8_t* key_blob,
436                                                                      const size_t key_blob_length,
437                                                                      uint8_t** x509_data,
438                                                                      size_t* x509_data_length) {
439    if (x509_data == NULL || x509_data_length == NULL) {
440        ALOGW("output public key buffer == NULL");
441        return -1;
442    }
443
444    Unique_EVP_PKEY pkey(unwrap_key(key_blob, key_blob_length));
445    if (pkey.get() == NULL) {
446        return -1;
447    }
448
449    int len = i2d_PUBKEY(pkey.get(), NULL);
450    if (len <= 0) {
451        logOpenSSLError("openssl_get_keypair_public");
452        return -1;
453    }
454
455    UniquePtr<uint8_t, Malloc_Free> key(static_cast<uint8_t*>(malloc(len)));
456    if (key.get() == NULL) {
457        ALOGE("Could not allocate memory for public key data");
458        return -1;
459    }
460
461    unsigned char* tmp = reinterpret_cast<unsigned char*>(key.get());
462    if (i2d_PUBKEY(pkey.get(), &tmp) != len) {
463        logOpenSSLError("openssl_get_keypair_public");
464        return -1;
465    }
466
467    ALOGV("Length of x509 data is %d", len);
468    *x509_data_length = len;
469    *x509_data = key.release();
470
471    return 0;
472}
473
474static int sign_dsa(EVP_PKEY* pkey, keymaster_dsa_sign_params_t* sign_params, const uint8_t* data,
475                    const size_t dataLength, uint8_t** signedData, size_t* signedDataLength) {
476    if (sign_params->digest_type != DIGEST_NONE) {
477        ALOGW("Cannot handle digest type %d", sign_params->digest_type);
478        return -1;
479    }
480
481    Unique_DSA dsa(EVP_PKEY_get1_DSA(pkey));
482    if (dsa.get() == NULL) {
483        logOpenSSLError("openssl_sign_dsa");
484        return -1;
485    }
486
487    unsigned int dsaSize = DSA_size(dsa.get());
488    UniquePtr<uint8_t, Malloc_Free> signedDataPtr(reinterpret_cast<uint8_t*>(malloc(dsaSize)));
489    if (signedDataPtr.get() == NULL) {
490        logOpenSSLError("openssl_sign_dsa");
491        return -1;
492    }
493
494    unsigned char* tmp = reinterpret_cast<unsigned char*>(signedDataPtr.get());
495    if (DSA_sign(0, data, dataLength, tmp, &dsaSize, dsa.get()) <= 0) {
496        logOpenSSLError("openssl_sign_dsa");
497        return -1;
498    }
499
500    *signedDataLength = dsaSize;
501    *signedData = signedDataPtr.release();
502
503    return 0;
504}
505
506static int sign_ec(EVP_PKEY* pkey, keymaster_ec_sign_params_t* sign_params, const uint8_t* data,
507                   const size_t dataLength, uint8_t** signedData, size_t* signedDataLength) {
508    if (sign_params->digest_type != DIGEST_NONE) {
509        ALOGW("Cannot handle digest type %d", sign_params->digest_type);
510        return -1;
511    }
512
513    Unique_EC_KEY eckey(EVP_PKEY_get1_EC_KEY(pkey));
514    if (eckey.get() == NULL) {
515        logOpenSSLError("openssl_sign_ec");
516        return -1;
517    }
518
519    unsigned int ecdsaSize = ECDSA_size(eckey.get());
520    UniquePtr<uint8_t, Malloc_Free> signedDataPtr(reinterpret_cast<uint8_t*>(malloc(ecdsaSize)));
521    if (signedDataPtr.get() == NULL) {
522        logOpenSSLError("openssl_sign_ec");
523        return -1;
524    }
525
526    unsigned char* tmp = reinterpret_cast<unsigned char*>(signedDataPtr.get());
527    if (ECDSA_sign(0, data, dataLength, tmp, &ecdsaSize, eckey.get()) <= 0) {
528        logOpenSSLError("openssl_sign_ec");
529        return -1;
530    }
531
532    *signedDataLength = ecdsaSize;
533    *signedData = signedDataPtr.release();
534
535    return 0;
536}
537
538static int sign_rsa(EVP_PKEY* pkey, keymaster_rsa_sign_params_t* sign_params, const uint8_t* data,
539                    const size_t dataLength, uint8_t** signedData, size_t* signedDataLength) {
540    if (sign_params->digest_type != DIGEST_NONE) {
541        ALOGW("Cannot handle digest type %d", sign_params->digest_type);
542        return -1;
543    } else if (sign_params->padding_type != PADDING_NONE) {
544        ALOGW("Cannot handle padding type %d", sign_params->padding_type);
545        return -1;
546    }
547
548    Unique_RSA rsa(EVP_PKEY_get1_RSA(pkey));
549    if (rsa.get() == NULL) {
550        logOpenSSLError("openssl_sign_rsa");
551        return -1;
552    }
553
554    UniquePtr<uint8_t, Malloc_Free> signedDataPtr(reinterpret_cast<uint8_t*>(malloc(dataLength)));
555    if (signedDataPtr.get() == NULL) {
556        logOpenSSLError("openssl_sign_rsa");
557        return -1;
558    }
559
560    unsigned char* tmp = reinterpret_cast<unsigned char*>(signedDataPtr.get());
561    if (RSA_private_encrypt(dataLength, data, tmp, rsa.get(), RSA_NO_PADDING) <= 0) {
562        logOpenSSLError("openssl_sign_rsa");
563        return -1;
564    }
565
566    *signedDataLength = dataLength;
567    *signedData = signedDataPtr.release();
568
569    return 0;
570}
571
572__attribute__((visibility("default"))) int openssl_sign_data(
573    const keymaster0_device_t*, const void* params, const uint8_t* keyBlob,
574    const size_t keyBlobLength, const uint8_t* data, const size_t dataLength, uint8_t** signedData,
575    size_t* signedDataLength) {
576    if (data == NULL) {
577        ALOGW("input data to sign == NULL");
578        return -1;
579    } else if (signedData == NULL || signedDataLength == NULL) {
580        ALOGW("output signature buffer == NULL");
581        return -1;
582    }
583
584    Unique_EVP_PKEY pkey(unwrap_key(keyBlob, keyBlobLength));
585    if (pkey.get() == NULL) {
586        return -1;
587    }
588
589    int type = EVP_PKEY_type(pkey->type);
590    if (type == EVP_PKEY_DSA) {
591        const keymaster_dsa_sign_params_t* sign_params =
592            reinterpret_cast<const keymaster_dsa_sign_params_t*>(params);
593        return sign_dsa(pkey.get(), const_cast<keymaster_dsa_sign_params_t*>(sign_params), data,
594                        dataLength, signedData, signedDataLength);
595    } else if (type == EVP_PKEY_EC) {
596        const keymaster_ec_sign_params_t* sign_params =
597            reinterpret_cast<const keymaster_ec_sign_params_t*>(params);
598        return sign_ec(pkey.get(), const_cast<keymaster_ec_sign_params_t*>(sign_params), data,
599                       dataLength, signedData, signedDataLength);
600    } else if (type == EVP_PKEY_RSA) {
601        const keymaster_rsa_sign_params_t* sign_params =
602            reinterpret_cast<const keymaster_rsa_sign_params_t*>(params);
603        return sign_rsa(pkey.get(), const_cast<keymaster_rsa_sign_params_t*>(sign_params), data,
604                        dataLength, signedData, signedDataLength);
605    } else {
606        ALOGW("Unsupported key type");
607        return -1;
608    }
609}
610
611static int verify_dsa(EVP_PKEY* pkey, keymaster_dsa_sign_params_t* sign_params,
612                      const uint8_t* signedData, const size_t signedDataLength,
613                      const uint8_t* signature, const size_t signatureLength) {
614    if (sign_params->digest_type != DIGEST_NONE) {
615        ALOGW("Cannot handle digest type %d", sign_params->digest_type);
616        return -1;
617    }
618
619    Unique_DSA dsa(EVP_PKEY_get1_DSA(pkey));
620    if (dsa.get() == NULL) {
621        logOpenSSLError("openssl_verify_dsa");
622        return -1;
623    }
624
625    if (DSA_verify(0, signedData, signedDataLength, signature, signatureLength, dsa.get()) <= 0) {
626        logOpenSSLError("openssl_verify_dsa");
627        return -1;
628    }
629
630    return 0;
631}
632
633static int verify_ec(EVP_PKEY* pkey, keymaster_ec_sign_params_t* sign_params,
634                     const uint8_t* signedData, const size_t signedDataLength,
635                     const uint8_t* signature, const size_t signatureLength) {
636    if (sign_params->digest_type != DIGEST_NONE) {
637        ALOGW("Cannot handle digest type %d", sign_params->digest_type);
638        return -1;
639    }
640
641    Unique_EC_KEY eckey(EVP_PKEY_get1_EC_KEY(pkey));
642    if (eckey.get() == NULL) {
643        logOpenSSLError("openssl_verify_ec");
644        return -1;
645    }
646
647    if (ECDSA_verify(0, signedData, signedDataLength, signature, signatureLength, eckey.get()) <=
648        0) {
649        logOpenSSLError("openssl_verify_ec");
650        return -1;
651    }
652
653    return 0;
654}
655
656static int verify_rsa(EVP_PKEY* pkey, keymaster_rsa_sign_params_t* sign_params,
657                      const uint8_t* signedData, const size_t signedDataLength,
658                      const uint8_t* signature, const size_t signatureLength) {
659    if (sign_params->digest_type != DIGEST_NONE) {
660        ALOGW("Cannot handle digest type %d", sign_params->digest_type);
661        return -1;
662    } else if (sign_params->padding_type != PADDING_NONE) {
663        ALOGW("Cannot handle padding type %d", sign_params->padding_type);
664        return -1;
665    } else if (signatureLength != signedDataLength) {
666        ALOGW("signed data length must be signature length");
667        return -1;
668    }
669
670    Unique_RSA rsa(EVP_PKEY_get1_RSA(pkey));
671    if (rsa.get() == NULL) {
672        logOpenSSLError("openssl_verify_data");
673        return -1;
674    }
675
676    UniquePtr<uint8_t[]> dataPtr(new uint8_t[signedDataLength]);
677    if (dataPtr.get() == NULL) {
678        logOpenSSLError("openssl_verify_data");
679        return -1;
680    }
681
682    unsigned char* tmp = reinterpret_cast<unsigned char*>(dataPtr.get());
683    if (!RSA_public_decrypt(signatureLength, signature, tmp, rsa.get(), RSA_NO_PADDING)) {
684        logOpenSSLError("openssl_verify_data");
685        return -1;
686    }
687
688    int result = 0;
689    for (size_t i = 0; i < signedDataLength; i++) {
690        result |= tmp[i] ^ signedData[i];
691    }
692
693    return result == 0 ? 0 : -1;
694}
695
696__attribute__((visibility("default"))) int openssl_verify_data(
697    const keymaster0_device_t*, const void* params, const uint8_t* keyBlob,
698    const size_t keyBlobLength, const uint8_t* signedData, const size_t signedDataLength,
699    const uint8_t* signature, const size_t signatureLength) {
700    if (signedData == NULL || signature == NULL) {
701        ALOGW("data or signature buffers == NULL");
702        return -1;
703    }
704
705    Unique_EVP_PKEY pkey(unwrap_key(keyBlob, keyBlobLength));
706    if (pkey.get() == NULL) {
707        return -1;
708    }
709
710    int type = EVP_PKEY_type(pkey->type);
711    if (type == EVP_PKEY_DSA) {
712        const keymaster_dsa_sign_params_t* sign_params =
713            reinterpret_cast<const keymaster_dsa_sign_params_t*>(params);
714        return verify_dsa(pkey.get(), const_cast<keymaster_dsa_sign_params_t*>(sign_params),
715                          signedData, signedDataLength, signature, signatureLength);
716    } else if (type == EVP_PKEY_RSA) {
717        const keymaster_rsa_sign_params_t* sign_params =
718            reinterpret_cast<const keymaster_rsa_sign_params_t*>(params);
719        return verify_rsa(pkey.get(), const_cast<keymaster_rsa_sign_params_t*>(sign_params),
720                          signedData, signedDataLength, signature, signatureLength);
721    } else if (type == EVP_PKEY_EC) {
722        const keymaster_ec_sign_params_t* sign_params =
723            reinterpret_cast<const keymaster_ec_sign_params_t*>(params);
724        return verify_ec(pkey.get(), const_cast<keymaster_ec_sign_params_t*>(sign_params),
725                         signedData, signedDataLength, signature, signatureLength);
726    } else {
727        ALOGW("Unsupported key type %d", type);
728        return -1;
729    }
730}
731
732/* Close an opened OpenSSL instance */
733static int openssl_close(hw_device_t* dev) {
734    delete dev;
735    return 0;
736}
737
738/*
739 * Generic device handling
740 */
741__attribute__((visibility("default"))) int openssl_open(const hw_module_t* module, const char* name,
742                                                        hw_device_t** device) {
743    if (strcmp(name, KEYSTORE_KEYMASTER) != 0)
744        return -EINVAL;
745
746    Unique_keymaster_device_t dev(new keymaster0_device_t);
747    if (dev.get() == NULL)
748        return -ENOMEM;
749
750    dev->common.tag = HARDWARE_DEVICE_TAG;
751    dev->common.version = 1;
752    dev->common.module = (struct hw_module_t*)module;
753    dev->common.close = openssl_close;
754
755    dev->flags = KEYMASTER_SOFTWARE_ONLY | KEYMASTER_BLOBS_ARE_STANDALONE | KEYMASTER_SUPPORTS_DSA |
756                 KEYMASTER_SUPPORTS_EC;
757
758    dev->generate_keypair = openssl_generate_keypair;
759    dev->import_keypair = openssl_import_keypair;
760    dev->get_keypair_public = openssl_get_keypair_public;
761    dev->delete_keypair = NULL;
762    dev->delete_all = NULL;
763    dev->sign_data = openssl_sign_data;
764    dev->verify_data = openssl_verify_data;
765
766    ERR_load_crypto_strings();
767    ERR_load_BIO_strings();
768
769    *device = reinterpret_cast<hw_device_t*>(dev.release());
770
771    return 0;
772}
773
774static struct hw_module_methods_t keystore_module_methods = {
775    .open = openssl_open,
776};
777
778struct keystore_module softkeymaster_module __attribute__((visibility("default"))) = {
779    .common =
780        {
781         .tag = HARDWARE_MODULE_TAG,
782         .module_api_version = KEYMASTER_MODULE_API_VERSION_0_2,
783         .hal_api_version = HARDWARE_HAL_API_VERSION,
784         .id = KEYSTORE_HARDWARE_MODULE_ID,
785         .name = "Keymaster OpenSSL HAL",
786         .author = "The Android Open Source Project",
787         .methods = &keystore_module_methods,
788         .dso = 0,
789         .reserved = {},
790        },
791};
792