c38eae5229a820966008ae1885af90cd27c265e7 |
|
23-Feb-2016 |
Shawn Willden <swillden@google.com> |
Revert "Revert "Add option to allow key validity after fingerprint enrollment."" This reverts commit 512c132f49fc6e8e4fc119f4cf167d33b2393509. Change-Id: Iac381dfebcfe42f0468569eb2395ebeb97a95887
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
512c132f49fc6e8e4fc119f4cf167d33b2393509 |
|
22-Feb-2016 |
Shawn Willden <swillden@google.com> |
Revert "Add option to allow key validity after fingerprint enrollment." This reverts commit ada0fc1b05902b11401094b15480377d1b6c5a35. Change-Id: I934b6e6af49ab680af726c544f0193dfcb80054e
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
ada0fc1b05902b11401094b15480377d1b6c5a35 |
|
29-Jan-2016 |
Shawn Willden <swillden@google.com> |
Add option to allow key validity after fingerprint enrollment. Bug: 21563854 Change-Id: I4f601e59fbfcd601e6a80ddcbc7b83ced6cc18c8
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
adef49640d6339e6b4a6ad736c5815e35d9b8803 |
|
29-Jan-2016 |
Shawn Willden <swillden@google.com> |
Add support for extending key validity while on body. Bug: 21563854 Change-Id: I3b622d2af77ec4ac3ba42407fc391112c153ef0f
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
a95550f8016bbb0dba086dbd73eec63e6cdbbe98 |
|
17-Jul-2015 |
Alex Klyubin <klyubin@google.com> |
Add KM_MIN_MAC_LENGTH tag to HMAC and AES-GCM keys. This makes Android Keystore add the KM_MIN_MAC_LENGTH tag to generated and imported HMAC and AES-GCM keys. This tag specifies the minimum length of the MAC/authentication tag authorized to be used for the key. For HMAC keys the minimum MAC length is set to the length of the digest associated with the key (HMAC keys are authorized for exactly one digest). For AES keys the minimum authetication tag length is set to 96 bit. This is the minimum supported by Android Keystore's AES-GCM implementation. Bug: 22337277 Change-Id: Ic6e47cf084734d1592788dc58088889f7fff74eb
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
b6e628644a981b8077b3755b9def4550ff4a46a0 |
|
06-Jul-2015 |
Alex Klyubin <klyubin@google.com> |
Avoid IllegalStateException when generating/importing keys. This avoids IllegalStateException when generating/importing keys which require user authentication when the system is not configured to generate/import such keys (e.g., secure lock screen not set up). The documentation states that before generating/importing such keys apps should check (using public API) whether the system is in a suitable state. However, some apps are not doing that and instead catching the IllegalStateException thrown during key generation/import. This is a bad practice because this exception is an undocumented implementation detail and should thus not be depended upon. This CL addresses this issue as follows: 1. Key(Pair)Generator.init now throws a checked InvalidAlgorithmParameterException when the system is in a wrong state. Because in most uses of Key(Pair)Generator .init is immediately followed by .generate, this prevents .generate from encountering this state and does so using a checked exception which is part of public API. 2. Key import rethrows the IllegalStateException as a checked KeyStoreException which is meant to be thrown if the key cannot be imported for any reason. Key(Pair)Generator.generate unfortunately cannot throw any checked exceptions and thus has to continue throwing unchecked exceptions. Bug: 22262809 Change-Id: Ic0f7b7a90e0ba63df9139c79b80a8649d2645d2a
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
fdbc02a433e87da7bc730bd2e773e6d1c84d4e99 |
|
29-Jun-2015 |
Alex Klyubin <klyubin@google.com> |
Enforce IND-CPA requirement when generating asymmetric keys. This enforces the randomized encryption requirement (IND-CPA), if requested, when generating asymmetric key pairs. Whether randomized encryption is used depends on the encryption padding modes authorized for the key pair. Thus, if randomized encryption is required, the KeyPairGenerator must reject attempts to generate keys authorized for encryption using non-compliant padding schemes. This is similar to the existing check in AndroidKeyStoreImpl during asymmetric key import. Bug: 22179911 Change-Id: I3d85367259c17bd44198a736ace853d0d3567d5e
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
ae6cb7aad56bb006769cd8a69b92af7236644fc1 |
|
23-Jun-2015 |
Alex Klyubin <klyubin@google.com> |
Keymaster INT, LONG and DATE tag values are unsigned. This CL ensures that Android Keystore framework code complies with signedness of keymaster tags. In particular: * INT tags are unsigned 32-bit numbers, and * LONG and DATE tags are unsigned 64-bit numbers. The ensure compliance, KeymasterArguments and KeyCharacteristics classes through which Android Keystore interacts with Keymaster tags have been modified as follows: * ENUM and INT tags which used to be conflated are now added/queried via separate methods, because ENUM can remain represented as an int data type whereas INT is now represented as a long data type with permitted range being [0; 2^32). * Methods for adding/quering LONG tags have been switched from the long data type to the BigInteger data type and now ensure that the value is in the permitted [0; 2^63). * Methods for adding/querying DATE tags now ensure the Date value is in the permitted range [0; 2^63) ms since Unix epoch. * Methods for adding tags throw an IllegalArgumentException if the tag type is unsuitable for the method. This is to ensure that tags with invalid values cannot be added through similar methods (e.g., INT tag added via an ENUM tag addition method invoked with a negative value). Bug: 22008538 Change-Id: I6eefd5cbb561cc52d27de952691af4d9d5e1af1e
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
a99b8b5e3fe456b74b9f86e12bebebb5e418f58e |
|
11-Jun-2015 |
Alex Klyubin <klyubin@google.com> |
Do not require USE_FINGERPRINT for getAuthenticatorId. This removes the requirement to hold the USE_FINGERPRINT permission to successfully invoke FingerprintManager.getAuthenticatorId(). This is needed because Android Keystore classes which run inside app processes occasionally need to access this authenticator ID. The access however is not necessarily triggered by the developer using APIs to do with fingerprints. Thus, if an app does not hold the USE_FINGERPRINT permission and uses Android Keystore API, it may unexpectedly encounter a SecurityException. It's OK to provide access to authenticator ID without requiring USE_FINGERPRINT permission because there are other ways to access this ID without holding that permission, such as though hidden KeyStore API. Once Android Keystore code is restructured to no longer require access to authenticator ID, this CL can be reverted. Bug: 21030147 Change-Id: I9af29830abce34c46e29e5c1682cc3ab88c95c00
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
3ceb1a04b44539c2b2c3afec6df487fe128911f2 |
|
06-Jun-2015 |
Alex Klyubin <klyubin@google.com> |
Switch Android Keystore key gen and import to new KeyStore API. This makes Android Keystore's asymmetric key generation and import use the new KeyStore API (similar to keymaster 1.0 API). Because the resulting private keys will be used through Conscrypt/keystore-engine which uses the old Keystore API, this CL implements a temporary workaround where all generated and imported keys are authorized for padding NONE and digest NONE, in addition to padding schemes and digests requested by the user of the Android Keystore API. This workaround is needed because keystore-engine uses digest NONE and padding NONE for all its crypto operations. Bug: 18088752 Bug: 20912868 Change-Id: Idc709039d091294265bd000160b5507f13825849
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|
dcdaf87ed0aa99073638bcfe645949f130f0c7ad |
|
14-May-2015 |
Alex Klyubin <klyubin@google.com> |
Move Android Keystore impl to android.security.keystore. This moves the non-public API classes backing Android Keystore from android.security to android.security.keystore, a package specially created for Android Keystore. Bug: 18088752 Change-Id: Ibf04d6a26c54d310b0501fc5e34f37b1176324ad
/frameworks/base/keystore/java/android/security/keystore/KeymasterUtils.java
|