1/*
2 * Copyright 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef SYSTEM_KEYMASTER_ATTESTATION_RECORD_H_
18#define SYSTEM_KEYMASTER_ATTESTATION_RECORD_H_
19
20#include <hardware/keymaster_defs.h>
21
22#include <keymaster/authorization_set.h>
23
24namespace keymaster {
25
26class KeymasterContext;
27
28/**
29 * The OID for Android attestation records.  For the curious, it breaks down as follows:
30 *
31 * 1 = ISO
32 * 3 = org
33 * 6 = DoD (Huh? OIDs are weird.)
34 * 1 = IANA
35 * 4 = Private
36 * 1 = Enterprises
37 * 11129 = Google
38 * 2 = Google security
39 * 1 = certificate extension
40 * 17 = Android attestation extension.
41 */
42static const char kAttestionRecordOid[] = "1.3.6.1.4.1.11129.2.1.17";
43
44keymaster_error_t build_attestation_record(const AuthorizationSet& attestation_params,
45                                           AuthorizationSet software_enforced,
46                                           AuthorizationSet tee_enforced,
47                                           const KeymasterContext& context,
48                                           UniquePtr<uint8_t[]>* asn1_key_desc,
49                                           size_t* asn1_key_desc_len);
50
51keymaster_error_t parse_attestation_record(const uint8_t* asn1_key_desc, size_t asn1_key_desc_len,
52                                           uint32_t* attestation_version,  //
53                                           keymaster_security_level_t* attestation_security_level,
54                                           uint32_t* keymaster_version,
55                                           keymaster_security_level_t* keymaster_security_level,
56                                           keymaster_blob_t* attestation_challenge,
57                                           AuthorizationSet* software_enforced,
58                                           AuthorizationSet* tee_enforced,
59                                           keymaster_blob_t* unique_id);
60}  // namespace keymaster
61
62#endif  // SYSTEM_KEYMASTER_ATTESTATION_RECORD_H_
63