ec_keymaster0_key.cpp revision 4fc15704d86aab977c2bdbb14345a2c417be2bab
16270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden/* 26270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * Copyright 2015 The Android Open Source Project 36270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * 46270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * Licensed under the Apache License, Version 2.0 (the "License"); 56270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * you may not use this file except in compliance with the License. 66270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * You may obtain a copy of the License at 76270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * 86270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * http://www.apache.org/licenses/LICENSE-2.0 96270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * 106270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * Unless required by applicable law or agreed to in writing, software 116270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * distributed under the License is distributed on an "AS IS" BASIS, 126270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 136270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * See the License for the specific language governing permissions and 146270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * limitations under the License. 156270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden */ 166270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 176270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden#include "ec_keymaster0_key.h" 186270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 196270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden#include <memory> 206270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 210629810b145187575bc26c910dded0d24c64569dShawn Willden#include <keymaster/android_keymaster_utils.h> 220629810b145187575bc26c910dded0d24c64569dShawn Willden#include <keymaster/logger.h> 236270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden#include <keymaster/soft_keymaster_context.h> 246270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 256270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden#include "keymaster0_engine.h" 266270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden#include "openssl_utils.h" 276270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 286270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdenusing std::unique_ptr; 296270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 306270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdennamespace keymaster { 316270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 326270aca8571399aca8ea538acd7386ddecdcc112Shawn WilldenEcdsaKeymaster0KeyFactory::EcdsaKeymaster0KeyFactory(const SoftKeymasterContext* context, 336270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const Keymaster0Engine* engine) 34d599b15c0693950bdc72fb867872044fdc484ef5Shawn Willden : EcKeyFactory(context), engine_(engine) {} 356270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 366270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdenkeymaster_error_t EcdsaKeymaster0KeyFactory::GenerateKey(const AuthorizationSet& key_description, 376270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden KeymasterKeyBlob* key_blob, 386270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden AuthorizationSet* hw_enforced, 390629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 406270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!key_blob || !hw_enforced || !sw_enforced) 416270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 426270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 436270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_ || !engine_->supports_ec()) 446270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return super::GenerateKey(key_description, key_blob, hw_enforced, sw_enforced); 456270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 466270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden uint32_t key_size; 476270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!key_description.GetTagValue(TAG_KEY_SIZE, &key_size)) { 486270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden LOG_E("%s", "No key size specified for EC key generation"); 496270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 506270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden } 516270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 526270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden KeymasterKeyBlob key_material; 536270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_->GenerateEcKey(key_size, &key_material)) 546270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_UNKNOWN_ERROR; 556270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 566270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden // These tags are hardware-enforced. Putting them in the hw_enforced set here will ensure that 576270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden // context_->CreateKeyBlob doesn't put them in sw_enforced. 586270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_ALGORITHM, KM_ALGORITHM_EC); 596270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_KEY_SIZE, key_size); 6034f09c52b08e654b8b76d9796240a5104c13a4a8Shawn Willden hw_enforced->push_back(TAG_ORIGIN, KM_ORIGIN_UNKNOWN); 616270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 6234f09c52b08e654b8b76d9796240a5104c13a4a8Shawn Willden return context_->CreateKeyBlob(key_description, KM_ORIGIN_UNKNOWN, key_material, key_blob, 636270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced, sw_enforced); 646270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} 656270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 666270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdenkeymaster_error_t EcdsaKeymaster0KeyFactory::ImportKey( 676270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const AuthorizationSet& key_description, keymaster_key_format_t input_key_material_format, 686270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const KeymasterKeyBlob& input_key_material, KeymasterKeyBlob* output_key_blob, 690629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* hw_enforced, AuthorizationSet* sw_enforced) const { 706270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!output_key_blob || !hw_enforced || !sw_enforced) 716270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 726270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 736270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_ || !engine_->supports_ec()) 746270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return super::ImportKey(key_description, input_key_material_format, input_key_material, 756270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden output_key_blob, hw_enforced, sw_enforced); 766270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 776270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden AuthorizationSet authorizations; 786270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden uint32_t key_size; 796270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden keymaster_error_t error = UpdateImportKeyDescription( 806270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden key_description, input_key_material_format, input_key_material, &authorizations, &key_size); 816270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (error != KM_ERROR_OK) 826270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return error; 836270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 846270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden KeymasterKeyBlob imported_hw_key; 856270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_->ImportKey(input_key_material_format, input_key_material, &imported_hw_key)) 866270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_UNKNOWN_ERROR; 876270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 886270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden // These tags are hardware-enforced. Putting them in the hw_enforced set here will ensure that 896270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden // context_->CreateKeyBlob doesn't put them in sw_enforced. 906270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_ALGORITHM, KM_ALGORITHM_EC); 916270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_KEY_SIZE, key_size); 9234f09c52b08e654b8b76d9796240a5104c13a4a8Shawn Willden hw_enforced->push_back(TAG_ORIGIN, KM_ORIGIN_UNKNOWN); 936270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 9434f09c52b08e654b8b76d9796240a5104c13a4a8Shawn Willden return context_->CreateKeyBlob(authorizations, KM_ORIGIN_UNKNOWN, imported_hw_key, 956270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden output_key_blob, hw_enforced, sw_enforced); 966270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} 976270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 986270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdenkeymaster_error_t EcdsaKeymaster0KeyFactory::LoadKey(const KeymasterKeyBlob& key_material, 99d599b15c0693950bdc72fb867872044fdc484ef5Shawn Willden const AuthorizationSet& additional_params, 1006270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const AuthorizationSet& hw_enforced, 1016270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const AuthorizationSet& sw_enforced, 1020629810b145187575bc26c910dded0d24c64569dShawn Willden UniquePtr<Key>* key) const { 1036270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!key) 1046270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 1056270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1066270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (sw_enforced.GetTagCount(TAG_ALGORITHM) == 1) 107d599b15c0693950bdc72fb867872044fdc484ef5Shawn Willden return super::LoadKey(key_material, additional_params, hw_enforced, sw_enforced, key); 1086270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1096270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden unique_ptr<EC_KEY, EC_Delete> ec_key(engine_->BlobToEcKey(key_material)); 1106270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!ec_key) 1116270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_UNKNOWN_ERROR; 1126270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1136270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden keymaster_error_t error; 1140f906ec40f6ade7955c6b967ea522aade54ea2e4Shawn Willden key->reset(new (std::nothrow) 1154fc15704d86aab977c2bdbb14345a2c417be2babShawn Willden EcKeymaster0Key(ec_key.release(), hw_enforced, sw_enforced, &error)); 1166270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (error != KM_ERROR_OK) 1176270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return error; 1186270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1196270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OK; 1206270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} 1216270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1226270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} // namespace keymaster 123