keymaster1_engine.cpp revision 41998988331ff38e922a59ef008896beb3145ba0
1/* 2 * Copyright 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#include "keymaster1_engine.h" 18 19#include <assert.h> 20 21#include <algorithm> 22#include <memory> 23 24#define LOG_TAG "Keymaster1Engine" 25#include <cutils/log.h> 26 27#include "keymaster/android_keymaster_utils.h" 28 29#include <openssl/bn.h> 30#include <openssl/ec_key.h> 31#include <openssl/ecdsa.h> 32 33#include "openssl_err.h" 34#include "openssl_utils.h" 35 36using std::shared_ptr; 37using std::unique_ptr; 38 39namespace keymaster { 40 41Keymaster1Engine* Keymaster1Engine::instance_ = nullptr; 42 43Keymaster1Engine::Keymaster1Engine(const keymaster1_device_t* keymaster1_device) 44 : keymaster1_device_(keymaster1_device), engine_(ENGINE_new()), 45 rsa_index_(RSA_get_ex_new_index(0 /* argl */, NULL /* argp */, NULL /* new_func */, 46 Keymaster1Engine::duplicate_key_data, 47 Keymaster1Engine::free_key_data)), 48 ec_key_index_(EC_KEY_get_ex_new_index(0 /* argl */, NULL /* argp */, NULL /* new_func */, 49 Keymaster1Engine::duplicate_key_data, 50 Keymaster1Engine::free_key_data)), 51 rsa_method_(BuildRsaMethod()), ecdsa_method_(BuildEcdsaMethod()) { 52 assert(rsa_index_ != -1); 53 assert(ec_key_index_ != -1); 54 assert(keymaster1_device); 55 assert(!instance_); 56 57 instance_ = this; 58 59 ENGINE_set_RSA_method(engine_.get(), &rsa_method_, sizeof(rsa_method_)); 60 ENGINE_set_ECDSA_method(engine_.get(), &ecdsa_method_, sizeof(ecdsa_method_)); 61} 62 63Keymaster1Engine::~Keymaster1Engine() { 64 keymaster1_device_->common.close( 65 reinterpret_cast<hw_device_t*>(const_cast<keymaster1_device_t*>(keymaster1_device_))); 66 instance_ = nullptr; 67} 68 69static void ConvertCharacteristics(keymaster_key_characteristics_t* characteristics, 70 AuthorizationSet* hw_enforced, AuthorizationSet* sw_enforced) { 71 unique_ptr<keymaster_key_characteristics_t, Characteristics_Delete> characteristics_deleter( 72 characteristics); 73 if (hw_enforced) 74 hw_enforced->Reinitialize(characteristics->hw_enforced); 75 if (sw_enforced) 76 sw_enforced->Reinitialize(characteristics->sw_enforced); 77} 78 79keymaster_error_t Keymaster1Engine::GenerateKey(const AuthorizationSet& key_description, 80 KeymasterKeyBlob* key_blob, 81 AuthorizationSet* hw_enforced, 82 AuthorizationSet* sw_enforced) const { 83 assert(key_blob); 84 85 keymaster_key_characteristics_t* characteristics; 86 keymaster_key_blob_t blob; 87 keymaster_error_t error = keymaster1_device_->generate_key(keymaster1_device_, &key_description, 88 &blob, &characteristics); 89 if (error != KM_ERROR_OK) 90 return error; 91 unique_ptr<uint8_t, Malloc_Delete> blob_deleter(const_cast<uint8_t*>(blob.key_material)); 92 key_blob->key_material = dup_buffer(blob.key_material, blob.key_material_size); 93 key_blob->key_material_size = blob.key_material_size; 94 95 ConvertCharacteristics(characteristics, hw_enforced, sw_enforced); 96 return error; 97} 98 99keymaster_error_t Keymaster1Engine::ImportKey(const AuthorizationSet& key_description, 100 keymaster_key_format_t input_key_material_format, 101 const KeymasterKeyBlob& input_key_material, 102 KeymasterKeyBlob* output_key_blob, 103 AuthorizationSet* hw_enforced, 104 AuthorizationSet* sw_enforced) const { 105 assert(output_key_blob); 106 107 keymaster_key_characteristics_t* characteristics; 108 const keymaster_blob_t input_key = {input_key_material.key_material, 109 input_key_material.key_material_size}; 110 keymaster_key_blob_t blob; 111 keymaster_error_t error = keymaster1_device_->import_key(keymaster1_device_, &key_description, 112 input_key_material_format, &input_key, 113 &blob, &characteristics); 114 if (error != KM_ERROR_OK) 115 return error; 116 unique_ptr<uint8_t, Malloc_Delete> blob_deleter(const_cast<uint8_t*>(blob.key_material)); 117 output_key_blob->key_material = dup_buffer(blob.key_material, blob.key_material_size); 118 output_key_blob->key_material_size = blob.key_material_size; 119 120 ConvertCharacteristics(characteristics, hw_enforced, sw_enforced); 121 return error; 122} 123 124RSA* Keymaster1Engine::BuildRsaKey(const KeymasterKeyBlob& blob, 125 const AuthorizationSet& additional_params, 126 keymaster_error_t* error) const { 127 // Create new RSA key (with engine methods) and add metadata 128 unique_ptr<RSA, RSA_Delete> rsa(RSA_new_method(engine_.get())); 129 if (!rsa) { 130 *error = TranslateLastOpenSslError(); 131 return nullptr; 132 } 133 134 KeyData* key_data = new KeyData(blob, additional_params); 135 if (!RSA_set_ex_data(rsa.get(), rsa_index_, key_data)) { 136 *error = TranslateLastOpenSslError(); 137 delete key_data; 138 return nullptr; 139 } 140 141 // Copy public key into new RSA key 142 unique_ptr<EVP_PKEY, EVP_PKEY_Delete> pkey( 143 GetKeymaster1PublicKey(key_data->key_material, key_data->begin_params, error)); 144 if (!pkey) { 145 *error = TranslateLastOpenSslError(); 146 return nullptr; 147 } 148 149 unique_ptr<RSA, RSA_Delete> public_rsa(EVP_PKEY_get1_RSA(pkey.get())); 150 if (!public_rsa) { 151 *error = TranslateLastOpenSslError(); 152 return nullptr; 153 } 154 155 rsa->n = BN_dup(public_rsa->n); 156 rsa->e = BN_dup(public_rsa->e); 157 if (!rsa->n || !rsa->e) { 158 *error = TranslateLastOpenSslError(); 159 return nullptr; 160 } 161 162 *error = KM_ERROR_OK; 163 return rsa.release(); 164} 165 166EC_KEY* Keymaster1Engine::BuildEcKey(const KeymasterKeyBlob& blob, 167 const AuthorizationSet& additional_params, 168 keymaster_error_t* error) const { 169 // Create new EC key (with engine methods) and insert blob 170 unique_ptr<EC_KEY, EC_KEY_Delete> ec_key(EC_KEY_new_method(engine_.get())); 171 if (!ec_key) { 172 *error = TranslateLastOpenSslError(); 173 return nullptr; 174 } 175 176 KeyData* key_data = new KeyData(blob, additional_params); 177 if (!EC_KEY_set_ex_data(ec_key.get(), ec_key_index_, key_data)) { 178 *error = TranslateLastOpenSslError(); 179 delete key_data; 180 return nullptr; 181 } 182 183 // Copy public key into new EC key 184 unique_ptr<EVP_PKEY, EVP_PKEY_Delete> pkey( 185 GetKeymaster1PublicKey(blob, additional_params, error)); 186 if (!pkey) { 187 *error = TranslateLastOpenSslError(); 188 return nullptr; 189 } 190 191 unique_ptr<EC_KEY, EC_KEY_Delete> public_ec_key(EVP_PKEY_get1_EC_KEY(pkey.get())); 192 if (!public_ec_key) { 193 *error = TranslateLastOpenSslError(); 194 return nullptr; 195 } 196 197 if (!EC_KEY_set_group(ec_key.get(), EC_KEY_get0_group(public_ec_key.get())) || 198 !EC_KEY_set_public_key(ec_key.get(), EC_KEY_get0_public_key(public_ec_key.get()))) { 199 *error = TranslateLastOpenSslError(); 200 return nullptr; 201 } 202 203 *error = KM_ERROR_OK; 204 return ec_key.release(); 205} 206 207Keymaster1Engine::KeyData* Keymaster1Engine::GetData(EVP_PKEY* key) const { 208 switch (EVP_PKEY_type(key->type)) { 209 case EVP_PKEY_RSA: { 210 unique_ptr<RSA, RSA_Delete> rsa(EVP_PKEY_get1_RSA(key)); 211 return GetData(rsa.get()); 212 } 213 214 case EVP_PKEY_EC: { 215 unique_ptr<EC_KEY, EC_KEY_Delete> ec_key(EVP_PKEY_get1_EC_KEY(key)); 216 return GetData(ec_key.get()); 217 } 218 219 default: 220 return nullptr; 221 }; 222} 223 224Keymaster1Engine::KeyData* Keymaster1Engine::GetData(const RSA* rsa) const { 225 if (!rsa) 226 return nullptr; 227 return reinterpret_cast<KeyData*>(RSA_get_ex_data(rsa, rsa_index_)); 228} 229 230Keymaster1Engine::KeyData* Keymaster1Engine::GetData(const EC_KEY* ec_key) const { 231 if (!ec_key) 232 return nullptr; 233 return reinterpret_cast<KeyData*>(EC_KEY_get_ex_data(ec_key, ec_key_index_)); 234} 235 236/* static */ 237int Keymaster1Engine::duplicate_key_data(CRYPTO_EX_DATA* /* to */, const CRYPTO_EX_DATA* /* from */, 238 void** from_d, int /* index */, long /* argl */, 239 void* /* argp */) { 240 KeyData* data = reinterpret_cast<KeyData*>(*from_d); 241 if (!data) 242 return 1; 243 244 // Default copy ctor is good. 245 *from_d = new KeyData(*data); 246 if (*from_d) 247 return 1; 248 return 0; 249} 250 251/* static */ 252void Keymaster1Engine::free_key_data(void* /* parent */, void* ptr, CRYPTO_EX_DATA* /* data */, 253 int /* index*/, long /* argl */, void* /* argp */) { 254 delete reinterpret_cast<KeyData*>(ptr); 255} 256 257keymaster_error_t Keymaster1Engine::Keymaster1Finish(const KeyData* key_data, 258 const keymaster_blob_t& input, 259 keymaster_blob_t* output) { 260 if (key_data->op_handle == 0) 261 return KM_ERROR_UNKNOWN_ERROR; 262 263 size_t input_consumed; 264 // Note: devices are required to consume all input in a single update call for undigested 265 // signing operations and encryption operations. No need to loop here. 266 keymaster_error_t error = 267 device()->update(device(), key_data->op_handle, &key_data->finish_params, &input, 268 &input_consumed, nullptr /* out_params */, nullptr /* output */); 269 if (error != KM_ERROR_OK) 270 return error; 271 272 return device()->finish(device(), key_data->op_handle, &key_data->finish_params, 273 nullptr /* signature */, nullptr /* out_params */, output); 274} 275 276/* static */ 277int Keymaster1Engine::rsa_sign_raw(RSA* rsa, size_t* out_len, uint8_t* out, size_t max_out, 278 const uint8_t* in, size_t in_len, int padding) { 279 KeyData* key_data = instance_->GetData(rsa); 280 if (!key_data) 281 return 0; 282 283 if (padding != key_data->expected_openssl_padding) { 284 LOG_E("Expected sign_raw with padding %d but got padding %d", 285 key_data->expected_openssl_padding, padding); 286 return KM_ERROR_UNKNOWN_ERROR; 287 } 288 289 keymaster_blob_t input = {in, in_len}; 290 keymaster_blob_t output; 291 key_data->error = instance_->Keymaster1Finish(key_data, input, &output); 292 if (key_data->error != KM_ERROR_OK) 293 return 0; 294 unique_ptr<uint8_t, Malloc_Delete> output_deleter(const_cast<uint8_t*>(output.data)); 295 296 *out_len = std::min(output.data_length, max_out); 297 memcpy(out, output.data, *out_len); 298 return 1; 299} 300 301/* static */ 302int Keymaster1Engine::rsa_decrypt(RSA* rsa, size_t* out_len, uint8_t* out, size_t max_out, 303 const uint8_t* in, size_t in_len, int padding) { 304 KeyData* key_data = instance_->GetData(rsa); 305 if (!key_data) 306 return 0; 307 308 if (padding != key_data->expected_openssl_padding) { 309 LOG_E("Expected sign_raw with padding %d but got padding %d", 310 key_data->expected_openssl_padding, padding); 311 return KM_ERROR_UNKNOWN_ERROR; 312 } 313 314 keymaster_blob_t input = {in, in_len}; 315 keymaster_blob_t output; 316 key_data->error = instance_->Keymaster1Finish(key_data, input, &output); 317 if (key_data->error != KM_ERROR_OK) 318 return 0; 319 unique_ptr<uint8_t, Malloc_Delete> output_deleter(const_cast<uint8_t*>(output.data)); 320 321 *out_len = std::min(output.data_length, max_out); 322 memcpy(out, output.data, *out_len); 323 return 1; 324} 325 326/* static */ 327int Keymaster1Engine::ecdsa_sign(const uint8_t* digest, size_t digest_len, uint8_t* sig, 328 unsigned int* sig_len, EC_KEY* ec_key) { 329 KeyData* key_data = instance_->GetData(ec_key); 330 if (!key_data) 331 return 0; 332 333 // Truncate digest if it's too long 334 size_t max_input_len = (ec_group_size_bits(ec_key) + 7) / 8; 335 if (digest_len > max_input_len) 336 digest_len = max_input_len; 337 338 keymaster_blob_t input = {digest, digest_len}; 339 keymaster_blob_t output; 340 key_data->error = instance_->Keymaster1Finish(key_data, input, &output); 341 if (key_data->error != KM_ERROR_OK) 342 return 0; 343 unique_ptr<uint8_t, Malloc_Delete> output_deleter(const_cast<uint8_t*>(output.data)); 344 345 *sig_len = std::min(output.data_length, ECDSA_size(ec_key)); 346 memcpy(sig, output.data, *sig_len); 347 return 1; 348} 349 350EVP_PKEY* Keymaster1Engine::GetKeymaster1PublicKey(const KeymasterKeyBlob& blob, 351 const AuthorizationSet& additional_params, 352 keymaster_error_t* error) const { 353 keymaster_blob_t client_id = {nullptr, 0}; 354 keymaster_blob_t app_data = {nullptr, 0}; 355 keymaster_blob_t* client_id_ptr = nullptr; 356 keymaster_blob_t* app_data_ptr = nullptr; 357 if (additional_params.GetTagValue(TAG_APPLICATION_ID, &client_id)) 358 client_id_ptr = &client_id; 359 if (additional_params.GetTagValue(TAG_APPLICATION_DATA, &app_data)) 360 app_data_ptr = &app_data; 361 362 keymaster_blob_t export_data = {nullptr, 0}; 363 *error = keymaster1_device_->export_key(keymaster1_device_, KM_KEY_FORMAT_X509, &blob, 364 client_id_ptr, app_data_ptr, &export_data); 365 if (*error != KM_ERROR_OK) 366 return nullptr; 367 368 unique_ptr<uint8_t, Malloc_Delete> pub_key(const_cast<uint8_t*>(export_data.data)); 369 370 const uint8_t* p = export_data.data; 371 return d2i_PUBKEY(nullptr /* allocate new struct */, &p, export_data.data_length); 372} 373 374RSA_METHOD Keymaster1Engine::BuildRsaMethod() { 375 RSA_METHOD method; 376 377 method.common.references = 0; 378 method.common.is_static = 1; 379 method.app_data = nullptr; 380 method.init = nullptr; 381 method.finish = nullptr; 382 method.size = nullptr; 383 method.sign = nullptr; 384 method.verify = nullptr; 385 method.encrypt = nullptr; 386 method.sign_raw = Keymaster1Engine::rsa_sign_raw; 387 method.decrypt = Keymaster1Engine::rsa_decrypt; 388 method.verify_raw = nullptr; 389 method.private_transform = nullptr; 390 method.mod_exp = nullptr; 391 method.bn_mod_exp = BN_mod_exp_mont; 392 method.flags = RSA_FLAG_OPAQUE; 393 method.keygen = nullptr; 394 method.supports_digest = nullptr; 395 396 return method; 397} 398 399ECDSA_METHOD Keymaster1Engine::BuildEcdsaMethod() { 400 ECDSA_METHOD method; 401 402 method.common.references = 0; 403 method.common.is_static = 1; 404 method.app_data = nullptr; 405 method.init = nullptr; 406 method.finish = nullptr; 407 method.group_order_size = nullptr; 408 method.sign = Keymaster1Engine::ecdsa_sign; 409 method.verify = nullptr; 410 method.flags = ECDSA_FLAG_OPAQUE; 411 412 return method; 413} 414 415} // namespace keymaster 416