195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden/* 295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Copyright 2014 The Android Open Source Project 395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Licensed under the Apache License, Version 2.0 (the "License"); 595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * you may not use this file except in compliance with the License. 695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * You may obtain a copy of the License at 795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * http://www.apache.org/licenses/LICENSE-2.0 995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 1095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Unless required by applicable law or agreed to in writing, software 1195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * distributed under the License is distributed on an "AS IS" BASIS, 1295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * See the License for the specific language governing permissions and 1495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * limitations under the License. 1595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden */ 1695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 17f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/symmetric_key.h> 1895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 1995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <assert.h> 2095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 2195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/err.h> 2295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/rand.h> 2395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 240629810b145187575bc26c910dded0d24c64569dShawn Willden#include <keymaster/android_keymaster_utils.h> 250cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden#include <keymaster/keymaster_context.h> 26f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/aes_key.h> 27f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/hmac_key.h> 28f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/openssl_err.h> 29f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/logger.h> 3095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 3195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willdennamespace keymaster { 3295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 330cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::GenerateKey(const AuthorizationSet& key_description, 340cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* key_blob, 350cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 360629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 370cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_blob || !hw_enforced || !sw_enforced) 380cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 397dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 400cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint32_t key_size_bits; 410cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_description.GetTagValue(TAG_KEY_SIZE, &key_size_bits) || 420cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden !key_size_supported(key_size_bits)) 430cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 440cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 4533ab0389e908b98702806c746e7babc0d46eb452Shawn Willden keymaster_error_t error = validate_algorithm_specific_new_key_params(key_description); 4633ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (error != KM_ERROR_OK) 4733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return error; 4833ab0389e908b98702806c746e7babc0d46eb452Shawn Willden 490797016108191fcf54bec412702d13f1646da041Shawn Willden size_t key_data_size = key_size_bytes(key_size_bits); 500cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob key_material(key_data_size); 510cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_material.key_material) 520cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 530cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 5441d5a7486e335387c8dd9437e0c84b285b5c7f28Janis Danisevskis error = random_source_.GenerateRandom(key_material.writable_data(), key_data_size); 550cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (error != KM_ERROR_OK) { 560cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden LOG_E("Error generating %d bit symmetric key", key_size_bits); 570cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return error; 587dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 597dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 60da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis return blob_maker_.CreateKeyBlob(key_description, KM_ORIGIN_GENERATED, key_material, key_blob, 61da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis hw_enforced, sw_enforced); 627dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 637dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 640cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::ImportKey(const AuthorizationSet& key_description, 650cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_key_format_t input_key_material_format, 660cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden const KeymasterKeyBlob& input_key_material, 670cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* output_key_blob, 680cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 690629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 700cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!output_key_blob || !hw_enforced || !sw_enforced) 710cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 720cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 730cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet authorizations(key_description); 747dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 750797016108191fcf54bec412702d13f1646da041Shawn Willden uint32_t key_bits; 760797016108191fcf54bec412702d13f1646da041Shawn Willden if (!authorizations.GetTagValue(TAG_KEY_SIZE, &key_bits)) { 770797016108191fcf54bec412702d13f1646da041Shawn Willden // Determine key size if not provided. 780797016108191fcf54bec412702d13f1646da041Shawn Willden key_bits = key_size_bits(input_key_material.key_material_size); 790797016108191fcf54bec412702d13f1646da041Shawn Willden authorizations.push_back(TAG_KEY_SIZE, key_bits); 807dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 817dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 8233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden keymaster_error_t error = validate_algorithm_specific_new_key_params(key_description); 830797016108191fcf54bec412702d13f1646da041Shawn Willden if (error != KM_ERROR_OK) return error; 840797016108191fcf54bec412702d13f1646da041Shawn Willden if (!key_size_supported(key_bits)) return KM_ERROR_UNSUPPORTED_KEY_SIZE; 850797016108191fcf54bec412702d13f1646da041Shawn Willden if (input_key_material_format != KM_KEY_FORMAT_RAW) return KM_ERROR_UNSUPPORTED_KEY_FORMAT; 860cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 870797016108191fcf54bec412702d13f1646da041Shawn Willden if (key_bits != key_size_bits(input_key_material.key_material_size)) { 880797016108191fcf54bec412702d13f1646da041Shawn Willden LOG_E("Expected %d-bit key data but got %d-bit key", key_bits, 890797016108191fcf54bec412702d13f1646da041Shawn Willden key_size_bits(input_key_material.key_material_size)); 900cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_INVALID_KEY_BLOB; 917dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 927dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 93da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis return blob_maker_.CreateKeyBlob(authorizations, KM_ORIGIN_IMPORTED, input_key_material, 940cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden output_key_blob, hw_enforced, sw_enforced); 957dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 967dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 977dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willdenstatic const keymaster_key_format_t supported_import_formats[] = {KM_KEY_FORMAT_RAW}; 980629810b145187575bc26c910dded0d24c64569dShawn Willdenconst keymaster_key_format_t* 990629810b145187575bc26c910dded0d24c64569dShawn WilldenSymmetricKeyFactory::SupportedImportFormats(size_t* format_count) const { 1007dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden *format_count = array_length(supported_import_formats); 1017dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return supported_import_formats; 1027dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 1037dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 10459c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis DanisevskisSymmetricKey::SymmetricKey(KeymasterKeyBlob&& key_material, 10559c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis AuthorizationSet&& hw_enforced, AuthorizationSet&& sw_enforced, 10659c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis const KeyFactory* key_factory) 10759c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis : Key(move(hw_enforced), move(sw_enforced), key_factory) { 10859c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis key_material_ = move(key_material); 10995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} 11095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 11159c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis DanisevskisSymmetricKey::~SymmetricKey() {} 1127dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 11395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} // namespace keymaster 114