symmetric_key.cpp revision 0629810b145187575bc26c910dded0d24c64569d
195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden/* 295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Copyright 2014 The Android Open Source Project 395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Licensed under the Apache License, Version 2.0 (the "License"); 595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * you may not use this file except in compliance with the License. 695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * You may obtain a copy of the License at 795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * http://www.apache.org/licenses/LICENSE-2.0 995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 1095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Unless required by applicable law or agreed to in writing, software 1195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * distributed under the License is distributed on an "AS IS" BASIS, 1295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * See the License for the specific language governing permissions and 1495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * limitations under the License. 1595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden */ 1695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 1795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include "symmetric_key.h" 1895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 1995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <assert.h> 2095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 2195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/err.h> 2295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/rand.h> 2395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 240629810b145187575bc26c910dded0d24c64569dShawn Willden#include <keymaster/android_keymaster_utils.h> 25567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden#include <keymaster/logger.h> 260cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden#include <keymaster/keymaster_context.h> 27567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden 2895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include "aes_key.h" 290d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden#include "hmac_key.h" 30567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden#include "openssl_err.h" 3195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 3295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willdennamespace keymaster { 3395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 340cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::GenerateKey(const AuthorizationSet& key_description, 350cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* key_blob, 360cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 370629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 380cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_blob || !hw_enforced || !sw_enforced) 390cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 407dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 410cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint32_t key_size_bits; 420cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_description.GetTagValue(TAG_KEY_SIZE, &key_size_bits) || 430cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden !key_size_supported(key_size_bits)) 440cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 450cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 460cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden size_t key_data_size = key_size_bits / 8; 470cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob key_material(key_data_size); 480cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_material.key_material) 490cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 500cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 510cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_error_t error = context_->GenerateRandom(key_material.writable_data(), key_data_size); 520cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (error != KM_ERROR_OK) { 530cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden LOG_E("Error generating %d bit symmetric key", key_size_bits); 540cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return error; 557dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 567dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 570cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return context_->CreateKeyBlob(key_description, KM_ORIGIN_GENERATED, key_material, key_blob, 580cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden hw_enforced, sw_enforced); 597dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 607dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 610cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::ImportKey(const AuthorizationSet& key_description, 620cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_key_format_t input_key_material_format, 630cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden const KeymasterKeyBlob& input_key_material, 640cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* output_key_blob, 650cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 660629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 670cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!output_key_blob || !hw_enforced || !sw_enforced) 680cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 690cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 700cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet authorizations(key_description); 717dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 720cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint32_t key_size_bits; 730cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!authorizations.GetTagValue(TAG_KEY_SIZE, &key_size_bits)) { 740cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden // Default key size if not specified. 750cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_size_bits = input_key_material.key_material_size * 8; 760cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden authorizations.push_back(TAG_KEY_SIZE, key_size_bits); 777dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 787dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 790cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_size_supported(key_size_bits)) 800cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 810cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 820cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (input_key_material_format != KM_KEY_FORMAT_RAW) 830cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_FORMAT; 840cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 850cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (key_size_bits != input_key_material.key_material_size * 8) { 860cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden LOG_E("Expected %d-bit key data but got %d bits", key_size_bits, 870cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden input_key_material.key_material_size * 8); 880cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_INVALID_KEY_BLOB; 897dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 907dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 910cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return context_->CreateKeyBlob(authorizations, KM_ORIGIN_IMPORTED, input_key_material, 920cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden output_key_blob, hw_enforced, sw_enforced); 937dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 947dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 957dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willdenstatic const keymaster_key_format_t supported_import_formats[] = {KM_KEY_FORMAT_RAW}; 960629810b145187575bc26c910dded0d24c64569dShawn Willdenconst keymaster_key_format_t* 970629810b145187575bc26c910dded0d24c64569dShawn WilldenSymmetricKeyFactory::SupportedImportFormats(size_t* format_count) const { 987dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden *format_count = array_length(supported_import_formats); 997dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return supported_import_formats; 1007dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 1017dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 1020cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn WilldenSymmetricKey::SymmetricKey(const KeymasterKeyBlob& key_material, 1030cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden const AuthorizationSet& hw_enforced, const AuthorizationSet& sw_enforced, 1040cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_error_t* error) 1050cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden : Key(hw_enforced, sw_enforced, error) { 10695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden if (*error != KM_ERROR_OK) 1077dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return; 1087dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 1090cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint8_t* tmp = dup_buffer(key_material.key_material, key_material.key_material_size); 1100cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (tmp) { 1110cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_data_.reset(tmp); 1120cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_data_size_ = key_material.key_material_size; 113a278f6156b9e57e1de8ca380b14fef113ad10be8Shawn Willden *error = KM_ERROR_OK; 1140cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden } else { 1150cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden *error = KM_ERROR_MEMORY_ALLOCATION_FAILED; 1160cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden } 11795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} 11895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 11995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn WilldenSymmetricKey::~SymmetricKey() { 1207dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden memset_s(key_data_.get(), 0, key_data_size_); 12195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} 12295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 12395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willdenkeymaster_error_t SymmetricKey::key_material(UniquePtr<uint8_t[]>* key_material, 12495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden size_t* size) const { 12595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden *size = key_data_size_; 12695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden key_material->reset(new uint8_t[*size]); 12795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden if (!key_material->get()) 12895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 1297dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden memcpy(key_material->get(), key_data_.get(), *size); 1307dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return KM_ERROR_OK; 1317dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 1327dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 13395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} // namespace keymaster 134