symmetric_key.cpp revision 0cb6942d3efb6c056f96321c82a4b3d86af601d6
195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden/* 295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Copyright 2014 The Android Open Source Project 395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Licensed under the Apache License, Version 2.0 (the "License"); 595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * you may not use this file except in compliance with the License. 695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * You may obtain a copy of the License at 795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * http://www.apache.org/licenses/LICENSE-2.0 995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 1095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Unless required by applicable law or agreed to in writing, software 1195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * distributed under the License is distributed on an "AS IS" BASIS, 1295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * See the License for the specific language governing permissions and 1495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * limitations under the License. 1595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden */ 1695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 1795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include "symmetric_key.h" 1895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 1995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <assert.h> 2095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 2195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/err.h> 2295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/rand.h> 2395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 24567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden#include <keymaster/logger.h> 250cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden#include <keymaster/keymaster_context.h> 26567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden 2795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include "aes_key.h" 280d560bfedd40389387f31f6696660fff6bc3a48aShawn Willden#include "hmac_key.h" 29567a4a04f43d35b785d50508e6459b01f2ab4d14Shawn Willden#include "openssl_err.h" 3095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 3195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willdennamespace keymaster { 3295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 330cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::GenerateKey(const AuthorizationSet& key_description, 340cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* key_blob, 350cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 360cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* sw_enforced) { 370cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_blob || !hw_enforced || !sw_enforced) 380cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 397dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 400cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint32_t key_size_bits; 410cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_description.GetTagValue(TAG_KEY_SIZE, &key_size_bits) || 420cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden !key_size_supported(key_size_bits)) 430cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 440cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 450cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden size_t key_data_size = key_size_bits / 8; 460cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob key_material(key_data_size); 470cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_material.key_material) 480cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 490cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 500cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_error_t error = context_->GenerateRandom(key_material.writable_data(), key_data_size); 510cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (error != KM_ERROR_OK) { 520cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden LOG_E("Error generating %d bit symmetric key", key_size_bits); 530cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return error; 547dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 557dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 560cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return context_->CreateKeyBlob(key_description, KM_ORIGIN_GENERATED, key_material, key_blob, 570cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden hw_enforced, sw_enforced); 587dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 597dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 600cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::ImportKey(const AuthorizationSet& key_description, 610cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_key_format_t input_key_material_format, 620cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden const KeymasterKeyBlob& input_key_material, 630cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* output_key_blob, 640cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 650cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* sw_enforced) { 660cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!output_key_blob || !hw_enforced || !sw_enforced) 670cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 680cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 690cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet authorizations(key_description); 707dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 710cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint32_t key_size_bits; 720cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!authorizations.GetTagValue(TAG_KEY_SIZE, &key_size_bits)) { 730cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden // Default key size if not specified. 740cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_size_bits = input_key_material.key_material_size * 8; 750cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden authorizations.push_back(TAG_KEY_SIZE, key_size_bits); 767dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 777dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 780cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_size_supported(key_size_bits)) 790cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 800cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 810cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (input_key_material_format != KM_KEY_FORMAT_RAW) 820cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_FORMAT; 830cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 840cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (key_size_bits != input_key_material.key_material_size * 8) { 850cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden LOG_E("Expected %d-bit key data but got %d bits", key_size_bits, 860cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden input_key_material.key_material_size * 8); 870cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_INVALID_KEY_BLOB; 887dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 897dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 900cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return context_->CreateKeyBlob(authorizations, KM_ORIGIN_IMPORTED, input_key_material, 910cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden output_key_blob, hw_enforced, sw_enforced); 927dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 937dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 947dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willdenstatic const keymaster_key_format_t supported_import_formats[] = {KM_KEY_FORMAT_RAW}; 957dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willdenconst keymaster_key_format_t* SymmetricKeyFactory::SupportedImportFormats(size_t* format_count) { 967dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden *format_count = array_length(supported_import_formats); 977dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return supported_import_formats; 987dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 997dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 1000cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn WilldenSymmetricKey::SymmetricKey(const KeymasterKeyBlob& key_material, 1010cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden const AuthorizationSet& hw_enforced, const AuthorizationSet& sw_enforced, 1020cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_error_t* error) 1030cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden : Key(hw_enforced, sw_enforced, error) { 10495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden if (*error != KM_ERROR_OK) 1057dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return; 1067dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 1070cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint8_t* tmp = dup_buffer(key_material.key_material, key_material.key_material_size); 1080cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (tmp) { 1090cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_data_.reset(tmp); 1100cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_data_size_ = key_material.key_material_size; 111a278f6156b9e57e1de8ca380b14fef113ad10be8Shawn Willden *error = KM_ERROR_OK; 1120cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden } else { 1130cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden *error = KM_ERROR_MEMORY_ALLOCATION_FAILED; 1140cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden } 11595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} 11695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 11795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn WilldenSymmetricKey::~SymmetricKey() { 1187dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden memset_s(key_data_.get(), 0, key_data_size_); 11995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} 12095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 12195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willdenkeymaster_error_t SymmetricKey::key_material(UniquePtr<uint8_t[]>* key_material, 12295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden size_t* size) const { 12395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden *size = key_data_size_; 12495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden key_material->reset(new uint8_t[*size]); 12595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden if (!key_material->get()) 12695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 1277dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden memcpy(key_material->get(), key_data_.get(), *size); 1287dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return KM_ERROR_OK; 1297dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 1307dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 13195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} // namespace keymaster 132