symmetric_key.cpp revision 41d5a7486e335387c8dd9437e0c84b285b5c7f28
195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden/* 295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Copyright 2014 The Android Open Source Project 395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Licensed under the Apache License, Version 2.0 (the "License"); 595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * you may not use this file except in compliance with the License. 695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * You may obtain a copy of the License at 795e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * http://www.apache.org/licenses/LICENSE-2.0 995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * 1095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * Unless required by applicable law or agreed to in writing, software 1195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * distributed under the License is distributed on an "AS IS" BASIS, 1295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * See the License for the specific language governing permissions and 1495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden * limitations under the License. 1595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden */ 1695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 17f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/symmetric_key.h> 1895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 1995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <assert.h> 2095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 2195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/err.h> 2295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden#include <openssl/rand.h> 2395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 240629810b145187575bc26c910dded0d24c64569dShawn Willden#include <keymaster/android_keymaster_utils.h> 250cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden#include <keymaster/keymaster_context.h> 26f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/aes_key.h> 27f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/hmac_key.h> 28f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/openssl_err.h> 29f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/logger.h> 3095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 3195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willdennamespace keymaster { 3295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 330cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::GenerateKey(const AuthorizationSet& key_description, 340cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* key_blob, 350cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 360629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 370cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_blob || !hw_enforced || !sw_enforced) 380cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 397dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 400cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint32_t key_size_bits; 410cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_description.GetTagValue(TAG_KEY_SIZE, &key_size_bits) || 420cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden !key_size_supported(key_size_bits)) 430cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 440cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 4533ab0389e908b98702806c746e7babc0d46eb452Shawn Willden keymaster_error_t error = validate_algorithm_specific_new_key_params(key_description); 4633ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (error != KM_ERROR_OK) 4733ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return error; 4833ab0389e908b98702806c746e7babc0d46eb452Shawn Willden 490cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden size_t key_data_size = key_size_bits / 8; 500cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob key_material(key_data_size); 510cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_material.key_material) 520cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 530cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 5441d5a7486e335387c8dd9437e0c84b285b5c7f28Janis Danisevskis error = random_source_.GenerateRandom(key_material.writable_data(), key_data_size); 550cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (error != KM_ERROR_OK) { 560cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden LOG_E("Error generating %d bit symmetric key", key_size_bits); 570cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return error; 587dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 597dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 60da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis return blob_maker_.CreateKeyBlob(key_description, KM_ORIGIN_GENERATED, key_material, key_blob, 61da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis hw_enforced, sw_enforced); 627dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 637dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 640cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willdenkeymaster_error_t SymmetricKeyFactory::ImportKey(const AuthorizationSet& key_description, 650cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_key_format_t input_key_material_format, 660cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden const KeymasterKeyBlob& input_key_material, 670cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden KeymasterKeyBlob* output_key_blob, 680cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet* hw_enforced, 690629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 700cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!output_key_blob || !hw_enforced || !sw_enforced) 710cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 720cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 730cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden AuthorizationSet authorizations(key_description); 747dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 750cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint32_t key_size_bits; 760cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!authorizations.GetTagValue(TAG_KEY_SIZE, &key_size_bits)) { 770cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden // Default key size if not specified. 780cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_size_bits = input_key_material.key_material_size * 8; 790cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden authorizations.push_back(TAG_KEY_SIZE, key_size_bits); 807dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 817dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 8233ab0389e908b98702806c746e7babc0d46eb452Shawn Willden keymaster_error_t error = validate_algorithm_specific_new_key_params(key_description); 8333ab0389e908b98702806c746e7babc0d46eb452Shawn Willden if (error != KM_ERROR_OK) 8433ab0389e908b98702806c746e7babc0d46eb452Shawn Willden return error; 8533ab0389e908b98702806c746e7babc0d46eb452Shawn Willden 860cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (!key_size_supported(key_size_bits)) 870cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_SIZE; 880cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 890cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (input_key_material_format != KM_KEY_FORMAT_RAW) 900cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_UNSUPPORTED_KEY_FORMAT; 910cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden 920cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (key_size_bits != input_key_material.key_material_size * 8) { 930cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden LOG_E("Expected %d-bit key data but got %d bits", key_size_bits, 940cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden input_key_material.key_material_size * 8); 950cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden return KM_ERROR_INVALID_KEY_BLOB; 967dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden } 977dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 98da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis return blob_maker_.CreateKeyBlob(authorizations, KM_ORIGIN_IMPORTED, input_key_material, 990cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden output_key_blob, hw_enforced, sw_enforced); 1007dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 1017dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 1027dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willdenstatic const keymaster_key_format_t supported_import_formats[] = {KM_KEY_FORMAT_RAW}; 1030629810b145187575bc26c910dded0d24c64569dShawn Willdenconst keymaster_key_format_t* 1040629810b145187575bc26c910dded0d24c64569dShawn WilldenSymmetricKeyFactory::SupportedImportFormats(size_t* format_count) const { 1057dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden *format_count = array_length(supported_import_formats); 1067dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return supported_import_formats; 1077dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 1087dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 1090cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn WilldenSymmetricKey::SymmetricKey(const KeymasterKeyBlob& key_material, 1100cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden const AuthorizationSet& hw_enforced, const AuthorizationSet& sw_enforced, 1110cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden keymaster_error_t* error) 1120cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden : Key(hw_enforced, sw_enforced, error) { 11395e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden if (*error != KM_ERROR_OK) 1147dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return; 1157dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 1160cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden uint8_t* tmp = dup_buffer(key_material.key_material, key_material.key_material_size); 1170cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden if (tmp) { 1180cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_data_.reset(tmp); 1190cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden key_data_size_ = key_material.key_material_size; 120a278f6156b9e57e1de8ca380b14fef113ad10be8Shawn Willden *error = KM_ERROR_OK; 1210cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden } else { 1220cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden *error = KM_ERROR_MEMORY_ALLOCATION_FAILED; 1230cb6942d3efb6c056f96321c82a4b3d86af601d6Shawn Willden } 12495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} 12595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 12695e1382b75bab7d8b4cce3c1267fa23df2006957Shawn WilldenSymmetricKey::~SymmetricKey() { 1277dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden memset_s(key_data_.get(), 0, key_data_size_); 12895e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} 12995e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden 13095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willdenkeymaster_error_t SymmetricKey::key_material(UniquePtr<uint8_t[]>* key_material, 13195e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden size_t* size) const { 13295e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden *size = key_data_size_; 1330f906ec40f6ade7955c6b967ea522aade54ea2e4Shawn Willden key_material->reset(new (std::nothrow) uint8_t[*size]); 13495e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden if (!key_material->get()) 13595e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden return KM_ERROR_MEMORY_ALLOCATION_FAILED; 1367dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden memcpy(key_material->get(), key_data_.get(), *size); 1377dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden return KM_ERROR_OK; 1387dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden} 1397dad93b6552a2253ad6e7a493ddf0c9113806712Shawn Willden 14095e1382b75bab7d8b4cce3c1267fa23df2006957Shawn Willden} // namespace keymaster 141