16270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden/* 26270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * Copyright 2015 The Android Open Source Project 36270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * 46270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * Licensed under the Apache License, Version 2.0 (the "License"); 56270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * you may not use this file except in compliance with the License. 66270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * You may obtain a copy of the License at 76270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * 86270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * http://www.apache.org/licenses/LICENSE-2.0 96270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * 106270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * Unless required by applicable law or agreed to in writing, software 116270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * distributed under the License is distributed on an "AS IS" BASIS, 126270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 136270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * See the License for the specific language governing permissions and 146270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden * limitations under the License. 156270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden */ 166270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 17f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/legacy_support/ec_keymaster0_key.h> 186270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 196270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden#include <memory> 206270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 210629810b145187575bc26c910dded0d24c64569dShawn Willden#include <keymaster/android_keymaster_utils.h> 22f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/contexts/soft_keymaster_context.h> 23f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/km_openssl/openssl_utils.h> 24f54cc93ccf57a94f9a2c660dbf3e06494adf178dJanis Danisevskis#include <keymaster/legacy_support/keymaster0_engine.h> 250629810b145187575bc26c910dded0d24c64569dShawn Willden#include <keymaster/logger.h> 266270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 276270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 286270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdenusing std::unique_ptr; 296270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 306270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdennamespace keymaster { 316270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 32da157a3b17b315c1c36f346c18037656946755aaJanis DanisevskisEcdsaKeymaster0KeyFactory::EcdsaKeymaster0KeyFactory(const SoftwareKeyBlobMaker* blob_maker, 336270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const Keymaster0Engine* engine) 34da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis : EcKeyFactory(blob_maker), engine_(engine) {} 356270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 366270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdenkeymaster_error_t EcdsaKeymaster0KeyFactory::GenerateKey(const AuthorizationSet& key_description, 376270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden KeymasterKeyBlob* key_blob, 386270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden AuthorizationSet* hw_enforced, 390629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* sw_enforced) const { 406270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!key_blob || !hw_enforced || !sw_enforced) 416270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 426270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 436270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_ || !engine_->supports_ec()) 446270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return super::GenerateKey(key_description, key_blob, hw_enforced, sw_enforced); 456270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 46ba0d5d01bde427b7d7a22cec84cd9304c00b4e14Shawn Willden keymaster_ec_curve_t ec_curve; 476270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden uint32_t key_size; 48ba0d5d01bde427b7d7a22cec84cd9304c00b4e14Shawn Willden keymaster_error_t error = GetCurveAndSize(key_description, &ec_curve, &key_size); 49ba0d5d01bde427b7d7a22cec84cd9304c00b4e14Shawn Willden if (error != KM_ERROR_OK) { 50ba0d5d01bde427b7d7a22cec84cd9304c00b4e14Shawn Willden return error; 516270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden } 526270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 536270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden KeymasterKeyBlob key_material; 546270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_->GenerateEcKey(key_size, &key_material)) 556270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_UNKNOWN_ERROR; 566270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 576270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden // These tags are hardware-enforced. Putting them in the hw_enforced set here will ensure that 58da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis // blob_maker_->CreateKeyBlob doesn't put them in sw_enforced. 596270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_ALGORITHM, KM_ALGORITHM_EC); 606270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_KEY_SIZE, key_size); 61ba0d5d01bde427b7d7a22cec84cd9304c00b4e14Shawn Willden hw_enforced->push_back(TAG_EC_CURVE, ec_curve); 6234f09c52b08e654b8b76d9796240a5104c13a4a8Shawn Willden hw_enforced->push_back(TAG_ORIGIN, KM_ORIGIN_UNKNOWN); 636270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 64da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis return blob_maker_.CreateKeyBlob(key_description, KM_ORIGIN_UNKNOWN, key_material, key_blob, 65da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis hw_enforced, sw_enforced); 666270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} 676270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 686270aca8571399aca8ea538acd7386ddecdcc112Shawn Willdenkeymaster_error_t EcdsaKeymaster0KeyFactory::ImportKey( 696270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const AuthorizationSet& key_description, keymaster_key_format_t input_key_material_format, 706270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden const KeymasterKeyBlob& input_key_material, KeymasterKeyBlob* output_key_blob, 710629810b145187575bc26c910dded0d24c64569dShawn Willden AuthorizationSet* hw_enforced, AuthorizationSet* sw_enforced) const { 726270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!output_key_blob || !hw_enforced || !sw_enforced) 736270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 746270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 756270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_ || !engine_->supports_ec()) 766270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return super::ImportKey(key_description, input_key_material_format, input_key_material, 776270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden output_key_blob, hw_enforced, sw_enforced); 786270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 796270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden AuthorizationSet authorizations; 806270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden uint32_t key_size; 816270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden keymaster_error_t error = UpdateImportKeyDescription( 826270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden key_description, input_key_material_format, input_key_material, &authorizations, &key_size); 836270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (error != KM_ERROR_OK) 846270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return error; 856270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 866270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden KeymasterKeyBlob imported_hw_key; 876270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!engine_->ImportKey(input_key_material_format, input_key_material, &imported_hw_key)) 886270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_UNKNOWN_ERROR; 896270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 906270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden // These tags are hardware-enforced. Putting them in the hw_enforced set here will ensure that 91da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis // blob_maker_->CreateKeyBlob doesn't put them in sw_enforced. 926270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_ALGORITHM, KM_ALGORITHM_EC); 936270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden hw_enforced->push_back(TAG_KEY_SIZE, key_size); 9434f09c52b08e654b8b76d9796240a5104c13a4a8Shawn Willden hw_enforced->push_back(TAG_ORIGIN, KM_ORIGIN_UNKNOWN); 956270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 96da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis return blob_maker_.CreateKeyBlob(authorizations, KM_ORIGIN_UNKNOWN, imported_hw_key, 97da157a3b17b315c1c36f346c18037656946755aaJanis Danisevskis output_key_blob, hw_enforced, sw_enforced); 986270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} 996270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 10059c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskiskeymaster_error_t EcdsaKeymaster0KeyFactory::LoadKey(KeymasterKeyBlob&& key_material, 101d599b15c0693950bdc72fb867872044fdc484ef5Shawn Willden const AuthorizationSet& additional_params, 10259c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis AuthorizationSet&& hw_enforced, 10359c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis AuthorizationSet&& sw_enforced, 1040629810b145187575bc26c910dded0d24c64569dShawn Willden UniquePtr<Key>* key) const { 1056270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!key) 1066270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OUTPUT_PARAMETER_NULL; 1076270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1086270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (sw_enforced.GetTagCount(TAG_ALGORITHM) == 1) 10959c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis return super::LoadKey(move(key_material), additional_params, move(hw_enforced), move(sw_enforced), key); 1106270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 111fabacaf3e6019804cc8a98a2b8296be1d0125519Thai Duong unique_ptr<EC_KEY, EC_KEY_Delete> ec_key(engine_->BlobToEcKey(key_material)); 1126270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden if (!ec_key) 1136270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_UNKNOWN_ERROR; 1146270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1150f906ec40f6ade7955c6b967ea522aade54ea2e4Shawn Willden key->reset(new (std::nothrow) 11659c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis EcKeymaster0Key(ec_key.release(), move(hw_enforced), move(sw_enforced), this)); 11759c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis if (!(*key)) 11859c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis return KM_ERROR_MEMORY_ALLOCATION_FAILED; 1196270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 12059c6af81b6b510dd991ab04b8d65f1bab966d0c8Janis Danisevskis (*key)->key_material() = move(key_material); 1216270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden return KM_ERROR_OK; 1226270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} 1236270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden 1246270aca8571399aca8ea538acd7386ddecdcc112Shawn Willden} // namespace keymaster 125