1 /* 2 ** 3 ** Copyright 2017, The Android Open Source Project 4 ** 5 ** Licensed under the Apache License, Version 2.0 (the "License"); 6 ** you may not use this file except in compliance with the License. 7 ** You may obtain a copy of the License at 8 ** 9 ** http://www.apache.org/licenses/LICENSE-2.0 10 ** 11 ** Unless required by applicable law or agreed to in writing, software 12 ** distributed under the License is distributed on an "AS IS" BASIS, 13 ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 ** See the License for the specific language governing permissions and 15 ** limitations under the License. 16 */ 17 18 #ifndef SOFTWARE_CONTEXT_KEYMASTER1_PASSTHROUGH_CONTEXT_H_ 19 #define SOFTWARE_CONTEXT_KEYMASTER1_PASSTHROUGH_CONTEXT_H_ 20 21 #include <unordered_map> 22 23 #include <hardware/keymaster1.h> 24 #include <hardware/keymaster_defs.h> 25 26 #include <keymaster/contexts/soft_attestation_context.h> 27 #include <keymaster/keymaster_context.h> 28 #include <keymaster/km_openssl/software_random_source.h> 29 #include <keymaster/legacy_support/keymaster1_engine.h> 30 #include <keymaster/legacy_support/keymaster_passthrough_engine.h> 31 #include <keymaster/legacy_support/keymaster_passthrough_key.h> 32 #include <keymaster/soft_key_factory.h> 33 34 namespace keymaster { 35 36 class Keymaster1PassthroughContext : public KeymasterContext, 37 public SoftAttestationContext, 38 public SoftwareRandomSource, 39 public SoftwareKeyBlobMaker { 40 public: 41 Keymaster1PassthroughContext(KmVersion version, keymaster1_device_t* dev); 42 GetKmVersion()43 KmVersion GetKmVersion() const override { return AttestationContext::GetKmVersion(); } 44 45 /** 46 * Sets the system version as reported by the system *itself*. This is used to verify that the 47 * system believes itself to be running the same version that is reported by the bootloader, in 48 * hardware implementations. For SoftKeymasterDevice, this sets the version information used. 49 * 50 * If the specified values don't match the bootloader-provided values, this method must return 51 * KM_ERROR_INVALID_ARGUMENT; 52 */ 53 keymaster_error_t SetSystemVersion(uint32_t os_version, uint32_t os_patchlevel) override; 54 55 /** 56 * Returns the system version. For hardware-based implementations this will be the value 57 * reported by the bootloader. For SoftKeymasterDevice it will be the verion information set by 58 * SetSystemVersion above. 59 */ 60 void GetSystemVersion(uint32_t* os_version, uint32_t* os_patchlevel) const override; 61 62 KeyFactory* GetKeyFactory(keymaster_algorithm_t algorithm) const override; 63 OperationFactory* GetOperationFactory(keymaster_algorithm_t algorithm, 64 keymaster_purpose_t purpose) const override; 65 keymaster_algorithm_t* GetSupportedAlgorithms(size_t* algorithms_count) const override; 66 67 /** 68 * UpgradeKeyBlob takes an existing blob, parses out key material and constructs a new blob with 69 * the current format and OS version info. 70 */ 71 keymaster_error_t UpgradeKeyBlob(const KeymasterKeyBlob& key_to_upgrade, 72 const AuthorizationSet& upgrade_params, 73 KeymasterKeyBlob* upgraded_key) const override; 74 75 /** 76 * ParseKeyBlob takes a blob and extracts authorization sets and key material, returning an 77 * error if the blob fails integrity checking or decryption. Note that the returned key 78 * material may itself be an opaque blob usable only by secure hardware (in the hybrid case). 79 * 80 * This method is called by AndroidKeymaster. 81 */ 82 keymaster_error_t ParseKeyBlob(const KeymasterKeyBlob& blob, 83 const AuthorizationSet& additional_params, 84 UniquePtr<Key>* key) const override; 85 86 /** 87 * Take whatever environment-specific action is appropriate (if any) to delete the specified 88 * key. 89 */ 90 keymaster_error_t DeleteKey(const KeymasterKeyBlob& /* blob */) const override; 91 92 /** 93 * Take whatever environment-specific action is appropriate to delete all keys. 94 */ 95 keymaster_error_t DeleteAllKeys() const override; 96 97 /** 98 * Adds entropy to the Cryptographic Pseudo Random Number Generator used to generate key 99 * material, and other cryptographic protocol elements. Note that if the underlying CPRNG 100 * tracks the size of its entropy pool, it should not assume that the provided data contributes 101 * any entropy, and it should also ensure that data provided through this interface cannot 102 * "poison" the CPRNG outputs, making them predictable. 103 */ 104 keymaster_error_t AddRngEntropy(const uint8_t* buf, size_t length) const override; 105 106 /** 107 * Return the enforcement policy for this context, or null if no enforcement should be done. 108 */ 109 KeymasterEnforcement* enforcement_policy() override; 110 111 CertificateChain GenerateAttestation(const Key& key, // 112 const AuthorizationSet& attest_params, 113 UniquePtr<Key> attest_key, 114 const KeymasterBlob& issuer_subject, 115 keymaster_error_t* error) const override; GenerateSelfSignedCertificate(const Key &,const AuthorizationSet &,bool,keymaster_error_t * error)116 CertificateChain GenerateSelfSignedCertificate(const Key& /* key */, 117 const AuthorizationSet& /* cert_params */, 118 bool /* fake_signature */, 119 keymaster_error_t* error) const override { 120 *error = KM_ERROR_UNIMPLEMENTED; 121 return {}; 122 } 123 124 keymaster_error_t CreateKeyBlob(const AuthorizationSet& key_description, 125 const keymaster_key_origin_t origin, 126 const KeymasterKeyBlob& key_material, KeymasterKeyBlob* blob, 127 AuthorizationSet* hw_enforced, 128 AuthorizationSet* sw_enforced) const override; 129 130 keymaster_error_t 131 UnwrapKey(const KeymasterKeyBlob& wrapped_key_blob, const KeymasterKeyBlob& wrapping_key_blob, 132 const AuthorizationSet& wrapping_key_params, const KeymasterKeyBlob& masking_key, 133 AuthorizationSet* wrapped_key_params, keymaster_key_format_t* wrapped_key_format, 134 KeymasterKeyBlob* wrapped_key_material) const override; 135 136 private: 137 keymaster1_device_t* device_; 138 mutable std::unordered_map<keymaster_algorithm_t, UniquePtr<KeyFactory>> factories_; 139 UniquePtr<KeymasterPassthroughEngine> pt_engine_; 140 UniquePtr<Keymaster1Engine> km1_engine_; 141 142 uint32_t os_version_; 143 uint32_t os_patchlevel_; 144 }; 145 146 } // namespace keymaster 147 148 #endif // SOFTWARE_CONTEXT_KEYMASTER1_PASSTHROUGH_CONTEXT_H_ 149