default/common/IdentityCredential.cpp

/*
 * Copyright 2019, The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#define LOG_TAG "IdentityCredential"

#include "IdentityCredential.h"
#include "IdentityCredentialStore.h"

#include <android/hardware/identity/support/IdentityCredentialSupport.h>

#include <string.h>

#include <android-base/logging.h>
#include <android-base/stringprintf.h>

#include <cppbor.h>
#include <cppbor_parse.h>

#include "FakeSecureHardwareProxy.h"
#include "WritableIdentityCredential.h"

namespace aidl::android::hardware::identity {

using ::aidl::android::hardware::keymaster::Timestamp;
using ::android::base::StringPrintf;
using ::std::optional;

using namespace ::android::hardware::identity;

int IdentityCredential::initialize() {
    if (credentialData_.size() == 0) {
        LOG(ERROR) << "CredentialData is empty";
        return IIdentityCredentialStore::STATUS_INVALID_DATA;
    }
    auto [item, _, message] = cppbor::parse(credentialData_);
    if (item == nullptr) {
        LOG(ERROR) << "CredentialData is not valid CBOR: " << message;
        return IIdentityCredentialStore::STATUS_INVALID_DATA;
    }

    const cppbor::Array* arrayItem = item->asArray();
    if (arrayItem == nullptr || arrayItem->size() != 3) {
        LOG(ERROR) << "CredentialData is not an array with three elements";
        return IIdentityCredentialStore::STATUS_INVALID_DATA;
    }

    const cppbor::Tstr* docTypeItem = (*arrayItem)[0]->asTstr();
    const cppbor::Bool* testCredentialItem =
            ((*arrayItem)[1]->asSimple() != nullptr ? ((*arrayItem)[1]->asSimple()->asBool())
                                                    : nullptr);
    const cppbor::Bstr* encryptedCredentialKeysItem = (*arrayItem)[2]->asBstr();
    if (docTypeItem == nullptr || testCredentialItem == nullptr ||
        encryptedCredentialKeysItem == nullptr) {
        LOG(ERROR) << "CredentialData unexpected item types";
        return IIdentityCredentialStore::STATUS_INVALID_DATA;
    }

    docType_ = docTypeItem->value();
    testCredential_ = testCredentialItem->value();

    encryptedCredentialKeys_ = encryptedCredentialKeysItem->value();
    if (!hwProxy_->initialize(testCredential_, docType_, encryptedCredentialKeys_)) {
        LOG(ERROR) << "hwProxy->initialize failed";
        return false;
    }

    return IIdentityCredentialStore::STATUS_OK;
}

ndk::ScopedAStatus IdentityCredential::deleteCredential(
        vector<uint8_t>* outProofOfDeletionSignature) {
    return deleteCredentialCommon({}, false, outProofOfDeletionSignature);
}

ndk::ScopedAStatus IdentityCredential::deleteCredentialWithChallenge(
        const vector<uint8_t>& challenge, vector<uint8_t>* outProofOfDeletionSignature) {
    return deleteCredentialCommon(challenge, true, outProofOfDeletionSignature);
}

ndk::ScopedAStatus IdentityCredential::deleteCredentialCommon(
        const vector<uint8_t>& challenge, bool includeChallenge,
        vector<uint8_t>* outProofOfDeletionSignature) {
    if (challenge.size() > 32) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA, "Challenge too big"));
    }

    cppbor::Array array = {"ProofOfDeletion", docType_, testCredential_};
    if (includeChallenge) {
        array = {"ProofOfDeletion", docType_, challenge, testCredential_};
    }

    vector<uint8_t> proofOfDeletionCbor = array.encode();
    vector<uint8_t> podDigest = support::sha256(proofOfDeletionCbor);

    optional<vector<uint8_t>> signatureOfToBeSigned = hwProxy_->deleteCredential(
            docType_, challenge, includeChallenge, proofOfDeletionCbor.size());
    if (!signatureOfToBeSigned) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error signing ProofOfDeletion"));
    }

    optional<vector<uint8_t>> signature =
            support::coseSignEcDsaWithSignature(signatureOfToBeSigned.value(),
                                                proofOfDeletionCbor,  // data
                                                {});                  // certificateChain
    if (!signature) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error signing data"));
    }

    *outProofOfDeletionSignature = signature.value();
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::proveOwnership(
        const vector<uint8_t>& challenge, vector<uint8_t>* outProofOfOwnershipSignature) {
    if (challenge.size() > 32) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA, "Challenge too big"));
    }

    cppbor::Array array;
    array = {"ProofOfOwnership", docType_, challenge, testCredential_};
    vector<uint8_t> proofOfOwnershipCbor = array.encode();
    vector<uint8_t> podDigest = support::sha256(proofOfOwnershipCbor);

    optional<vector<uint8_t>> signatureOfToBeSigned = hwProxy_->proveOwnership(
            docType_, testCredential_, challenge, proofOfOwnershipCbor.size());
    if (!signatureOfToBeSigned) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error signing ProofOfOwnership"));
    }

    optional<vector<uint8_t>> signature =
            support::coseSignEcDsaWithSignature(signatureOfToBeSigned.value(),
                                                proofOfOwnershipCbor,  // data
                                                {});                   // certificateChain
    if (!signature) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error signing data"));
    }

    *outProofOfOwnershipSignature = signature.value();
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::createEphemeralKeyPair(vector<uint8_t>* outKeyPair) {
    optional<vector<uint8_t>> ephemeralPriv = hwProxy_->createEphemeralKeyPair();
    if (!ephemeralPriv) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error creating ephemeral key"));
    }
    optional<vector<uint8_t>> keyPair = support::ecPrivateKeyToKeyPair(ephemeralPriv.value());
    if (!keyPair) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error creating ephemeral key-pair"));
    }

    // Stash public key of this key-pair for later check in startRetrieval().
    optional<vector<uint8_t>> publicKey = support::ecKeyPairGetPublicKey(keyPair.value());
    if (!publicKey) {
        LOG(ERROR) << "Error getting public part of ephemeral key pair";
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED,
                "Error getting public part of ephemeral key pair"));
    }
    ephemeralPublicKey_ = publicKey.value();

    *outKeyPair = keyPair.value();
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::setReaderEphemeralPublicKey(
        const vector<uint8_t>& publicKey) {
    readerPublicKey_ = publicKey;
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::createAuthChallenge(int64_t* outChallenge) {
    optional<uint64_t> challenge = hwProxy_->createAuthChallenge();
    if (!challenge) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error generating challenge"));
    }
    *outChallenge = challenge.value();
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::setRequestedNamespaces(
        const vector<RequestNamespace>& requestNamespaces) {
    requestNamespaces_ = requestNamespaces;
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::setVerificationToken(
        const VerificationToken& verificationToken) {
    verificationToken_ = verificationToken;
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::startRetrieval(
        const vector<SecureAccessControlProfile>& accessControlProfiles,
        const HardwareAuthToken& authToken, const vector<uint8_t>& itemsRequest,
        const vector<uint8_t>& signingKeyBlob, const vector<uint8_t>& sessionTranscript,
        const vector<uint8_t>& readerSignature, const vector<int32_t>& requestCounts) {
    std::unique_ptr<cppbor::Item> sessionTranscriptItem;
    if (sessionTranscript.size() > 0) {
        auto [item, _, message] = cppbor::parse(sessionTranscript);
        if (item == nullptr) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "SessionTranscript contains invalid CBOR"));
        }
        sessionTranscriptItem = std::move(item);
    }
    if (numStartRetrievalCalls_ > 0) {
        if (sessionTranscript_ != sessionTranscript) {
            LOG(ERROR) << "Session Transcript changed";
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_SESSION_TRANSCRIPT_MISMATCH,
                    "Passed-in SessionTranscript doesn't match previously used SessionTranscript"));
        }
    }
    sessionTranscript_ = sessionTranscript;

    // This resets various state in the TA...
    if (!hwProxy_->startRetrieveEntries()) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error starting retrieving entries"));
    }

    optional<vector<uint8_t>> signatureOfToBeSigned;
    if (readerSignature.size() > 0) {
        signatureOfToBeSigned = support::coseSignGetSignature(readerSignature);
        if (!signatureOfToBeSigned) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_READER_SIGNATURE_CHECK_FAILED,
                    "Error extracting signatureOfToBeSigned from COSE_Sign1"));
        }
    }

    // Feed the auth token to secure hardware only if they're valid.
    if (authToken.timestamp.milliSeconds != 0) {
        if (!hwProxy_->setAuthToken(
                    authToken.challenge, authToken.userId, authToken.authenticatorId,
                    int(authToken.authenticatorType), authToken.timestamp.milliSeconds,
                    authToken.mac, verificationToken_.challenge,
                    verificationToken_.timestamp.milliSeconds,
                    int(verificationToken_.securityLevel), verificationToken_.mac)) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA, "Invalid Auth Token"));
        }
    }

    // We'll be feeding ACPs interleaved with certificates from the reader
    // certificate chain...
    vector<SecureAccessControlProfile> remainingAcps = accessControlProfiles;

    // ... and we'll use those ACPs to build up a 32-bit mask indicating which
    // of the possible 32 ACPs grants access.
    uint32_t accessControlProfileMask = 0;

    // If there is a signature, validate that it was made with the top-most key in the
    // certificate chain embedded in the COSE_Sign1 structure.
    optional<vector<uint8_t>> readerCertificateChain;
    if (readerSignature.size() > 0) {
        readerCertificateChain = support::coseSignGetX5Chain(readerSignature);
        if (!readerCertificateChain) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_READER_SIGNATURE_CHECK_FAILED,
                    "Unable to get reader certificate chain from COSE_Sign1"));
        }

        // First, feed all the reader certificates to the secure hardware. We start
        // at the end..
        optional<vector<vector<uint8_t>>> splitCerts =
                support::certificateChainSplit(readerCertificateChain.value());
        if (!splitCerts || splitCerts.value().size() == 0) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_READER_SIGNATURE_CHECK_FAILED,
                    "Error splitting certificate chain from COSE_Sign1"));
        }
        for (ssize_t n = splitCerts.value().size() - 1; n >= 0; --n) {
            const vector<uint8_t>& x509Cert = splitCerts.value()[n];
            if (!hwProxy_->pushReaderCert(x509Cert)) {
                return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                        IIdentityCredentialStore::STATUS_READER_SIGNATURE_CHECK_FAILED,
                        StringPrintf("Error validating reader certificate %zd", n).c_str()));
            }

            // If we have ACPs for that particular certificate, send them to the
            // TA right now...
            //
            // Remember in this case certificate equality is done by comparing public keys,
            // not bitwise comparison of the certificates.
            //
            optional<vector<uint8_t>> x509CertPubKey =
                    support::certificateChainGetTopMostKey(x509Cert);
            if (!x509CertPubKey) {
                return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                        IIdentityCredentialStore::STATUS_FAILED,
                        StringPrintf("Error getting public key from reader certificate %zd", n)
                                .c_str()));
            }
            vector<SecureAccessControlProfile>::iterator it = remainingAcps.begin();
            while (it != remainingAcps.end()) {
                const SecureAccessControlProfile& profile = *it;
                if (profile.readerCertificate.encodedCertificate.size() == 0) {
                    ++it;
                    continue;
                }
                optional<vector<uint8_t>> profilePubKey = support::certificateChainGetTopMostKey(
                        profile.readerCertificate.encodedCertificate);
                if (!profilePubKey) {
                    return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                            IIdentityCredentialStore::STATUS_FAILED,
                            "Error getting public key from profile"));
                }
                if (profilePubKey.value() == x509CertPubKey.value()) {
                    optional<bool> res = hwProxy_->validateAccessControlProfile(
                            profile.id, profile.readerCertificate.encodedCertificate,
                            profile.userAuthenticationRequired, profile.timeoutMillis,
                            profile.secureUserId, profile.mac);
                    if (!res) {
                        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                                IIdentityCredentialStore::STATUS_INVALID_DATA,
                                "Error validating access control profile"));
                    }
                    if (res.value()) {
                        accessControlProfileMask |= (1 << profile.id);
                    }
                    it = remainingAcps.erase(it);
                } else {
                    ++it;
                }
            }
        }

        // ... then pass the request message and have the TA check it's signed by the
        // key in last certificate we pushed.
        if (sessionTranscript.size() > 0 && itemsRequest.size() > 0 && readerSignature.size() > 0) {
            optional<vector<uint8_t>> tbsSignature = support::coseSignGetSignature(readerSignature);
            if (!tbsSignature) {
                return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                        IIdentityCredentialStore::STATUS_READER_SIGNATURE_CHECK_FAILED,
                        "Error extracting toBeSigned from COSE_Sign1"));
            }
            optional<int> coseSignAlg = support::coseSignGetAlg(readerSignature);
            if (!coseSignAlg) {
                return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                        IIdentityCredentialStore::STATUS_READER_SIGNATURE_CHECK_FAILED,
                        "Error extracting signature algorithm from COSE_Sign1"));
            }
            if (!hwProxy_->validateRequestMessage(sessionTranscript, itemsRequest,
                                                  coseSignAlg.value(), tbsSignature.value())) {
                return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                        IIdentityCredentialStore::STATUS_READER_SIGNATURE_CHECK_FAILED,
                        "readerMessage is not signed by top-level certificate"));
            }
        }
    }

    // Feed remaining access control profiles...
    for (const SecureAccessControlProfile& profile : remainingAcps) {
        optional<bool> res = hwProxy_->validateAccessControlProfile(
                profile.id, profile.readerCertificate.encodedCertificate,
                profile.userAuthenticationRequired, profile.timeoutMillis, profile.secureUserId,
                profile.mac);
        if (!res) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "Error validating access control profile"));
        }
        if (res.value()) {
            accessControlProfileMask |= (1 << profile.id);
        }
    }

    // TODO: move this check to the TA
#if 1
    // To prevent replay-attacks, we check that the public part of the ephemeral
    // key we previously created, is present in the DeviceEngagement part of
    // SessionTranscript as a COSE_Key, in uncompressed form.
    //
    // We do this by just searching for the X and Y coordinates.
    if (sessionTranscript.size() > 0) {
        auto [getXYSuccess, ePubX, ePubY] = support::ecPublicKeyGetXandY(ephemeralPublicKey_);
        if (!getXYSuccess) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_EPHEMERAL_PUBLIC_KEY_NOT_FOUND,
                    "Error extracting X and Y from ePub"));
        }
        if (sessionTranscript.size() > 0 &&
            !(memmem(sessionTranscript.data(), sessionTranscript.size(), ePubX.data(),
                     ePubX.size()) != nullptr &&
              memmem(sessionTranscript.data(), sessionTranscript.size(), ePubY.data(),
                     ePubY.size()) != nullptr)) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_EPHEMERAL_PUBLIC_KEY_NOT_FOUND,
                    "Did not find ephemeral public key's X and Y coordinates in "
                    "SessionTranscript (make sure leading zeroes are not used)"));
        }
    }
#endif

    // itemsRequest: If non-empty, contains request data that may be signed by the
    // reader.  The content can be defined in the way appropriate for the
    // credential, but there are three requirements that must be met to work with
    // this HAL:
    if (itemsRequest.size() > 0) {
        // 1. The content must be a CBOR-encoded structure.
        auto [item, _, message] = cppbor::parse(itemsRequest);
        if (item == nullptr) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_ITEMS_REQUEST_MESSAGE,
                    "Error decoding CBOR in itemsRequest"));
        }

        // 2. The CBOR structure must be a map.
        const cppbor::Map* map = item->asMap();
        if (map == nullptr) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_ITEMS_REQUEST_MESSAGE,
                    "itemsRequest is not a CBOR map"));
        }

        // 3. The map must contain a key "nameSpaces" whose value contains a map, as described in
        //    the example below.
        //
        //   NameSpaces = {
        //     + NameSpace => DataElements ; Requested data elements for each NameSpace
        //   }
        //
        //   NameSpace = tstr
        //
        //   DataElements = {
        //     + DataElement => IntentToRetain
        //   }
        //
        //   DataElement = tstr
        //   IntentToRetain = bool
        //
        // Here's an example of an |itemsRequest| CBOR value satisfying above requirements 1.
        // through 3.:
        //
        //    {
        //        'docType' : 'org.iso.18013-5.2019',
        //        'nameSpaces' : {
        //            'org.iso.18013-5.2019' : {
        //                'Last name' : false,
        //                'Birth date' : false,
        //                'First name' : false,
        //                'Home address' : true
        //            },
        //            'org.aamva.iso.18013-5.2019' : {
        //                'Real Id' : false
        //            }
        //        }
        //    }
        //
        const cppbor::Map* nsMap = nullptr;
        for (size_t n = 0; n < map->size(); n++) {
            const auto& [keyItem, valueItem] = (*map)[n];
            if (keyItem->type() == cppbor::TSTR && keyItem->asTstr()->value() == "nameSpaces" &&
                valueItem->type() == cppbor::MAP) {
                nsMap = valueItem->asMap();
                break;
            }
        }
        if (nsMap == nullptr) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_ITEMS_REQUEST_MESSAGE,
                    "No nameSpaces map in top-most map"));
        }

        for (size_t n = 0; n < nsMap->size(); n++) {
            auto& [nsKeyItem, nsValueItem] = (*nsMap)[n];
            const cppbor::Tstr* nsKey = nsKeyItem->asTstr();
            const cppbor::Map* nsInnerMap = nsValueItem->asMap();
            if (nsKey == nullptr || nsInnerMap == nullptr) {
                return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                        IIdentityCredentialStore::STATUS_INVALID_ITEMS_REQUEST_MESSAGE,
                        "Type mismatch in nameSpaces map"));
            }
            string requestedNamespace = nsKey->value();
            set<string> requestedKeys;
            for (size_t m = 0; m < nsInnerMap->size(); m++) {
                const auto& [innerMapKeyItem, innerMapValueItem] = (*nsInnerMap)[m];
                const cppbor::Tstr* nameItem = innerMapKeyItem->asTstr();
                const cppbor::Simple* simple = innerMapValueItem->asSimple();
                const cppbor::Bool* intentToRetainItem =
                        (simple != nullptr) ? simple->asBool() : nullptr;
                if (nameItem == nullptr || intentToRetainItem == nullptr) {
                    return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                            IIdentityCredentialStore::STATUS_INVALID_ITEMS_REQUEST_MESSAGE,
                            "Type mismatch in value in nameSpaces map"));
                }
                requestedKeys.insert(nameItem->value());
            }
            requestedNameSpacesAndNames_[requestedNamespace] = requestedKeys;
        }
    }

    deviceNameSpacesMap_ = cppbor::Map();
    currentNameSpaceDeviceNameSpacesMap_ = cppbor::Map();

    requestCountsRemaining_ = requestCounts;
    currentNameSpace_ = "";

    itemsRequest_ = itemsRequest;
    signingKeyBlob_ = signingKeyBlob;

    // calculate the size of DeviceNameSpaces. We need to know it ahead of time.
    calcDeviceNameSpacesSize(accessControlProfileMask);

    // Count the number of non-empty namespaces
    size_t numNamespacesWithValues = 0;
    for (size_t n = 0; n < expectedNumEntriesPerNamespace_.size(); n++) {
        if (expectedNumEntriesPerNamespace_[n] > 0) {
            numNamespacesWithValues += 1;
        }
    }

    // Finally, pass info so the HMAC key can be derived and the TA can start
    // creating the DeviceNameSpaces CBOR...
    if (sessionTranscript_.size() > 0 && readerPublicKey_.size() > 0 && signingKeyBlob.size() > 0) {
        // We expect the reader ephemeral public key to be same size and curve
        // as the ephemeral key we generated (e.g. P-256 key), otherwise ECDH
        // won't work. So its length should be 65 bytes and it should be
        // starting with 0x04.
        if (readerPublicKey_.size() != 65 || readerPublicKey_[0] != 0x04) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_FAILED,
                    "Reader public key is not in expected format"));
        }
        vector<uint8_t> pubKeyP256(readerPublicKey_.begin() + 1, readerPublicKey_.end());
        if (!hwProxy_->calcMacKey(sessionTranscript_, pubKeyP256, signingKeyBlob, docType_,
                                  numNamespacesWithValues, expectedDeviceNameSpacesSize_)) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_FAILED, "Error starting retrieving entries"));
        }
    }

    numStartRetrievalCalls_ += 1;
    return ndk::ScopedAStatus::ok();
}

size_t cborNumBytesForLength(size_t length) {
    if (length < 24) {
        return 0;
    } else if (length <= 0xff) {
        return 1;
    } else if (length <= 0xffff) {
        return 2;
    } else if (length <= 0xffffffff) {
        return 4;
    }
    return 8;
}

size_t cborNumBytesForTstr(const string& value) {
    return 1 + cborNumBytesForLength(value.size()) + value.size();
}

void IdentityCredential::calcDeviceNameSpacesSize(uint32_t accessControlProfileMask) {
    /*
     * This is how DeviceNameSpaces is defined:
     *
     *        DeviceNameSpaces = {
     *            * NameSpace => DeviceSignedItems
     *        }
     *        DeviceSignedItems = {
     *            + DataItemName => DataItemValue
     *        }
     *
     *        Namespace = tstr
     *        DataItemName = tstr
     *        DataItemValue = any
     *
     * This function will calculate its length using knowledge of how CBOR is
     * encoded.
     */
    size_t ret = 0;
    vector<unsigned int> numEntriesPerNamespace;
    for (const RequestNamespace& rns : requestNamespaces_) {
        vector<RequestDataItem> itemsToInclude;

        for (const RequestDataItem& rdi : rns.items) {
            // If we have a CBOR request message, skip if item isn't in it
            if (itemsRequest_.size() > 0) {
                const auto& it = requestedNameSpacesAndNames_.find(rns.namespaceName);
                if (it == requestedNameSpacesAndNames_.end()) {
                    continue;
                }
                const set<string>& dataItemNames = it->second;
                if (dataItemNames.find(rdi.name) == dataItemNames.end()) {
                    continue;
                }
            }

            // Access is granted if at least one of the profiles grants access.
            //
            // If an item is configured without any profiles, access is denied.
            //
            bool authorized = false;
            for (auto id : rdi.accessControlProfileIds) {
                if (accessControlProfileMask & (1 << id)) {
                    authorized = true;
                    break;
                }
            }
            if (!authorized) {
                continue;
            }

            itemsToInclude.push_back(rdi);
        }

        numEntriesPerNamespace.push_back(itemsToInclude.size());

        // If no entries are to be in the namespace, we don't include it in
        // the CBOR...
        if (itemsToInclude.size() == 0) {
            continue;
        }

        // Key: NameSpace
        ret += cborNumBytesForTstr(rns.namespaceName);

        // Value: Open the DeviceSignedItems map
        ret += 1 + cborNumBytesForLength(itemsToInclude.size());

        for (const RequestDataItem& item : itemsToInclude) {
            // Key: DataItemName
            ret += cborNumBytesForTstr(item.name);

            // Value: DataItemValue - entryData.size is the length of serialized CBOR so we use
            // that.
            ret += item.size;
        }
    }

    // Now that we know the number of namespaces with values, we know how many
    // bytes the DeviceNamespaces map in the beginning is going to take up.
    ret += 1 + cborNumBytesForLength(numEntriesPerNamespace.size());

    expectedDeviceNameSpacesSize_ = ret;
    expectedNumEntriesPerNamespace_ = numEntriesPerNamespace;
}

ndk::ScopedAStatus IdentityCredential::startRetrieveEntryValue(
        const string& nameSpace, const string& name, int32_t entrySize,
        const vector<int32_t>& accessControlProfileIds) {
    if (name.empty()) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA, "Name cannot be empty"));
    }
    if (nameSpace.empty()) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA, "Name space cannot be empty"));
    }

    if (requestCountsRemaining_.size() == 0) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA,
                "No more name spaces left to go through"));
    }

    bool newNamespace;
    if (currentNameSpace_ == "") {
        // First call.
        currentNameSpace_ = nameSpace;
        newNamespace = true;
    }

    if (nameSpace == currentNameSpace_) {
        // Same namespace.
        if (requestCountsRemaining_[0] == 0) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "No more entries to be retrieved in current name space"));
        }
        requestCountsRemaining_[0] -= 1;
    } else {
        // New namespace.
        if (requestCountsRemaining_[0] != 0) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "Moved to new name space but one or more entries need to be retrieved "
                    "in current name space"));
        }
        if (currentNameSpaceDeviceNameSpacesMap_.size() > 0) {
            deviceNameSpacesMap_.add(currentNameSpace_,
                                     std::move(currentNameSpaceDeviceNameSpacesMap_));
        }
        currentNameSpaceDeviceNameSpacesMap_ = cppbor::Map();

        requestCountsRemaining_.erase(requestCountsRemaining_.begin());
        currentNameSpace_ = nameSpace;
        newNamespace = true;
    }

    // It's permissible to have an empty itemsRequest... but if non-empty you can
    // only request what was specified in said itemsRequest. Enforce that.
    if (itemsRequest_.size() > 0) {
        const auto& it = requestedNameSpacesAndNames_.find(nameSpace);
        if (it == requestedNameSpacesAndNames_.end()) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_NOT_IN_REQUEST_MESSAGE,
                    "Name space was not requested in startRetrieval"));
        }
        const set<string>& dataItemNames = it->second;
        if (dataItemNames.find(name) == dataItemNames.end()) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_NOT_IN_REQUEST_MESSAGE,
                    "Data item name in name space was not requested in startRetrieval"));
        }
    }

    unsigned int newNamespaceNumEntries = 0;
    if (newNamespace) {
        if (expectedNumEntriesPerNamespace_.size() == 0) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "No more populated name spaces left to go through"));
        }
        newNamespaceNumEntries = expectedNumEntriesPerNamespace_[0];
        expectedNumEntriesPerNamespace_.erase(expectedNumEntriesPerNamespace_.begin());
    }

    // Access control is enforced in the secure hardware.
    //
    // ... except for STATUS_NOT_IN_REQUEST_MESSAGE, that's handled above (TODO:
    // consolidate).
    //
    AccessCheckResult res = hwProxy_->startRetrieveEntryValue(
            nameSpace, name, newNamespaceNumEntries, entrySize, accessControlProfileIds);
    switch (res) {
        case AccessCheckResult::kOk:
            /* Do nothing. */
            break;
        case AccessCheckResult::kFailed:
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_FAILED,
                    "Access control check failed (failed)"));
            break;
        case AccessCheckResult::kNoAccessControlProfiles:
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_NO_ACCESS_CONTROL_PROFILES,
                    "Access control check failed (no access control profiles)"));
            break;
        case AccessCheckResult::kUserAuthenticationFailed:
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_USER_AUTHENTICATION_FAILED,
                    "Access control check failed (user auth)"));
            break;
        case AccessCheckResult::kReaderAuthenticationFailed:
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_READER_AUTHENTICATION_FAILED,
                    "Access control check failed (reader auth)"));
            break;
    }

    currentName_ = name;
    currentAccessControlProfileIds_ = accessControlProfileIds;
    entryRemainingBytes_ = entrySize;
    entryValue_.resize(0);

    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::retrieveEntryValue(const vector<uint8_t>& encryptedContent,
                                                          vector<uint8_t>* outContent) {
    optional<vector<uint8_t>> content = hwProxy_->retrieveEntryValue(
            encryptedContent, currentNameSpace_, currentName_, currentAccessControlProfileIds_);
    if (!content) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA, "Error decrypting data"));
    }

    size_t chunkSize = content.value().size();

    if (chunkSize > entryRemainingBytes_) {
        LOG(ERROR) << "Retrieved chunk of size " << chunkSize
                   << " is bigger than remaining space of size " << entryRemainingBytes_;
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA,
                "Retrieved chunk is bigger than remaining space"));
    }

    entryRemainingBytes_ -= chunkSize;
    if (entryRemainingBytes_ > 0) {
        if (chunkSize != IdentityCredentialStore::kGcmChunkSize) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "Retrieved non-final chunk of size which isn't kGcmChunkSize"));
        }
    }

    entryValue_.insert(entryValue_.end(), content.value().begin(), content.value().end());

    if (entryRemainingBytes_ == 0) {
        auto [entryValueItem, _, message] = cppbor::parse(entryValue_);
        if (entryValueItem == nullptr) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "Retrieved data which is invalid CBOR"));
        }
        currentNameSpaceDeviceNameSpacesMap_.add(currentName_, std::move(entryValueItem));
    }

    *outContent = content.value();
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::finishRetrieval(vector<uint8_t>* outMac,
                                                       vector<uint8_t>* outDeviceNameSpaces) {
    if (currentNameSpaceDeviceNameSpacesMap_.size() > 0) {
        deviceNameSpacesMap_.add(currentNameSpace_,
                                 std::move(currentNameSpaceDeviceNameSpacesMap_));
    }
    vector<uint8_t> encodedDeviceNameSpaces = deviceNameSpacesMap_.encode();

    if (encodedDeviceNameSpaces.size() != expectedDeviceNameSpacesSize_) {
        LOG(ERROR) << "encodedDeviceNameSpaces is " << encodedDeviceNameSpaces.size() << " bytes, "
                   << "was expecting " << expectedDeviceNameSpacesSize_;
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_INVALID_DATA,
                StringPrintf(
                        "Unexpected CBOR size %zd for encodedDeviceNameSpaces, was expecting %zd",
                        encodedDeviceNameSpaces.size(), expectedDeviceNameSpacesSize_)
                        .c_str()));
    }

    // If there's no signing key or no sessionTranscript or no reader ephemeral
    // public key, we return the empty MAC.
    optional<vector<uint8_t>> mac;
    if (signingKeyBlob_.size() > 0 && sessionTranscript_.size() > 0 &&
        readerPublicKey_.size() > 0) {
        optional<vector<uint8_t>> digestToBeMaced = hwProxy_->finishRetrieval();
        if (!digestToBeMaced || digestToBeMaced.value().size() != 32) {
            return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                    IIdentityCredentialStore::STATUS_INVALID_DATA,
                    "Error generating digestToBeMaced"));
        }
        // Now construct COSE_Mac0 from the returned MAC...
        mac = support::coseMacWithDigest(digestToBeMaced.value(), {} /* data */);
    }

    *outMac = mac.value_or(vector<uint8_t>({}));
    *outDeviceNameSpaces = encodedDeviceNameSpaces;
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::generateSigningKeyPair(
        vector<uint8_t>* outSigningKeyBlob, Certificate* outSigningKeyCertificate) {
    time_t now = time(NULL);
    optional<pair<vector<uint8_t>, vector<uint8_t>>> pair =
            hwProxy_->generateSigningKeyPair(docType_, now);
    if (!pair) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED, "Error creating signingKey"));
    }

    *outSigningKeyCertificate = Certificate();
    outSigningKeyCertificate->encodedCertificate = pair->first;

    *outSigningKeyBlob = pair->second;
    return ndk::ScopedAStatus::ok();
}

ndk::ScopedAStatus IdentityCredential::updateCredential(
        shared_ptr<IWritableIdentityCredential>* outWritableCredential) {
    sp<SecureHardwareProvisioningProxy> hwProxy = hwProxyFactory_->createProvisioningProxy();
    shared_ptr<WritableIdentityCredential> wc =
            ndk::SharedRefBase::make<WritableIdentityCredential>(hwProxy, docType_,
                                                                 testCredential_);
    if (!wc->initializeForUpdate(encryptedCredentialKeys_)) {
        return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
                IIdentityCredentialStore::STATUS_FAILED,
                "Error initializing WritableIdentityCredential for update"));
    }
    *outWritableCredential = wc;
    return ndk::ScopedAStatus::ok();
}

}  // namespace aidl::android::hardware::identity