// Copyright 2015 The Android Open Source Project // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. #define LOG_TAG "keystore_client" #include "keystore/keystore_client_impl.h" #include <string> #include <vector> #include "binder/IBinder.h" #include "binder/IInterface.h" #include "binder/IServiceManager.h" #include "keystore/IKeystoreService.h" #include "keystore/keystore.h" #include "log/log.h" #include "utils/String16.h" #include "utils/String8.h" #include "keystore_client.pb.h" using android::ExportResult; using android::KeyCharacteristics; using android::KeymasterArguments; using android::OperationResult; using android::String16; using keymaster::AuthorizationSet; using keymaster::AuthorizationSetBuilder; namespace { // Use the UID of the current process. const int kDefaultUID = -1; const char kEncryptSuffix[] = "_ENC"; const char kAuthenticateSuffix[] = "_AUTH"; const uint32_t kAESKeySize = 256; // bits const uint32_t kHMACKeySize = 256; // bits const uint32_t kHMACOutputSize = 256; // bits const uint8_t* StringAsByteArray(const std::string& s) { return reinterpret_cast<const uint8_t*>(s.data()); } std::string ByteArrayAsString(const uint8_t* data, size_t data_size) { return std::string(reinterpret_cast<const char*>(data), data_size); } void CopyParameters(const AuthorizationSet& in, std::vector<keymaster_key_param_t>* out) { keymaster_key_param_set_t tmp; in.CopyToParamSet(&tmp); out->assign(&tmp.params[0], &tmp.params[tmp.length]); free(tmp.params); } } // namespace namespace keystore { KeystoreClientImpl::KeystoreClientImpl() { service_manager_ = android::defaultServiceManager(); keystore_binder_ = service_manager_->getService(String16("android.security.keystore")); keystore_ = android::interface_cast<android::IKeystoreService>(keystore_binder_); } bool KeystoreClientImpl::encryptWithAuthentication(const std::string& key_name, const std::string& data, std::string* encrypted_data) { // The encryption algorithm is AES-256-CBC with PKCS #7 padding and a random // IV. The authentication algorithm is HMAC-SHA256 and is computed over the // cipher-text (i.e. Encrypt-then-MAC approach). This was chosen over AES-GCM // because hardware support for GCM is not mandatory for all Brillo devices. std::string encryption_key_name = key_name + kEncryptSuffix; if (!createOrVerifyEncryptionKey(encryption_key_name)) { return false; } std::string authentication_key_name = key_name + kAuthenticateSuffix; if (!createOrVerifyAuthenticationKey(authentication_key_name)) { return false; } AuthorizationSetBuilder encrypt_params; encrypt_params.Padding(KM_PAD_PKCS7); encrypt_params.Authorization(keymaster::TAG_BLOCK_MODE, KM_MODE_CBC); AuthorizationSet output_params; std::string raw_encrypted_data; if (!oneShotOperation(KM_PURPOSE_ENCRYPT, encryption_key_name, encrypt_params.build(), data, std::string(), /* signature_to_verify */ &output_params, &raw_encrypted_data)) { ALOGE("Encrypt: AES operation failed."); return false; } keymaster_blob_t init_vector_blob; if (!output_params.GetTagValue(keymaster::TAG_NONCE, &init_vector_blob)) { ALOGE("Encrypt: Missing initialization vector."); return false; } std::string init_vector = ByteArrayAsString(init_vector_blob.data, init_vector_blob.data_length); AuthorizationSetBuilder authenticate_params; authenticate_params.Digest(KM_DIGEST_SHA_2_256); authenticate_params.Authorization(keymaster::TAG_MAC_LENGTH, kHMACOutputSize); std::string raw_authentication_data; if (!oneShotOperation(KM_PURPOSE_SIGN, authentication_key_name, authenticate_params.build(), init_vector + raw_encrypted_data, std::string(), /* signature_to_verify */ &output_params, &raw_authentication_data)) { ALOGE("Encrypt: HMAC operation failed."); return false; } EncryptedData protobuf; protobuf.set_init_vector(init_vector); protobuf.set_authentication_data(raw_authentication_data); protobuf.set_encrypted_data(raw_encrypted_data); if (!protobuf.SerializeToString(encrypted_data)) { ALOGE("Encrypt: Failed to serialize EncryptedData protobuf."); return false; } return true; } bool KeystoreClientImpl::decryptWithAuthentication(const std::string& key_name, const std::string& encrypted_data, std::string* data) { EncryptedData protobuf; if (!protobuf.ParseFromString(encrypted_data)) { ALOGE("Decrypt: Failed to parse EncryptedData protobuf."); } // Verify authentication before attempting decryption. std::string authentication_key_name = key_name + kAuthenticateSuffix; AuthorizationSetBuilder authenticate_params; authenticate_params.Digest(KM_DIGEST_SHA_2_256); AuthorizationSet output_params; std::string output_data; if (!oneShotOperation(KM_PURPOSE_VERIFY, authentication_key_name, authenticate_params.build(), protobuf.init_vector() + protobuf.encrypted_data(), protobuf.authentication_data(), &output_params, &output_data)) { ALOGE("Decrypt: HMAC operation failed."); return false; } std::string encryption_key_name = key_name + kEncryptSuffix; AuthorizationSetBuilder encrypt_params; encrypt_params.Padding(KM_PAD_PKCS7); encrypt_params.Authorization(keymaster::TAG_BLOCK_MODE, KM_MODE_CBC); encrypt_params.Authorization(keymaster::TAG_NONCE, protobuf.init_vector().data(), protobuf.init_vector().size()); if (!oneShotOperation(KM_PURPOSE_DECRYPT, encryption_key_name, encrypt_params.build(), protobuf.encrypted_data(), std::string(), /* signature_to_verify */ &output_params, data)) { ALOGE("Decrypt: AES operation failed."); return false; } return true; } bool KeystoreClientImpl::oneShotOperation(keymaster_purpose_t purpose, const std::string& key_name, const keymaster::AuthorizationSet& input_parameters, const std::string& input_data, const std::string& signature_to_verify, keymaster::AuthorizationSet* output_parameters, std::string* output_data) { keymaster_operation_handle_t handle; int32_t result = beginOperation(purpose, key_name, input_parameters, output_parameters, &handle); if (result != KM_ERROR_OK) { ALOGE("BeginOperation failed: %d", result); return false; } AuthorizationSet empty_params; size_t num_input_bytes_consumed; AuthorizationSet ignored_params; result = updateOperation(handle, empty_params, input_data, &num_input_bytes_consumed, &ignored_params, output_data); if (result != KM_ERROR_OK) { ALOGE("UpdateOperation failed: %d", result); return false; } result = finishOperation(handle, empty_params, signature_to_verify, &ignored_params, output_data); if (result != KM_ERROR_OK) { ALOGE("FinishOperation failed: %d", result); return false; } return true; } int32_t KeystoreClientImpl::addRandomNumberGeneratorEntropy(const std::string& entropy) { return mapKeystoreError(keystore_->addRngEntropy(StringAsByteArray(entropy), entropy.size())); } int32_t KeystoreClientImpl::generateKey(const std::string& key_name, const AuthorizationSet& key_parameters, AuthorizationSet* hardware_enforced_characteristics, AuthorizationSet* software_enforced_characteristics) { String16 key_name16(key_name.data(), key_name.size()); KeymasterArguments key_arguments; CopyParameters(key_parameters, &key_arguments.params); KeyCharacteristics characteristics; int32_t result = keystore_->generateKey(key_name16, key_arguments, NULL /*entropy*/, 0 /*entropyLength*/, kDefaultUID, KEYSTORE_FLAG_NONE, &characteristics); hardware_enforced_characteristics->Reinitialize(characteristics.characteristics.hw_enforced); software_enforced_characteristics->Reinitialize(characteristics.characteristics.sw_enforced); return mapKeystoreError(result); } int32_t KeystoreClientImpl::getKeyCharacteristics(const std::string& key_name, AuthorizationSet* hardware_enforced_characteristics, AuthorizationSet* software_enforced_characteristics) { String16 key_name16(key_name.data(), key_name.size()); keymaster_blob_t client_id_blob = {nullptr, 0}; keymaster_blob_t app_data_blob = {nullptr, 0}; KeyCharacteristics characteristics; int32_t result = keystore_->getKeyCharacteristics(key_name16, &client_id_blob, &app_data_blob, kDefaultUID, &characteristics); hardware_enforced_characteristics->Reinitialize(characteristics.characteristics.hw_enforced); software_enforced_characteristics->Reinitialize(characteristics.characteristics.sw_enforced); return mapKeystoreError(result); } int32_t KeystoreClientImpl::importKey(const std::string& key_name, const AuthorizationSet& key_parameters, keymaster_key_format_t key_format, const std::string& key_data, AuthorizationSet* hardware_enforced_characteristics, AuthorizationSet* software_enforced_characteristics) { String16 key_name16(key_name.data(), key_name.size()); KeymasterArguments key_arguments; CopyParameters(key_parameters, &key_arguments.params); KeyCharacteristics characteristics; int32_t result = keystore_->importKey(key_name16, key_arguments, key_format, StringAsByteArray(key_data), key_data.size(), kDefaultUID, KEYSTORE_FLAG_NONE, &characteristics); hardware_enforced_characteristics->Reinitialize(characteristics.characteristics.hw_enforced); software_enforced_characteristics->Reinitialize(characteristics.characteristics.sw_enforced); return mapKeystoreError(result); } int32_t KeystoreClientImpl::exportKey(keymaster_key_format_t export_format, const std::string& key_name, std::string* export_data) { String16 key_name16(key_name.data(), key_name.size()); keymaster_blob_t client_id_blob = {nullptr, 0}; keymaster_blob_t app_data_blob = {nullptr, 0}; ExportResult export_result; keystore_->exportKey(key_name16, export_format, &client_id_blob, &app_data_blob, kDefaultUID, &export_result); *export_data = ByteArrayAsString(export_result.exportData.get(), export_result.dataLength); return mapKeystoreError(export_result.resultCode); } int32_t KeystoreClientImpl::deleteKey(const std::string& key_name) { String16 key_name16(key_name.data(), key_name.size()); return mapKeystoreError(keystore_->del(key_name16, kDefaultUID)); } int32_t KeystoreClientImpl::deleteAllKeys() { return mapKeystoreError(keystore_->clear_uid(kDefaultUID)); } int32_t KeystoreClientImpl::beginOperation(keymaster_purpose_t purpose, const std::string& key_name, const AuthorizationSet& input_parameters, AuthorizationSet* output_parameters, keymaster_operation_handle_t* handle) { android::sp<android::IBinder> token(new android::BBinder); String16 key_name16(key_name.data(), key_name.size()); KeymasterArguments input_arguments; CopyParameters(input_parameters, &input_arguments.params); OperationResult result; keystore_->begin(token, key_name16, purpose, true /*pruneable*/, input_arguments, NULL /*entropy*/, 0 /*entropyLength*/, kDefaultUID, &result); int32_t error_code = mapKeystoreError(result.resultCode); if (error_code == KM_ERROR_OK) { *handle = getNextVirtualHandle(); active_operations_[*handle] = result.token; if (!result.outParams.params.empty()) { output_parameters->Reinitialize(&*result.outParams.params.begin(), result.outParams.params.size()); } } return error_code; } int32_t KeystoreClientImpl::updateOperation(keymaster_operation_handle_t handle, const AuthorizationSet& input_parameters, const std::string& input_data, size_t* num_input_bytes_consumed, AuthorizationSet* output_parameters, std::string* output_data) { if (active_operations_.count(handle) == 0) { return KM_ERROR_INVALID_OPERATION_HANDLE; } KeymasterArguments input_arguments; CopyParameters(input_parameters, &input_arguments.params); OperationResult result; keystore_->update(active_operations_[handle], input_arguments, StringAsByteArray(input_data), input_data.size(), &result); int32_t error_code = mapKeystoreError(result.resultCode); if (error_code == KM_ERROR_OK) { *num_input_bytes_consumed = result.inputConsumed; if (!result.outParams.params.empty()) { output_parameters->Reinitialize(&*result.outParams.params.begin(), result.outParams.params.size()); } output_data->append(ByteArrayAsString(result.data.get(), result.dataLength)); } return error_code; } int32_t KeystoreClientImpl::finishOperation(keymaster_operation_handle_t handle, const AuthorizationSet& input_parameters, const std::string& signature_to_verify, AuthorizationSet* output_parameters, std::string* output_data) { if (active_operations_.count(handle) == 0) { return KM_ERROR_INVALID_OPERATION_HANDLE; } KeymasterArguments input_arguments; CopyParameters(input_parameters, &input_arguments.params); OperationResult result; keystore_->finish(active_operations_[handle], input_arguments, StringAsByteArray(signature_to_verify), signature_to_verify.size(), NULL /*entropy*/, 0 /*entropyLength*/, &result); int32_t error_code = mapKeystoreError(result.resultCode); if (error_code == KM_ERROR_OK) { if (!result.outParams.params.empty()) { output_parameters->Reinitialize(&*result.outParams.params.begin(), result.outParams.params.size()); } output_data->append(ByteArrayAsString(result.data.get(), result.dataLength)); active_operations_.erase(handle); } return error_code; } int32_t KeystoreClientImpl::abortOperation(keymaster_operation_handle_t handle) { if (active_operations_.count(handle) == 0) { return KM_ERROR_INVALID_OPERATION_HANDLE; } int32_t error_code = mapKeystoreError(keystore_->abort(active_operations_[handle])); if (error_code == KM_ERROR_OK) { active_operations_.erase(handle); } return error_code; } bool KeystoreClientImpl::doesKeyExist(const std::string& key_name) { String16 key_name16(key_name.data(), key_name.size()); int32_t error_code = mapKeystoreError(keystore_->exist(key_name16, kDefaultUID)); return (error_code == KM_ERROR_OK); } bool KeystoreClientImpl::listKeys(const std::string& prefix, std::vector<std::string>* key_name_list) { String16 prefix16(prefix.data(), prefix.size()); android::Vector<String16> matches; int32_t error_code = mapKeystoreError(keystore_->list(prefix16, kDefaultUID, &matches)); if (error_code == KM_ERROR_OK) { for (const auto& match : matches) { android::String8 key_name(match); key_name_list->push_back(prefix + std::string(key_name.string(), key_name.size())); } return true; } return false; } keymaster_operation_handle_t KeystoreClientImpl::getNextVirtualHandle() { return next_virtual_handle_++; } int32_t KeystoreClientImpl::mapKeystoreError(int32_t keystore_error) { // See notes in keystore_client.h for rationale. if (keystore_error == ::NO_ERROR) { return KM_ERROR_OK; } return keystore_error; } bool KeystoreClientImpl::createOrVerifyEncryptionKey(const std::string& key_name) { bool key_exists = doesKeyExist(key_name); if (key_exists) { bool verified = false; if (!verifyEncryptionKeyAttributes(key_name, &verified)) { return false; } if (!verified) { int32_t result = deleteKey(key_name); if (result != KM_ERROR_OK) { ALOGE("Failed to delete invalid encryption key: %d", result); return false; } key_exists = false; } } if (!key_exists) { AuthorizationSetBuilder key_parameters; key_parameters.AesEncryptionKey(kAESKeySize) .Padding(KM_PAD_PKCS7) .Authorization(keymaster::TAG_BLOCK_MODE, KM_MODE_CBC) .Authorization(keymaster::TAG_NO_AUTH_REQUIRED); AuthorizationSet hardware_enforced_characteristics; AuthorizationSet software_enforced_characteristics; int32_t result = generateKey(key_name, key_parameters.build(), &hardware_enforced_characteristics, &software_enforced_characteristics); if (result != KM_ERROR_OK) { ALOGE("Failed to generate encryption key: %d", result); return false; } if (hardware_enforced_characteristics.size() == 0) { ALOGW("WARNING: Encryption key is not hardware-backed."); } } return true; } bool KeystoreClientImpl::createOrVerifyAuthenticationKey(const std::string& key_name) { bool key_exists = doesKeyExist(key_name); if (key_exists) { bool verified = false; if (!verifyAuthenticationKeyAttributes(key_name, &verified)) { return false; } if (!verified) { int32_t result = deleteKey(key_name); if (result != KM_ERROR_OK) { ALOGE("Failed to delete invalid authentication key: %d", result); return false; } key_exists = false; } } if (!key_exists) { AuthorizationSetBuilder key_parameters; key_parameters.HmacKey(kHMACKeySize) .Digest(KM_DIGEST_SHA_2_256) .Authorization(keymaster::TAG_MIN_MAC_LENGTH, kHMACOutputSize) .Authorization(keymaster::TAG_NO_AUTH_REQUIRED); AuthorizationSet hardware_enforced_characteristics; AuthorizationSet software_enforced_characteristics; int32_t result = generateKey(key_name, key_parameters.build(), &hardware_enforced_characteristics, &software_enforced_characteristics); if (result != KM_ERROR_OK) { ALOGE("Failed to generate authentication key: %d", result); return false; } if (hardware_enforced_characteristics.size() == 0) { ALOGW("WARNING: Authentication key is not hardware-backed."); } } return true; } bool KeystoreClientImpl::verifyEncryptionKeyAttributes(const std::string& key_name, bool* verified) { AuthorizationSet hardware_enforced_characteristics; AuthorizationSet software_enforced_characteristics; int32_t result = getKeyCharacteristics(key_name, &hardware_enforced_characteristics, &software_enforced_characteristics); if (result != KM_ERROR_OK) { ALOGE("Failed to query encryption key: %d", result); return false; } *verified = true; keymaster_algorithm_t algorithm = KM_ALGORITHM_RSA; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_ALGORITHM, &algorithm) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_ALGORITHM, &algorithm)) || algorithm != KM_ALGORITHM_AES) { ALOGW("Found encryption key with invalid algorithm."); *verified = false; } uint32_t key_size = 0; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_KEY_SIZE, &key_size) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_KEY_SIZE, &key_size)) || key_size != kAESKeySize) { ALOGW("Found encryption key with invalid size."); *verified = false; } keymaster_block_mode_t block_mode = KM_MODE_ECB; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_BLOCK_MODE, &block_mode) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_BLOCK_MODE, &block_mode)) || block_mode != KM_MODE_CBC) { ALOGW("Found encryption key with invalid block mode."); *verified = false; } keymaster_padding_t padding_mode = KM_PAD_NONE; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_PADDING, &padding_mode) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_PADDING, &padding_mode)) || padding_mode != KM_PAD_PKCS7) { ALOGW("Found encryption key with invalid padding mode."); *verified = false; } if (hardware_enforced_characteristics.size() == 0) { ALOGW("WARNING: Encryption key is not hardware-backed."); } return true; } bool KeystoreClientImpl::verifyAuthenticationKeyAttributes(const std::string& key_name, bool* verified) { AuthorizationSet hardware_enforced_characteristics; AuthorizationSet software_enforced_characteristics; int32_t result = getKeyCharacteristics(key_name, &hardware_enforced_characteristics, &software_enforced_characteristics); if (result != KM_ERROR_OK) { ALOGE("Failed to query authentication key: %d", result); return false; } *verified = true; keymaster_algorithm_t algorithm = KM_ALGORITHM_RSA; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_ALGORITHM, &algorithm) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_ALGORITHM, &algorithm)) || algorithm != KM_ALGORITHM_HMAC) { ALOGW("Found authentication key with invalid algorithm."); *verified = false; } uint32_t key_size = 0; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_KEY_SIZE, &key_size) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_KEY_SIZE, &key_size)) || key_size != kHMACKeySize) { ALOGW("Found authentication key with invalid size."); *verified = false; } uint32_t mac_size = 0; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_MIN_MAC_LENGTH, &mac_size) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_MIN_MAC_LENGTH, &mac_size)) || mac_size != kHMACOutputSize) { ALOGW("Found authentication key with invalid minimum mac size."); *verified = false; } keymaster_digest_t digest = KM_DIGEST_NONE; if ((!hardware_enforced_characteristics.GetTagValue(keymaster::TAG_DIGEST, &digest) && !software_enforced_characteristics.GetTagValue(keymaster::TAG_DIGEST, &digest)) || digest != KM_DIGEST_SHA_2_256) { ALOGW("Found authentication key with invalid digest list."); *verified = false; } if (hardware_enforced_characteristics.size() == 0) { ALOGW("WARNING: Authentication key is not hardware-backed."); } return true; } } // namespace keystore