/*
* Copyright 2014 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "android_keymaster_test_utils.h"
#include <algorithm>
#include <openssl/rand.h>
#include <keymaster/android_keymaster_messages.h>
#include <keymaster/android_keymaster_utils.h>
using std::copy_if;
using std::find_if;
using std::is_permutation;
using std::ostream;
using std::string;
using std::vector;
#ifndef KEYMASTER_NAME_TAGS
#error Keymaster test code requires that KEYMASTER_NAME_TAGS is defined
#endif
std::ostream& operator<<(std::ostream& os, const keymaster_key_param_t& param) {
os << "Tag: " << keymaster::StringifyTag(param.tag);
switch (keymaster_tag_get_type(param.tag)) {
case KM_INVALID:
os << " Invalid";
break;
case KM_UINT_REP:
os << " (Rep)";
/* Falls through */
case KM_UINT:
os << " Int: " << param.integer;
break;
case KM_ENUM_REP:
os << " (Rep)";
/* Falls through */
case KM_ENUM:
os << " Enum: " << param.enumerated;
break;
case KM_ULONG_REP:
os << " (Rep)";
/* Falls through */
case KM_ULONG:
os << " Long: " << param.long_integer;
break;
case KM_DATE:
os << " Date: " << param.date_time;
break;
case KM_BOOL:
os << " Bool: " << param.boolean;
break;
case KM_BIGNUM:
os << " Bignum: ";
if (!param.blob.data)
os << "(null)";
else
for (size_t i = 0; i < param.blob.data_length; ++i)
os << std::hex << std::setw(2) << static_cast<int>(param.blob.data[i]) << std::dec;
break;
case KM_BYTES:
os << " Bytes: ";
if (!param.blob.data)
os << "(null)";
else
for (size_t i = 0; i < param.blob.data_length; ++i)
os << std::hex << std::setw(2) << static_cast<int>(param.blob.data[i]) << std::dec;
break;
}
return os;
}
bool operator==(const keymaster_key_param_t& a, const keymaster_key_param_t& b) {
if (a.tag != b.tag) {
return false;
}
switch (keymaster_tag_get_type(a.tag)) {
case KM_INVALID:
return true;
case KM_UINT_REP:
case KM_UINT:
return a.integer == b.integer;
case KM_ENUM_REP:
case KM_ENUM:
return a.enumerated == b.enumerated;
case KM_ULONG:
case KM_ULONG_REP:
return a.long_integer == b.long_integer;
case KM_DATE:
return a.date_time == b.date_time;
case KM_BOOL:
return a.boolean == b.boolean;
case KM_BIGNUM:
case KM_BYTES:
if ((a.blob.data == NULL || b.blob.data == NULL) && a.blob.data != b.blob.data)
return false;
return a.blob.data_length == b.blob.data_length &&
(memcmp(a.blob.data, b.blob.data, a.blob.data_length) == 0);
}
return false;
}
static char hex_value[256] = {
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0, 0, 0, // '0'..'9'
0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 'A'..'F'
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 11, 12, 13, 14, 15, 0,
0, 0, 0, 0, 0, 0, 0, 0, // 'a'..'f'
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
string hex2str(string a) {
string b;
size_t num = a.size() / 2;
b.resize(num);
for (size_t i = 0; i < num; i++) {
b[i] = (hex_value[a[i * 2] & 0xFF] << 4) + (hex_value[a[i * 2 + 1] & 0xFF]);
}
return b;
}
namespace keymaster {
bool operator==(const AuthorizationSet& a, const AuthorizationSet& b) {
if (a.size() != b.size())
return false;
for (size_t i = 0; i < a.size(); ++i)
if (!(a[i] == b[i]))
return false;
return true;
}
bool operator!=(const AuthorizationSet& a, const AuthorizationSet& b) {
return !(a == b);
}
std::ostream& operator<<(std::ostream& os, const AuthorizationSet& set) {
if (set.size() == 0)
os << "(Empty)" << std::endl;
else {
os << "\n";
for (size_t i = 0; i < set.size(); ++i)
os << set[i] << std::endl;
}
return os;
}
namespace test {
std::ostream& operator<<(std::ostream& os, const InstanceCreatorPtr& instance_creator) {
return os << instance_creator->name();
}
Keymaster2Test::Keymaster2Test() : op_handle_(OP_HANDLE_SENTINEL) {
memset(&characteristics_, 0, sizeof(characteristics_));
blob_.key_material = nullptr;
RAND_seed("foobar", 6);
blob_.key_material = 0;
device_ = GetParam()->CreateDevice();
}
Keymaster2Test::~Keymaster2Test() {
FreeCharacteristics();
FreeKeyBlob();
device_->common.close(reinterpret_cast<hw_device_t*>(device_));
}
keymaster2_device_t* Keymaster2Test::device() {
return device_;
}
keymaster_error_t Keymaster2Test::GenerateKey(const AuthorizationSetBuilder& builder) {
AuthorizationSet params(builder.build());
params.push_back(UserAuthParams());
params.push_back(ClientParams());
FreeKeyBlob();
FreeCharacteristics();
return device()->generate_key(device(), ¶ms, &blob_, &characteristics_);
}
keymaster_error_t Keymaster2Test::DeleteKey() {
return device()->delete_key(device(), &blob_);
}
keymaster_error_t Keymaster2Test::ImportKey(const AuthorizationSetBuilder& builder,
keymaster_key_format_t format,
const string& key_material) {
AuthorizationSet params(builder.build());
params.push_back(UserAuthParams());
params.push_back(ClientParams());
FreeKeyBlob();
FreeCharacteristics();
keymaster_blob_t key = {reinterpret_cast<const uint8_t*>(key_material.c_str()),
key_material.length()};
return device()->import_key(device(), ¶ms, format, &key, &blob_, &characteristics_);
}
AuthorizationSet Keymaster2Test::UserAuthParams() {
AuthorizationSet set;
set.push_back(TAG_USER_ID, 7);
set.push_back(TAG_USER_AUTH_TYPE, HW_AUTH_PASSWORD);
set.push_back(TAG_AUTH_TIMEOUT, 300);
return set;
}
AuthorizationSet Keymaster2Test::ClientParams() {
AuthorizationSet set;
set.push_back(TAG_APPLICATION_ID, "app_id", 6);
return set;
}
keymaster_error_t Keymaster2Test::BeginOperation(keymaster_purpose_t purpose) {
AuthorizationSet in_params(client_params());
keymaster_key_param_set_t out_params;
keymaster_error_t error =
device()->begin(device(), purpose, &blob_, &in_params, &out_params, &op_handle_);
EXPECT_EQ(0U, out_params.length);
EXPECT_TRUE(out_params.params == nullptr);
return error;
}
keymaster_error_t Keymaster2Test::BeginOperation(keymaster_purpose_t purpose,
const AuthorizationSet& input_set,
AuthorizationSet* output_set) {
keymaster_key_param_set_t out_params;
keymaster_error_t error =
device()->begin(device(), purpose, &blob_, &input_set, &out_params, &op_handle_);
if (error == KM_ERROR_OK) {
if (output_set) {
output_set->Reinitialize(out_params);
} else {
EXPECT_EQ(0U, out_params.length);
EXPECT_TRUE(out_params.params == nullptr);
}
keymaster_free_param_set(&out_params);
}
return error;
}
keymaster_error_t Keymaster2Test::UpdateOperation(const string& message, string* output,
size_t* input_consumed) {
EXPECT_NE(op_handle_, OP_HANDLE_SENTINEL);
keymaster_blob_t input = {reinterpret_cast<const uint8_t*>(message.c_str()), message.length()};
keymaster_blob_t out_tmp;
keymaster_key_param_set_t out_params;
keymaster_error_t error = device()->update(device(), op_handle_, nullptr /* params */, &input,
input_consumed, &out_params, &out_tmp);
if (error == KM_ERROR_OK && out_tmp.data)
output->append(reinterpret_cast<const char*>(out_tmp.data), out_tmp.data_length);
free(const_cast<uint8_t*>(out_tmp.data));
return error;
}
keymaster_error_t Keymaster2Test::UpdateOperation(const AuthorizationSet& additional_params,
const string& message,
AuthorizationSet* output_params, string* output,
size_t* input_consumed) {
EXPECT_NE(op_handle_, OP_HANDLE_SENTINEL);
keymaster_blob_t input = {reinterpret_cast<const uint8_t*>(message.c_str()), message.length()};
keymaster_blob_t out_tmp;
keymaster_key_param_set_t out_params;
keymaster_error_t error = device()->update(device(), op_handle_, &additional_params, &input,
input_consumed, &out_params, &out_tmp);
if (error == KM_ERROR_OK && out_tmp.data)
output->append(reinterpret_cast<const char*>(out_tmp.data), out_tmp.data_length);
free((void*)out_tmp.data);
if (output_params)
output_params->Reinitialize(out_params);
keymaster_free_param_set(&out_params);
return error;
}
keymaster_error_t Keymaster2Test::FinishOperation(string* output) {
return FinishOperation("", "", output);
}
keymaster_error_t Keymaster2Test::FinishOperation(const string& input, const string& signature,
string* output) {
AuthorizationSet additional_params;
AuthorizationSet output_params;
return FinishOperation(additional_params, input, signature, &output_params, output);
}
keymaster_error_t Keymaster2Test::FinishOperation(const AuthorizationSet& additional_params,
const string& input, const string& signature,
AuthorizationSet* output_params, string* output) {
keymaster_blob_t inp = {reinterpret_cast<const uint8_t*>(input.c_str()), input.length()};
keymaster_blob_t sig = {reinterpret_cast<const uint8_t*>(signature.c_str()),
signature.length()};
keymaster_blob_t out_tmp;
keymaster_key_param_set_t out_params;
keymaster_error_t error = device()->finish(device(), op_handle_, &additional_params, &inp, &sig,
&out_params, &out_tmp);
if (error != KM_ERROR_OK) {
EXPECT_TRUE(out_tmp.data == nullptr);
EXPECT_TRUE(out_params.params == nullptr);
return error;
}
if (out_tmp.data)
output->append(reinterpret_cast<const char*>(out_tmp.data), out_tmp.data_length);
free((void*)out_tmp.data);
if (output_params)
output_params->Reinitialize(out_params);
keymaster_free_param_set(&out_params);
return error;
}
keymaster_error_t Keymaster2Test::AbortOperation() {
return device()->abort(device(), op_handle_);
}
keymaster_error_t Keymaster2Test::AttestKey(const string& attest_challenge,
keymaster_cert_chain_t* cert_chain) {
AuthorizationSet attest_params;
attest_params.push_back(UserAuthParams());
attest_params.push_back(ClientParams());
attest_params.push_back(TAG_ATTESTATION_CHALLENGE, attest_challenge.data(),
attest_challenge.length());
return device()->attest_key(device(), &blob_, &attest_params, cert_chain);
}
keymaster_error_t Keymaster2Test::UpgradeKey(const AuthorizationSet& upgrade_params) {
keymaster_key_blob_t upgraded_blob;
keymaster_error_t error =
device()->upgrade_key(device(), &blob_, &upgrade_params, &upgraded_blob);
if (error == KM_ERROR_OK) {
FreeKeyBlob();
blob_ = upgraded_blob;
}
return error;
}
string Keymaster2Test::ProcessMessage(keymaster_purpose_t purpose, const string& message) {
EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, client_params(), NULL /* output_params */));
string result;
EXPECT_EQ(KM_ERROR_OK, FinishOperation(message, "" /* signature */, &result));
return result;
}
string Keymaster2Test::ProcessMessage(keymaster_purpose_t purpose, const string& message,
const AuthorizationSet& begin_params,
const AuthorizationSet& update_params,
AuthorizationSet* begin_out_params) {
EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, begin_params, begin_out_params));
string result;
EXPECT_EQ(KM_ERROR_OK, FinishOperation(update_params, message, "" /* signature */, &result));
return result;
}
string Keymaster2Test::ProcessMessage(keymaster_purpose_t purpose, const string& message,
const string& signature, const AuthorizationSet& begin_params,
const AuthorizationSet& update_params,
AuthorizationSet* output_params) {
EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, begin_params, output_params));
string result;
EXPECT_EQ(KM_ERROR_OK, FinishOperation(update_params, message, signature, &result));
return result;
}
string Keymaster2Test::ProcessMessage(keymaster_purpose_t purpose, const string& message,
const string& signature) {
EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, client_params(), NULL /* output_params */));
string result;
EXPECT_EQ(KM_ERROR_OK, FinishOperation(message, signature, &result));
return result;
}
void Keymaster2Test::SignMessage(const string& message, string* signature,
keymaster_digest_t digest) {
SCOPED_TRACE("SignMessage");
AuthorizationSet input_params(AuthorizationSet(client_params_, array_length(client_params_)));
input_params.push_back(TAG_DIGEST, digest);
AuthorizationSet update_params;
AuthorizationSet output_params;
*signature =
ProcessMessage(KM_PURPOSE_SIGN, message, input_params, update_params, &output_params);
EXPECT_GT(signature->size(), 0U);
}
void Keymaster2Test::SignMessage(const string& message, string* signature,
keymaster_digest_t digest, keymaster_padding_t padding) {
SCOPED_TRACE("SignMessage");
AuthorizationSet input_params(AuthorizationSet(client_params_, array_length(client_params_)));
input_params.push_back(TAG_DIGEST, digest);
input_params.push_back(TAG_PADDING, padding);
AuthorizationSet update_params;
AuthorizationSet output_params;
*signature =
ProcessMessage(KM_PURPOSE_SIGN, message, input_params, update_params, &output_params);
EXPECT_GT(signature->size(), 0U);
}
void Keymaster2Test::MacMessage(const string& message, string* signature, size_t mac_length) {
SCOPED_TRACE("SignMessage");
AuthorizationSet input_params(AuthorizationSet(client_params_, array_length(client_params_)));
input_params.push_back(TAG_MAC_LENGTH, mac_length);
AuthorizationSet update_params;
AuthorizationSet output_params;
*signature =
ProcessMessage(KM_PURPOSE_SIGN, message, input_params, update_params, &output_params);
EXPECT_GT(signature->size(), 0U);
}
void Keymaster2Test::VerifyMessage(const string& message, const string& signature,
keymaster_digest_t digest) {
SCOPED_TRACE("VerifyMessage");
AuthorizationSet input_params(client_params());
input_params.push_back(TAG_DIGEST, digest);
AuthorizationSet update_params;
AuthorizationSet output_params;
ProcessMessage(KM_PURPOSE_VERIFY, message, signature, input_params, update_params,
&output_params);
}
void Keymaster2Test::VerifyMessage(const string& message, const string& signature,
keymaster_digest_t digest, keymaster_padding_t padding) {
SCOPED_TRACE("VerifyMessage");
AuthorizationSet input_params(client_params());
input_params.push_back(TAG_DIGEST, digest);
input_params.push_back(TAG_PADDING, padding);
AuthorizationSet update_params;
AuthorizationSet output_params;
ProcessMessage(KM_PURPOSE_VERIFY, message, signature, input_params, update_params,
&output_params);
}
void Keymaster2Test::VerifyMac(const string& message, const string& signature) {
SCOPED_TRACE("VerifyMac");
ProcessMessage(KM_PURPOSE_VERIFY, message, signature);
}
string Keymaster2Test::EncryptMessage(const string& message, keymaster_padding_t padding,
string* generated_nonce) {
SCOPED_TRACE("EncryptMessage");
AuthorizationSet begin_params(client_params()), output_params;
begin_params.push_back(TAG_PADDING, padding);
AuthorizationSet update_params;
string ciphertext =
ProcessMessage(KM_PURPOSE_ENCRYPT, message, begin_params, update_params, &output_params);
if (generated_nonce) {
keymaster_blob_t nonce_blob;
EXPECT_TRUE(output_params.GetTagValue(TAG_NONCE, &nonce_blob));
*generated_nonce = make_string(nonce_blob.data, nonce_blob.data_length);
} else {
EXPECT_EQ(-1, output_params.find(TAG_NONCE));
}
return ciphertext;
}
string Keymaster2Test::EncryptMessage(const string& message, keymaster_digest_t digest,
keymaster_padding_t padding, string* generated_nonce) {
AuthorizationSet update_params;
return EncryptMessage(update_params, message, digest, padding, generated_nonce);
}
string Keymaster2Test::EncryptMessage(const string& message, keymaster_block_mode_t block_mode,
keymaster_padding_t padding, string* generated_nonce) {
AuthorizationSet update_params;
return EncryptMessage(update_params, message, block_mode, padding, generated_nonce);
}
string Keymaster2Test::EncryptMessage(const AuthorizationSet& update_params, const string& message,
keymaster_digest_t digest, keymaster_padding_t padding,
string* generated_nonce) {
SCOPED_TRACE("EncryptMessage");
AuthorizationSet begin_params(client_params()), output_params;
begin_params.push_back(TAG_PADDING, padding);
begin_params.push_back(TAG_DIGEST, digest);
string ciphertext =
ProcessMessage(KM_PURPOSE_ENCRYPT, message, begin_params, update_params, &output_params);
if (generated_nonce) {
keymaster_blob_t nonce_blob;
EXPECT_TRUE(output_params.GetTagValue(TAG_NONCE, &nonce_blob));
*generated_nonce = make_string(nonce_blob.data, nonce_blob.data_length);
} else {
EXPECT_EQ(-1, output_params.find(TAG_NONCE));
}
return ciphertext;
}
string Keymaster2Test::EncryptMessage(const AuthorizationSet& update_params, const string& message,
keymaster_block_mode_t block_mode,
keymaster_padding_t padding, string* generated_nonce) {
SCOPED_TRACE("EncryptMessage");
AuthorizationSet begin_params(client_params()), output_params;
begin_params.push_back(TAG_PADDING, padding);
begin_params.push_back(TAG_BLOCK_MODE, block_mode);
string ciphertext =
ProcessMessage(KM_PURPOSE_ENCRYPT, message, begin_params, update_params, &output_params);
if (generated_nonce) {
keymaster_blob_t nonce_blob;
EXPECT_TRUE(output_params.GetTagValue(TAG_NONCE, &nonce_blob));
*generated_nonce = make_string(nonce_blob.data, nonce_blob.data_length);
} else {
EXPECT_EQ(-1, output_params.find(TAG_NONCE));
}
return ciphertext;
}
string Keymaster2Test::EncryptMessageWithParams(const string& message,
const AuthorizationSet& begin_params,
const AuthorizationSet& update_params,
AuthorizationSet* output_params) {
SCOPED_TRACE("EncryptMessageWithParams");
return ProcessMessage(KM_PURPOSE_ENCRYPT, message, begin_params, update_params, output_params);
}
string Keymaster2Test::DecryptMessage(const string& ciphertext, keymaster_padding_t padding) {
SCOPED_TRACE("DecryptMessage");
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, padding);
AuthorizationSet update_params;
return ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext, begin_params, update_params);
}
string Keymaster2Test::DecryptMessage(const string& ciphertext, keymaster_digest_t digest,
keymaster_padding_t padding) {
SCOPED_TRACE("DecryptMessage");
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, padding);
begin_params.push_back(TAG_DIGEST, digest);
AuthorizationSet update_params;
return ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext, begin_params, update_params);
}
string Keymaster2Test::DecryptMessage(const string& ciphertext, keymaster_block_mode_t block_mode,
keymaster_padding_t padding) {
SCOPED_TRACE("DecryptMessage");
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, padding);
begin_params.push_back(TAG_BLOCK_MODE, block_mode);
AuthorizationSet update_params;
return ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext, begin_params, update_params);
}
string Keymaster2Test::DecryptMessage(const string& ciphertext, keymaster_digest_t digest,
keymaster_padding_t padding, const string& nonce) {
SCOPED_TRACE("DecryptMessage");
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, padding);
begin_params.push_back(TAG_DIGEST, digest);
begin_params.push_back(TAG_NONCE, nonce.data(), nonce.size());
AuthorizationSet update_params;
return ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext, begin_params, update_params);
}
string Keymaster2Test::DecryptMessage(const string& ciphertext, keymaster_block_mode_t block_mode,
keymaster_padding_t padding, const string& nonce) {
SCOPED_TRACE("DecryptMessage");
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, padding);
begin_params.push_back(TAG_BLOCK_MODE, block_mode);
begin_params.push_back(TAG_NONCE, nonce.data(), nonce.size());
AuthorizationSet update_params;
return ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext, begin_params, update_params);
}
string Keymaster2Test::DecryptMessage(const AuthorizationSet& update_params,
const string& ciphertext, keymaster_digest_t digest,
keymaster_padding_t padding, const string& nonce) {
SCOPED_TRACE("DecryptMessage");
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, padding);
begin_params.push_back(TAG_DIGEST, digest);
begin_params.push_back(TAG_NONCE, nonce.data(), nonce.size());
return ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext, begin_params, update_params);
}
keymaster_error_t Keymaster2Test::GetCharacteristics() {
FreeCharacteristics();
return device()->get_key_characteristics(device(), &blob_, &client_id_, NULL /* app_data */,
&characteristics_);
}
keymaster_error_t Keymaster2Test::ExportKey(keymaster_key_format_t format, string* export_data) {
keymaster_blob_t export_tmp;
keymaster_error_t error = device()->export_key(device(), format, &blob_, &client_id_,
NULL /* app_data */, &export_tmp);
if (error != KM_ERROR_OK)
return error;
*export_data = string(reinterpret_cast<const char*>(export_tmp.data), export_tmp.data_length);
free((void*)export_tmp.data);
return error;
}
void Keymaster2Test::CheckHmacTestVector(const string& key, const string& message,
keymaster_digest_t digest, string expected_mac) {
ASSERT_EQ(KM_ERROR_OK, ImportKey(AuthorizationSetBuilder()
.HmacKey(key.size() * 8)
.Authorization(TAG_MIN_MAC_LENGTH, expected_mac.size() * 8)
.Digest(digest),
KM_KEY_FORMAT_RAW, key));
string signature;
MacMessage(message, &signature, expected_mac.size() * 8);
EXPECT_EQ(expected_mac, signature) << "Test vector didn't match for digest " << (int)digest;
}
void Keymaster2Test::CheckAesCtrTestVector(const string& key, const string& nonce,
const string& message,
const string& expected_ciphertext) {
ASSERT_EQ(KM_ERROR_OK, ImportKey(AuthorizationSetBuilder()
.AesEncryptionKey(key.size() * 8)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CTR)
.Authorization(TAG_CALLER_NONCE)
.Padding(KM_PAD_NONE),
KM_KEY_FORMAT_RAW, key));
AuthorizationSet begin_params(client_params()), update_params, output_params;
begin_params.push_back(TAG_NONCE, nonce.data(), nonce.size());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_CTR);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
string ciphertext =
EncryptMessageWithParams(message, begin_params, update_params, &output_params);
EXPECT_EQ(expected_ciphertext, ciphertext);
}
AuthorizationSet Keymaster2Test::hw_enforced() {
return AuthorizationSet(characteristics_.hw_enforced);
}
AuthorizationSet Keymaster2Test::sw_enforced() {
return AuthorizationSet(characteristics_.sw_enforced);
}
void Keymaster2Test::FreeCharacteristics() {
keymaster_free_characteristics(&characteristics_);
}
void Keymaster2Test::FreeKeyBlob() {
free(const_cast<uint8_t*>(blob_.key_material));
blob_.key_material = NULL;
}
void Keymaster2Test::corrupt_key_blob() {
assert(blob_.key_material);
uint8_t* tmp = const_cast<uint8_t*>(blob_.key_material);
++tmp[blob_.key_material_size / 2];
}
class Sha256OnlyWrapper {
public:
explicit Sha256OnlyWrapper(const keymaster1_device_t* wrapped_device)
: wrapped_device_(wrapped_device) {
new_module = *wrapped_device_->common.module;
new_module_name = std::string("SHA 256-only ") + wrapped_device_->common.module->name;
new_module.name = new_module_name.c_str();
memset(&device_, 0, sizeof(device_));
device_.common.module = &new_module;
device_.common.close = close_device;
device_.get_supported_algorithms = get_supported_algorithms;
device_.get_supported_block_modes = get_supported_block_modes;
device_.get_supported_padding_modes = get_supported_padding_modes;
device_.get_supported_digests = get_supported_digests;
device_.get_supported_import_formats = get_supported_import_formats;
device_.get_supported_export_formats = get_supported_export_formats;
device_.add_rng_entropy = add_rng_entropy;
device_.generate_key = generate_key;
device_.get_key_characteristics = get_key_characteristics;
device_.import_key = import_key;
device_.export_key = export_key;
device_.begin = begin;
device_.update = update;
device_.finish = finish;
device_.abort = abort;
}
keymaster1_device_t* keymaster_device() { return &device_; }
static bool is_supported(keymaster_digest_t digest) {
return digest == KM_DIGEST_NONE || digest == KM_DIGEST_SHA_2_256;
}
static bool all_digests_supported(const keymaster_key_param_set_t* params) {
for (size_t i = 0; i < params->length; ++i)
if (params->params[i].tag == TAG_DIGEST)
if (!is_supported(static_cast<keymaster_digest_t>(params->params[i].enumerated)))
return false;
return true;
}
static const keymaster_key_param_t*
get_algorithm_param(const keymaster_key_param_set_t* params) {
keymaster_key_param_t* end = params->params + params->length;
auto alg_ptr = std::find_if(params->params, end, [](keymaster_key_param_t& p) {
return p.tag == KM_TAG_ALGORITHM;
});
if (alg_ptr == end)
return nullptr;
return alg_ptr;
}
static int close_device(hw_device_t* dev) {
Sha256OnlyWrapper* wrapper = reinterpret_cast<Sha256OnlyWrapper*>(dev);
const keymaster1_device_t* wrapped_device = wrapper->wrapped_device_;
delete wrapper;
return wrapped_device->common.close(const_cast<hw_device_t*>(&wrapped_device->common));
}
static const keymaster1_device_t* unwrap(const keymaster1_device_t* dev) {
return reinterpret_cast<const Sha256OnlyWrapper*>(dev)->wrapped_device_;
}
static keymaster_error_t get_supported_algorithms(const struct keymaster1_device* dev,
keymaster_algorithm_t** algorithms,
size_t* algorithms_length) {
return unwrap(dev)->get_supported_algorithms(unwrap(dev), algorithms, algorithms_length);
}
static keymaster_error_t get_supported_block_modes(const struct keymaster1_device* dev,
keymaster_algorithm_t algorithm,
keymaster_purpose_t purpose,
keymaster_block_mode_t** modes,
size_t* modes_length) {
return unwrap(dev)->get_supported_block_modes(unwrap(dev), algorithm, purpose, modes,
modes_length);
}
static keymaster_error_t get_supported_padding_modes(const struct keymaster1_device* dev,
keymaster_algorithm_t algorithm,
keymaster_purpose_t purpose,
keymaster_padding_t** modes,
size_t* modes_length) {
return unwrap(dev)->get_supported_padding_modes(unwrap(dev), algorithm, purpose, modes,
modes_length);
}
static keymaster_error_t get_supported_digests(const keymaster1_device_t* dev,
keymaster_algorithm_t algorithm,
keymaster_purpose_t purpose,
keymaster_digest_t** digests,
size_t* digests_length) {
keymaster_error_t error = unwrap(dev)->get_supported_digests(
unwrap(dev), algorithm, purpose, digests, digests_length);
if (error != KM_ERROR_OK)
return error;
std::vector<keymaster_digest_t> filtered_digests;
std::copy_if(*digests, *digests + *digests_length, std::back_inserter(filtered_digests),
[](keymaster_digest_t digest) { return is_supported(digest); });
free(*digests);
*digests_length = filtered_digests.size();
*digests = reinterpret_cast<keymaster_digest_t*>(
malloc(*digests_length * sizeof(keymaster_digest_t)));
std::copy(filtered_digests.begin(), filtered_digests.end(), *digests);
return KM_ERROR_OK;
}
static keymaster_error_t get_supported_import_formats(const struct keymaster1_device* dev,
keymaster_algorithm_t algorithm,
keymaster_key_format_t** formats,
size_t* formats_length) {
return unwrap(dev)->get_supported_import_formats(unwrap(dev), algorithm, formats,
formats_length);
}
static keymaster_error_t get_supported_export_formats(const struct keymaster1_device* dev,
keymaster_algorithm_t algorithm,
keymaster_key_format_t** formats,
size_t* formats_length) {
return unwrap(dev)->get_supported_export_formats(unwrap(dev), algorithm, formats,
formats_length);
}
static keymaster_error_t add_rng_entropy(const struct keymaster1_device* dev,
const uint8_t* data, size_t data_length) {
return unwrap(dev)->add_rng_entropy(unwrap(dev), data, data_length);
}
static keymaster_error_t generate_key(const keymaster1_device_t* dev,
const keymaster_key_param_set_t* params,
keymaster_key_blob_t* key_blob,
keymaster_key_characteristics_t** characteristics) {
auto alg_ptr = get_algorithm_param(params);
if (!alg_ptr)
return KM_ERROR_UNSUPPORTED_ALGORITHM;
if (alg_ptr->enumerated == KM_ALGORITHM_HMAC && !all_digests_supported(params))
return KM_ERROR_UNSUPPORTED_DIGEST;
return unwrap(dev)->generate_key(unwrap(dev), params, key_blob, characteristics);
}
static keymaster_error_t
get_key_characteristics(const struct keymaster1_device* dev,
const keymaster_key_blob_t* key_blob, const keymaster_blob_t* client_id,
const keymaster_blob_t* app_data,
keymaster_key_characteristics_t** characteristics) {
return unwrap(dev)->get_key_characteristics(unwrap(dev), key_blob, client_id, app_data,
characteristics);
}
static keymaster_error_t
import_key(const keymaster1_device_t* dev, const keymaster_key_param_set_t* params,
keymaster_key_format_t key_format, const keymaster_blob_t* key_data,
keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t** characteristics) {
auto alg_ptr = get_algorithm_param(params);
if (!alg_ptr)
return KM_ERROR_UNSUPPORTED_ALGORITHM;
if (alg_ptr->enumerated == KM_ALGORITHM_HMAC && !all_digests_supported(params))
return KM_ERROR_UNSUPPORTED_DIGEST;
return unwrap(dev)->import_key(unwrap(dev), params, key_format, key_data, key_blob,
characteristics);
}
static keymaster_error_t export_key(const struct keymaster1_device* dev, //
keymaster_key_format_t export_format,
const keymaster_key_blob_t* key_to_export,
const keymaster_blob_t* client_id,
const keymaster_blob_t* app_data,
keymaster_blob_t* export_data) {
return unwrap(dev)->export_key(unwrap(dev), export_format, key_to_export, client_id,
app_data, export_data);
}
static keymaster_error_t begin(const keymaster1_device_t* dev, //
keymaster_purpose_t purpose, const keymaster_key_blob_t* key,
const keymaster_key_param_set_t* in_params,
keymaster_key_param_set_t* out_params,
keymaster_operation_handle_t* operation_handle) {
if (!all_digests_supported(in_params))
return KM_ERROR_UNSUPPORTED_DIGEST;
return unwrap(dev)->begin(unwrap(dev), purpose, key, in_params, out_params,
operation_handle);
}
static keymaster_error_t update(const keymaster1_device_t* dev,
keymaster_operation_handle_t operation_handle,
const keymaster_key_param_set_t* in_params,
const keymaster_blob_t* input, size_t* input_consumed,
keymaster_key_param_set_t* out_params,
keymaster_blob_t* output) {
return unwrap(dev)->update(unwrap(dev), operation_handle, in_params, input, input_consumed,
out_params, output);
}
static keymaster_error_t finish(const struct keymaster1_device* dev, //
keymaster_operation_handle_t operation_handle,
const keymaster_key_param_set_t* in_params,
const keymaster_blob_t* signature,
keymaster_key_param_set_t* out_params,
keymaster_blob_t* output) {
return unwrap(dev)->finish(unwrap(dev), operation_handle, in_params, signature, out_params,
output);
}
static keymaster_error_t abort(const struct keymaster1_device* dev,
keymaster_operation_handle_t operation_handle) {
return unwrap(dev)->abort(unwrap(dev), operation_handle);
}
private:
keymaster1_device_t device_;
const keymaster1_device_t* wrapped_device_;
hw_module_t new_module;
string new_module_name;
};
keymaster1_device_t* make_device_sha256_only(keymaster1_device_t* device) {
return (new Sha256OnlyWrapper(device))->keymaster_device();
}
} // namespace test
} // namespace keymaster