1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); you 5 * may not use this file except in compliance with the License. You may 6 * obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 13 * implied. See the License for the specific language governing 14 * permissions and limitations under the License. 15 */ 16 17 #ifndef ANDROID_HARDWARE_QCOM_KEYMASTER_H 18 #define ANDROID_HARDWARE_QCOM_KEYMASTER_H 19 20 #include <stdint.h> 21 #include <sys/cdefs.h> 22 #include <sys/types.h> 23 24 __BEGIN_DECLS 25 26 /** 27 * The id of this module 28 */ 29 #define QCOM_KEYSTORE_KEYMASTER "qcom_keymaster" 30 /** 31 * Operation result 32 */ 33 #define KEYMATER_SUCCESS 0 34 #define KEYMASTER_FAILURE -1 35 36 /** 37 * The API level of this version of the header. The allows the implementing 38 * module to recognize which API level of the client it is dealing with in 39 * the case of pre-compiled binary clients. 40 */ 41 #define QCOM_KEYMASTER_API_VERSION 2 42 43 #define KM_MAGIC_NUM (0x4B4D4B42) /* "KMKB" Key Master Key Blob in hex */ 44 #define KM_KEY_SIZE_MAX (512) /* 4096 bits */ 45 #define KM_IV_LENGTH (16) /* AES128 CBC IV */ 46 #define KM_HMAC_LENGTH (32) /* SHA2 will be used for HMAC */ 47 48 struct qcom_km_key_blob { 49 uint32_t magic_num; 50 uint32_t version_num; 51 uint8_t modulus[KM_KEY_SIZE_MAX]; 52 uint32_t modulus_size; 53 uint8_t public_exponent[KM_KEY_SIZE_MAX]; 54 uint32_t public_exponent_size; 55 uint8_t iv[KM_IV_LENGTH]; 56 uint8_t encrypted_private_exponent[KM_KEY_SIZE_MAX]; 57 uint32_t encrypted_private_exponent_size; 58 uint8_t hmac[KM_HMAC_LENGTH]; 59 }; 60 typedef struct qcom_km_key_blob qcom_km_key_blob_t; 61 /** 62 * Commands supported 63 */ 64 enum keymaster_cmd_t { 65 /* 66 * List the commands supportedin by the hardware. 67 */ 68 KEYMASTER_GENERATE_KEYPAIR = 0x00000001, 69 KEYMASTER_IMPORT_KEYPAIR = 0x00000002, 70 KEYMASTER_SIGN_DATA = 0x00000003, 71 KEYMASTER_VERIFY_DATA = 0x00000004, 72 }; 73 74 75 /** 76 * Command to Generate a public and private key. The key data returned 77 * (by secure app) is in shared buffer at offset of "key_blob" and is opaque 78 * 79 * cmd_id : Command issue to secure app 80 * key_type : Currently on RSA_TYPE is supported 81 * rsa_params : Parameters needed to generate an RSA key 82 */ 83 struct keymaster_gen_keypair_cmd { 84 keymaster_cmd_t cmd_id; 85 keymaster_keypair_t key_type; 86 keymaster_rsa_keygen_params_t rsa_params; 87 }; 88 typedef struct keymaster_gen_keypair_cmd keymaster_gen_keypair_cmd_t; 89 90 /** 91 * Response to Generate a public and private key. The key data returned 92 * (by secure app) is in shared buffer at offset of "key_blob" and is opaque 93 * 94 * cmd_id : Command issue to secure app 95 * key_blob : key blob data 96 * key_blob_len : Total length of key blob information 97 * status : Result (success 0, or failure -1) 98 */ 99 struct keymaster_gen_keypair_resp { 100 keymaster_cmd_t cmd_id; 101 qcom_km_key_blob_t key_blob; 102 size_t key_blob_len; 103 int32_t status; 104 }; 105 typedef struct keymaster_gen_keypair_resp keymaster_gen_keypair_resp_t; 106 107 108 /** 109 * Command to import a public and private key pair. The imported keys 110 * will be in PKCS#8 format with DER encoding (Java standard). The key 111 * data returned (by secure app) is in shared buffer at offset of 112 * "key_blob" and is opaque 113 * 114 * cmd_id : Command issue to secure app 115 * pkcs8_key : Pointer to pkcs8 formatted key information 116 * pkcs8_key_len: PKCS8 formatted key length 117 */ 118 struct keymaster_import_keypair_cmd { 119 keymaster_cmd_t cmd_id; 120 uint32_t pkcs8_key; 121 size_t pkcs8_key_len; 122 }; 123 typedef struct keymaster_import_keypair_cmd keymaster_import_keypair_cmd_t; 124 125 /** 126 * Response to import a public and private key. The key data returned 127 * (by secure app) is in shared buffer at offset of "key_blob" and is opaque 128 * 129 * cmd_id : Command issue to secure app 130 * key_blob : key blob data 131 * key_blob_len : Total length of key blob information 132 * status : Result (success 0, or failure -1) 133 */ 134 struct keymaster_import_keypair_resp { 135 keymaster_cmd_t cmd_id; 136 qcom_km_key_blob_t key_blob; 137 size_t key_blob_len; 138 int32_t status; 139 }; 140 typedef struct keymaster_import_keypair_resp keymaster_import_keypair_resp_t; 141 142 /** 143 * Command to sign data using a key info generated before. This can use either 144 * an asymmetric key or a secret key. 145 * The signed data is returned (by secure app) at offset of data + dlen. 146 * 147 * cmd_id : Command issue to secure app 148 * sign_param : 149 * key_blob : Key data information (in shared buffer) 150 * data : Pointer to plain data buffer 151 * dlen : Plain data length 152 */ 153 struct keymaster_sign_data_cmd { 154 keymaster_cmd_t cmd_id; 155 keymaster_rsa_sign_params_t sign_param; 156 qcom_km_key_blob_t key_blob; 157 uint32_t data; 158 size_t dlen; 159 }; 160 typedef struct keymaster_sign_data_cmd keymaster_sign_data_cmd_t; 161 162 /** 163 * Response to sign data response 164 * 165 * cmd_id : Command issue to secure app 166 * signed_data : signature 167 * sig_len : Signed data length 168 * status : Result (success 0, or failure -1) 169 */ 170 struct keymaster_sign_data_resp { 171 keymaster_cmd_t cmd_id; 172 uint8_t signed_data[KM_KEY_SIZE_MAX]; 173 size_t sig_len; 174 int32_t status; 175 }; 176 177 typedef struct keymaster_sign_data_resp keymaster_sign_data_resp_t; 178 179 /** 180 * Command to verify data using a key info generated before. This can use either 181 * an asymmetric key or a secret key. 182 * 183 * cmd_id : Command issue to secure app 184 * sign_param : 185 * key_blob : Key data information (in shared buffer) 186 * key_blob_len: Total key length 187 * signed_data : Pointer to signed data buffer 188 * signed_dlen : Signed data length 189 * signature : Offset to the signature data buffer (from signed data buffer) 190 * slen : Signature data length 191 */ 192 struct keymaster_verify_data_cmd { 193 keymaster_cmd_t cmd_id; 194 keymaster_rsa_sign_params_t sign_param; 195 qcom_km_key_blob_t key_blob; 196 uint32_t signed_data; 197 size_t signed_dlen; 198 uint32_t signature; 199 size_t slen; 200 }; 201 typedef struct keymaster_verify_data_cmd keymaster_verify_data_cmd_t; 202 /** 203 * Response to verify data 204 * 205 * cmd_id : Command issue to secure app 206 * status : Result (success 0, or failure -1) 207 */ 208 struct keymaster_verify_data_resp { 209 keymaster_cmd_t cmd_id; 210 int32_t status; 211 }; 212 typedef struct keymaster_verify_data_resp keymaster_verify_data_resp_t; 213 214 __END_DECLS 215 216 #endif // ANDROID_HARDWARE_QCOM_KEYMASTER_H 217
