Home | History | Annotate | Download | only in keymaster 
      1 /*
      2  * Copyright (C) 2015 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 package android.security.keymaster;
     18 
     19 import java.util.HashMap;
     20 import java.util.Map;
     21 
     22 /**
     23  * Class tracking all the keymaster enum values needed for the binder API to keystore.
     24  * This must be kept in sync with hardware/libhardware/include/hardware/keymaster_defs.h
     25  * See keymaster_defs.h for detailed descriptions of each constant.
     26  * @hide
     27  */
     28 public final class KeymasterDefs {
     29 
     30     private KeymasterDefs() {}
     31 
     32     // Tag types.
     33     public static final int KM_INVALID = 0 << 28;
     34     public static final int KM_ENUM = 1 << 28;
     35     public static final int KM_ENUM_REP = 2 << 28;
     36     public static final int KM_UINT = 3 << 28;
     37     public static final int KM_UINT_REP = 4 << 28;
     38     public static final int KM_ULONG = 5 << 28;
     39     public static final int KM_DATE = 6 << 28;
     40     public static final int KM_BOOL = 7 << 28;
     41     public static final int KM_BIGNUM = 8 << 28;
     42     public static final int KM_BYTES = 9 << 28;
     43     public static final int KM_ULONG_REP = 10 << 28;
     44 
     45     // Tag values.
     46     public static final int KM_TAG_INVALID = KM_INVALID | 0;
     47     public static final int KM_TAG_PURPOSE = KM_ENUM_REP | 1;
     48     public static final int KM_TAG_ALGORITHM = KM_ENUM | 2;
     49     public static final int KM_TAG_KEY_SIZE = KM_UINT | 3;
     50     public static final int KM_TAG_BLOCK_MODE = KM_ENUM_REP | 4;
     51     public static final int KM_TAG_DIGEST = KM_ENUM_REP | 5;
     52     public static final int KM_TAG_PADDING = KM_ENUM_REP | 6;
     53     public static final int KM_TAG_CALLER_NONCE = KM_BOOL | 7;
     54     public static final int KM_TAG_MIN_MAC_LENGTH = KM_UINT | 8;
     55 
     56     public static final int KM_TAG_RESCOPING_ADD = KM_ENUM_REP | 101;
     57     public static final int KM_TAG_RESCOPING_DEL = KM_ENUM_REP | 102;
     58     public static final int KM_TAG_BLOB_USAGE_REQUIREMENTS = KM_ENUM | 705;
     59 
     60     public static final int KM_TAG_RSA_PUBLIC_EXPONENT = KM_ULONG | 200;
     61     public static final int KM_TAG_ACTIVE_DATETIME = KM_DATE | 400;
     62     public static final int KM_TAG_ORIGINATION_EXPIRE_DATETIME = KM_DATE | 401;
     63     public static final int KM_TAG_USAGE_EXPIRE_DATETIME = KM_DATE | 402;
     64     public static final int KM_TAG_MIN_SECONDS_BETWEEN_OPS = KM_UINT | 403;
     65     public static final int KM_TAG_MAX_USES_PER_BOOT = KM_UINT | 404;
     66 
     67     public static final int KM_TAG_ALL_USERS = KM_BOOL | 500;
     68     public static final int KM_TAG_USER_ID = KM_UINT | 501;
     69     public static final int KM_TAG_USER_SECURE_ID = KM_ULONG_REP | 502;
     70     public static final int KM_TAG_NO_AUTH_REQUIRED = KM_BOOL | 503;
     71     public static final int KM_TAG_USER_AUTH_TYPE = KM_ENUM | 504;
     72     public static final int KM_TAG_AUTH_TIMEOUT = KM_UINT | 505;
     73 
     74     public static final int KM_TAG_ALL_APPLICATIONS = KM_BOOL | 600;
     75     public static final int KM_TAG_APPLICATION_ID = KM_BYTES | 601;
     76 
     77     public static final int KM_TAG_APPLICATION_DATA = KM_BYTES | 700;
     78     public static final int KM_TAG_CREATION_DATETIME = KM_DATE | 701;
     79     public static final int KM_TAG_ORIGIN = KM_ENUM | 702;
     80     public static final int KM_TAG_ROLLBACK_RESISTANT = KM_BOOL | 703;
     81     public static final int KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704;
     82 
     83     public static final int KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000;
     84     public static final int KM_TAG_NONCE = KM_BYTES | 1001;
     85     public static final int KM_TAG_AUTH_TOKEN = KM_BYTES | 1002;
     86     public static final int KM_TAG_MAC_LENGTH = KM_UINT | 1003;
     87 
     88     // Algorithm values.
     89     public static final int KM_ALGORITHM_RSA = 1;
     90     public static final int KM_ALGORITHM_EC = 3;
     91     public static final int KM_ALGORITHM_AES = 32;
     92     public static final int KM_ALGORITHM_HMAC = 128;
     93 
     94     // Block modes.
     95     public static final int KM_MODE_ECB = 1;
     96     public static final int KM_MODE_CBC = 2;
     97     public static final int KM_MODE_CTR = 3;
     98     public static final int KM_MODE_GCM = 32;
     99 
    100     // Padding modes.
    101     public static final int KM_PAD_NONE = 1;
    102     public static final int KM_PAD_RSA_OAEP = 2;
    103     public static final int KM_PAD_RSA_PSS = 3;
    104     public static final int KM_PAD_RSA_PKCS1_1_5_ENCRYPT = 4;
    105     public static final int KM_PAD_RSA_PKCS1_1_5_SIGN = 5;
    106     public static final int KM_PAD_PKCS7 = 64;
    107 
    108     // Digest modes.
    109     public static final int KM_DIGEST_NONE = 0;
    110     public static final int KM_DIGEST_MD5 = 1;
    111     public static final int KM_DIGEST_SHA1 = 2;
    112     public static final int KM_DIGEST_SHA_2_224 = 3;
    113     public static final int KM_DIGEST_SHA_2_256 = 4;
    114     public static final int KM_DIGEST_SHA_2_384 = 5;
    115     public static final int KM_DIGEST_SHA_2_512 = 6;
    116 
    117     // Key origins.
    118     public static final int KM_ORIGIN_GENERATED = 0;
    119     public static final int KM_ORIGIN_IMPORTED = 2;
    120     public static final int KM_ORIGIN_UNKNOWN = 3;
    121 
    122     // Key usability requirements.
    123     public static final int KM_BLOB_STANDALONE = 0;
    124     public static final int KM_BLOB_REQUIRES_FILE_SYSTEM = 1;
    125 
    126     // Operation Purposes.
    127     public static final int KM_PURPOSE_ENCRYPT = 0;
    128     public static final int KM_PURPOSE_DECRYPT = 1;
    129     public static final int KM_PURPOSE_SIGN = 2;
    130     public static final int KM_PURPOSE_VERIFY = 3;
    131 
    132     // Key formats.
    133     public static final int KM_KEY_FORMAT_X509 = 0;
    134     public static final int KM_KEY_FORMAT_PKCS8 = 1;
    135     public static final int KM_KEY_FORMAT_RAW = 3;
    136 
    137     // User authenticators.
    138     public static final int HW_AUTH_PASSWORD = 1 << 0;
    139     public static final int HW_AUTH_FINGERPRINT = 1 << 1;
    140 
    141     // Error codes.
    142     public static final int KM_ERROR_OK = 0;
    143     public static final int KM_ERROR_ROOT_OF_TRUST_ALREADY_SET = -1;
    144     public static final int KM_ERROR_UNSUPPORTED_PURPOSE = -2;
    145     public static final int KM_ERROR_INCOMPATIBLE_PURPOSE = -3;
    146     public static final int KM_ERROR_UNSUPPORTED_ALGORITHM = -4;
    147     public static final int KM_ERROR_INCOMPATIBLE_ALGORITHM = -5;
    148     public static final int KM_ERROR_UNSUPPORTED_KEY_SIZE = -6;
    149     public static final int KM_ERROR_UNSUPPORTED_BLOCK_MODE = -7;
    150     public static final int KM_ERROR_INCOMPATIBLE_BLOCK_MODE = -8;
    151     public static final int KM_ERROR_UNSUPPORTED_MAC_LENGTH = -9;
    152     public static final int KM_ERROR_UNSUPPORTED_PADDING_MODE = -10;
    153     public static final int KM_ERROR_INCOMPATIBLE_PADDING_MODE = -11;
    154     public static final int KM_ERROR_UNSUPPORTED_DIGEST = -12;
    155     public static final int KM_ERROR_INCOMPATIBLE_DIGEST = -13;
    156     public static final int KM_ERROR_INVALID_EXPIRATION_TIME = -14;
    157     public static final int KM_ERROR_INVALID_USER_ID = -15;
    158     public static final int KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT = -16;
    159     public static final int KM_ERROR_UNSUPPORTED_KEY_FORMAT = -17;
    160     public static final int KM_ERROR_INCOMPATIBLE_KEY_FORMAT = -18;
    161     public static final int KM_ERROR_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = -19;
    162     public static final int KM_ERROR_UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = -20;
    163     public static final int KM_ERROR_INVALID_INPUT_LENGTH = -21;
    164     public static final int KM_ERROR_KEY_EXPORT_OPTIONS_INVALID = -22;
    165     public static final int KM_ERROR_DELEGATION_NOT_ALLOWED = -23;
    166     public static final int KM_ERROR_KEY_NOT_YET_VALID = -24;
    167     public static final int KM_ERROR_KEY_EXPIRED = -25;
    168     public static final int KM_ERROR_KEY_USER_NOT_AUTHENTICATED = -26;
    169     public static final int KM_ERROR_OUTPUT_PARAMETER_NULL = -27;
    170     public static final int KM_ERROR_INVALID_OPERATION_HANDLE = -28;
    171     public static final int KM_ERROR_INSUFFICIENT_BUFFER_SPACE = -29;
    172     public static final int KM_ERROR_VERIFICATION_FAILED = -30;
    173     public static final int KM_ERROR_TOO_MANY_OPERATIONS = -31;
    174     public static final int KM_ERROR_UNEXPECTED_NULL_POINTER = -32;
    175     public static final int KM_ERROR_INVALID_KEY_BLOB = -33;
    176     public static final int KM_ERROR_IMPORTED_KEY_NOT_ENCRYPTED = -34;
    177     public static final int KM_ERROR_IMPORTED_KEY_DECRYPTION_FAILED = -35;
    178     public static final int KM_ERROR_IMPORTED_KEY_NOT_SIGNED = -36;
    179     public static final int KM_ERROR_IMPORTED_KEY_VERIFICATION_FAILED = -37;
    180     public static final int KM_ERROR_INVALID_ARGUMENT = -38;
    181     public static final int KM_ERROR_UNSUPPORTED_TAG = -39;
    182     public static final int KM_ERROR_INVALID_TAG = -40;
    183     public static final int KM_ERROR_MEMORY_ALLOCATION_FAILED = -41;
    184     public static final int KM_ERROR_INVALID_RESCOPING = -42;
    185     public static final int KM_ERROR_IMPORT_PARAMETER_MISMATCH = -44;
    186     public static final int KM_ERROR_SECURE_HW_ACCESS_DENIED = -45;
    187     public static final int KM_ERROR_OPERATION_CANCELLED = -46;
    188     public static final int KM_ERROR_CONCURRENT_ACCESS_CONFLICT = -47;
    189     public static final int KM_ERROR_SECURE_HW_BUSY = -48;
    190     public static final int KM_ERROR_SECURE_HW_COMMUNICATION_FAILED = -49;
    191     public static final int KM_ERROR_UNSUPPORTED_EC_FIELD = -50;
    192     public static final int KM_ERROR_MISSING_NONCE = -51;
    193     public static final int KM_ERROR_INVALID_NONCE = -52;
    194     public static final int KM_ERROR_MISSING_MAC_LENGTH = -53;
    195     public static final int KM_ERROR_KEY_RATE_LIMIT_EXCEEDED = -54;
    196     public static final int KM_ERROR_CALLER_NONCE_PROHIBITED = -55;
    197     public static final int KM_ERROR_KEY_MAX_OPS_EXCEEDED = -56;
    198     public static final int KM_ERROR_INVALID_MAC_LENGTH = -57;
    199     public static final int KM_ERROR_MISSING_MIN_MAC_LENGTH = -58;
    200     public static final int KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH = -59;
    201     public static final int KM_ERROR_UNIMPLEMENTED = -100;
    202     public static final int KM_ERROR_VERSION_MISMATCH = -101;
    203     public static final int KM_ERROR_UNKNOWN_ERROR = -1000;
    204 
    205     public static final Map<Integer, String> sErrorCodeToString = new HashMap<Integer, String>();
    206     static {
    207         sErrorCodeToString.put(KM_ERROR_OK, "OK");
    208         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_PURPOSE, "Unsupported purpose");
    209         sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_PURPOSE, "Incompatible purpose");
    210         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_ALGORITHM, "Unsupported algorithm");
    211         sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_ALGORITHM, "Incompatible algorithm");
    212         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_KEY_SIZE, "Unsupported key size");
    213         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_BLOCK_MODE, "Unsupported block mode");
    214         sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_BLOCK_MODE, "Incompatible block mode");
    215         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_MAC_LENGTH,
    216                 "Unsupported MAC or authentication tag length");
    217         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_PADDING_MODE, "Unsupported padding mode");
    218         sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_PADDING_MODE, "Incompatible padding mode");
    219         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_DIGEST, "Unsupported digest");
    220         sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_DIGEST, "Incompatible digest");
    221         sErrorCodeToString.put(KM_ERROR_INVALID_EXPIRATION_TIME, "Invalid expiration time");
    222         sErrorCodeToString.put(KM_ERROR_INVALID_USER_ID, "Invalid user ID");
    223         sErrorCodeToString.put(KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT,
    224                 "Invalid user authorization timeout");
    225         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_KEY_FORMAT, "Unsupported key format");
    226         sErrorCodeToString.put(KM_ERROR_INCOMPATIBLE_KEY_FORMAT, "Incompatible key format");
    227         sErrorCodeToString.put(KM_ERROR_INVALID_INPUT_LENGTH, "Invalid input length");
    228         sErrorCodeToString.put(KM_ERROR_KEY_NOT_YET_VALID, "Key not yet valid");
    229         sErrorCodeToString.put(KM_ERROR_KEY_EXPIRED, "Key expired");
    230         sErrorCodeToString.put(KM_ERROR_KEY_USER_NOT_AUTHENTICATED, "Key user not authenticated");
    231         sErrorCodeToString.put(KM_ERROR_INVALID_OPERATION_HANDLE, "Invalid operation handle");
    232         sErrorCodeToString.put(KM_ERROR_VERIFICATION_FAILED, "Signature/MAC verification failed");
    233         sErrorCodeToString.put(KM_ERROR_TOO_MANY_OPERATIONS, "Too many operations");
    234         sErrorCodeToString.put(KM_ERROR_INVALID_KEY_BLOB, "Invalid key blob");
    235         sErrorCodeToString.put(KM_ERROR_INVALID_ARGUMENT, "Invalid argument");
    236         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_TAG, "Unsupported tag");
    237         sErrorCodeToString.put(KM_ERROR_INVALID_TAG, "Invalid tag");
    238         sErrorCodeToString.put(KM_ERROR_MEMORY_ALLOCATION_FAILED, "Memory allocation failed");
    239         sErrorCodeToString.put(KM_ERROR_UNSUPPORTED_EC_FIELD, "Unsupported EC field");
    240         sErrorCodeToString.put(KM_ERROR_MISSING_NONCE, "Required IV missing");
    241         sErrorCodeToString.put(KM_ERROR_INVALID_NONCE, "Invalid IV");
    242         sErrorCodeToString.put(KM_ERROR_CALLER_NONCE_PROHIBITED,
    243                 "Caller-provided IV not permitted");
    244         sErrorCodeToString.put(KM_ERROR_INVALID_MAC_LENGTH,
    245                 "Invalid MAC or authentication tag length");
    246         sErrorCodeToString.put(KM_ERROR_UNIMPLEMENTED, "Not implemented");
    247         sErrorCodeToString.put(KM_ERROR_UNKNOWN_ERROR, "Unknown error");
    248     }
    249 
    250     public static int getTagType(int tag) {
    251         return tag & (0xF << 28);
    252     }
    253 
    254     public static String getErrorMessage(int errorCode) {
    255         String result = sErrorCodeToString.get(errorCode);
    256         if (result != null) {
    257             return result;
    258         }
    259         return String.valueOf(errorCode);
    260     }
    261 }
    262