Home | History | Annotate | Download | only in keymaster
      1 /*
      2  * Copyright 2015 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #ifndef SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_
     18 #define SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_
     19 
     20 #include <memory>
     21 
     22 #include <openssl/ec.h>
     23 #include <openssl/engine.h>
     24 #include <openssl/ex_data.h>
     25 #include <openssl/rsa.h>
     26 
     27 #include <hardware/keymaster0.h>
     28 #include <hardware/keymaster_defs.h>
     29 
     30 namespace keymaster {
     31 
     32 struct KeymasterKeyBlob;
     33 
     34 /* Keymaster0Engine is a BoringSSL ENGINE that implements RSA by forwarding the requested
     35  * operations to a keymaster0 module. */
     36 class Keymaster0Engine {
     37   public:
     38     /**
     39      * Create a Keymaster0Engine, wrapping the provided keymaster0_device.  The engine takes
     40      * ownership of the device, and will close it during destruction.
     41      */
     42     Keymaster0Engine(const keymaster0_device_t* keymaster0_device);
     43     ~Keymaster0Engine();
     44 
     45     bool supports_ec() const { return supports_ec_; }
     46 
     47     bool GenerateRsaKey(uint64_t public_exponent, uint32_t public_modulus,
     48                         KeymasterKeyBlob* key_material) const;
     49     bool GenerateEcKey(uint32_t key_size, KeymasterKeyBlob* key_material) const;
     50 
     51     bool ImportKey(keymaster_key_format_t key_format, const KeymasterKeyBlob& to_import,
     52                    KeymasterKeyBlob* imported_key_material) const;
     53 
     54     RSA* BlobToRsaKey(const KeymasterKeyBlob& blob) const;
     55     EC_KEY* BlobToEcKey(const KeymasterKeyBlob& blob) const;
     56 
     57     const keymaster_key_blob_t* RsaKeyToBlob(const RSA* rsa) const;
     58     const keymaster_key_blob_t* EcKeyToBlob(const EC_KEY* rsa) const;
     59 
     60     EVP_PKEY* GetKeymaster0PublicKey(const KeymasterKeyBlob& blob) const;
     61 
     62   private:
     63     Keymaster0Engine(const Keymaster0Engine&);  // Uncopyable
     64     void operator=(const Keymaster0Engine&);    // Unassignable
     65 
     66     static int keyblob_dup(CRYPTO_EX_DATA* to, const CRYPTO_EX_DATA* from, void** from_d, int index,
     67                            long argl, void* argp);
     68     static void keyblob_free(void* parent, void* ptr, CRYPTO_EX_DATA* data, int index, long argl,
     69                              void* argp);
     70     static int rsa_private_transform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len);
     71     static int ecdsa_sign(const uint8_t* digest, size_t digest_len, uint8_t* sig,
     72                           unsigned int* sig_len, EC_KEY* ec_key);
     73 
     74     struct Malloc_Delete {
     75         void operator()(void* p) { free(p); }
     76     };
     77 
     78     bool Keymaster0Sign(const void* signing_params, const keymaster_key_blob_t& key_blob,
     79                         const uint8_t* data, const size_t data_length,
     80                         std::unique_ptr<uint8_t[], Malloc_Delete>* signature,
     81                         size_t* signature_length) const;
     82 
     83     int RsaPrivateTransform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len) const;
     84     int EcdsaSign(const uint8_t* digest, size_t digest_len, uint8_t* sig, unsigned int* sig_len,
     85                   EC_KEY* ec_key) const;
     86 
     87     const keymaster0_device_t* keymaster0_device_;
     88     ENGINE* const engine_;
     89     int rsa_index_, ec_key_index_;
     90     bool supports_ec_;
     91 
     92     static const RSA_METHOD rsa_method_;
     93     static const ECDSA_METHOD ecdsa_method_;
     94     static Keymaster0Engine* instance_;
     95 };
     96 
     97 }  // namespace keymaster
     98 
     99 #endif  // SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_
    100