1 /* 2 * Copyright 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef SYSTEM_KEYMASTER_SOFT_KEYMASTER_CONTEXT_H_ 18 #define SYSTEM_KEYMASTER_SOFT_KEYMASTER_CONTEXT_H_ 19 20 #include <memory> 21 #include <string> 22 23 #include <openssl/evp.h> 24 25 #include <hardware/keymaster0.h> 26 #include <hardware/keymaster1.h> 27 #include <keymaster/keymaster_context.h> 28 29 namespace keymaster { 30 31 class SoftKeymasterKeyRegistrations; 32 class Keymaster0Engine; 33 class Keymaster1Engine; 34 35 /** 36 * SoftKeymasterContext provides the context for a non-secure implementation of AndroidKeymaster. 37 */ 38 class SoftKeymasterContext : public KeymasterContext { 39 public: 40 SoftKeymasterContext(const std::string& root_of_trust = "SW"); 41 ~SoftKeymasterContext() override; 42 43 /** 44 * Use the specified HW keymaster0 device for the operations it supports. Takes ownership of 45 * the specified device (will call keymaster0_device->common.close()); 46 */ 47 keymaster_error_t SetHardwareDevice(keymaster0_device_t* keymaster0_device); 48 49 /** 50 * Use the specified HW keymaster1 device for performing undigested RSA and EC operations after 51 * digesting has been done in software. Takes ownership of the specified device (will call 52 * keymaster1_device->common.close()); 53 */ 54 keymaster_error_t SetHardwareDevice(keymaster1_device_t* keymaster1_device); 55 56 keymaster_security_level_t GetSecurityLevel() const override { 57 return KM_SECURITY_LEVEL_SOFTWARE; 58 } 59 60 keymaster_error_t SetSystemVersion(uint32_t os_version, uint32_t os_patchlevel) override; 61 void GetSystemVersion(uint32_t* os_version, uint32_t* os_patchlevel) const override; 62 63 KeyFactory* GetKeyFactory(keymaster_algorithm_t algorithm) const override; 64 OperationFactory* GetOperationFactory(keymaster_algorithm_t algorithm, 65 keymaster_purpose_t purpose) const override; 66 keymaster_algorithm_t* GetSupportedAlgorithms(size_t* algorithms_count) const override; 67 keymaster_error_t CreateKeyBlob(const AuthorizationSet& auths, keymaster_key_origin_t origin, 68 const KeymasterKeyBlob& key_material, KeymasterKeyBlob* blob, 69 AuthorizationSet* hw_enforced, 70 AuthorizationSet* sw_enforced) const override; 71 keymaster_error_t UpgradeKeyBlob(const KeymasterKeyBlob& key_to_upgrade, 72 const AuthorizationSet& upgrade_params, 73 KeymasterKeyBlob* upgraded_key) const override; 74 keymaster_error_t ParseKeyBlob(const KeymasterKeyBlob& blob, 75 const AuthorizationSet& additional_params, 76 KeymasterKeyBlob* key_material, AuthorizationSet* hw_enforced, 77 AuthorizationSet* sw_enforced) const override; 78 keymaster_error_t DeleteKey(const KeymasterKeyBlob& blob) const override; 79 keymaster_error_t DeleteAllKeys() const override; 80 keymaster_error_t AddRngEntropy(const uint8_t* buf, size_t length) const override; 81 keymaster_error_t GenerateRandom(uint8_t* buf, size_t length) const override; 82 83 EVP_PKEY* AttestationKey(keymaster_algorithm_t algorithm, 84 keymaster_error_t* error) const override; 85 keymaster_cert_chain_t* AttestationChain(keymaster_algorithm_t algorithm, 86 keymaster_error_t* error) const override; 87 keymaster_error_t GenerateUniqueId(uint64_t creation_date_time, 88 const keymaster_blob_t& application_id, 89 bool reset_since_rotation, Buffer* unique_id) const override; 90 91 KeymasterEnforcement* enforcement_policy() override { 92 // SoftKeymaster does no enforcement; it's all done by Keystore. 93 return nullptr; 94 } 95 96 void AddSystemVersionToSet(AuthorizationSet* auth_set) const; 97 98 private: 99 keymaster_error_t ParseOldSoftkeymasterBlob(const KeymasterKeyBlob& blob, 100 KeymasterKeyBlob* key_material, 101 AuthorizationSet* hw_enforced, 102 AuthorizationSet* sw_enforced) const; 103 keymaster_error_t ParseKeymaster1HwBlob(const KeymasterKeyBlob& blob, 104 const AuthorizationSet& additional_params, 105 KeymasterKeyBlob* key_material, 106 AuthorizationSet* hw_enforced, 107 AuthorizationSet* sw_enforced) const; 108 keymaster_error_t ParseKeymaster0HwBlob(const KeymasterKeyBlob& blob, 109 KeymasterKeyBlob* key_material, 110 AuthorizationSet* hw_enforced, 111 AuthorizationSet* sw_enforced) const; 112 keymaster_error_t FakeKeyAuthorizations(EVP_PKEY* pubkey, AuthorizationSet* hw_enforced, 113 AuthorizationSet* sw_enforced) const; 114 keymaster_error_t BuildHiddenAuthorizations(const AuthorizationSet& input_set, 115 AuthorizationSet* hidden) const; 116 117 std::unique_ptr<Keymaster0Engine> km0_engine_; 118 std::unique_ptr<Keymaster1Engine> km1_engine_; 119 std::unique_ptr<KeyFactory> rsa_factory_; 120 std::unique_ptr<KeyFactory> ec_factory_; 121 std::unique_ptr<KeyFactory> aes_factory_; 122 std::unique_ptr<KeyFactory> hmac_factory_; 123 keymaster1_device* km1_dev_; 124 const std::string root_of_trust_; 125 uint32_t os_version_; 126 uint32_t os_patchlevel_; 127 }; 128 129 } // namespace keymaster 130 131 #endif // SYSTEM_KEYMASTER_SOFT_KEYMASTER_CONTEXT_H_ 132
