Home | History | Annotate | Download | only in keymaster
      1 /*
      2  * Copyright 2015 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #ifndef SYSTEM_KEYMASTER_KEYMASTER1_ENGINE_H_
     18 #define SYSTEM_KEYMASTER_KEYMASTER1_ENGINE_H_
     19 
     20 #include <memory>
     21 
     22 #include <openssl/ec.h>
     23 #include <openssl/engine.h>
     24 #include <openssl/ex_data.h>
     25 #include <openssl/rsa.h>
     26 
     27 #include <hardware/keymaster1.h>
     28 #include <hardware/keymaster_defs.h>
     29 
     30 #include <keymaster/android_keymaster_utils.h>
     31 #include <keymaster/authorization_set.h>
     32 
     33 #include "openssl_utils.h"
     34 
     35 namespace keymaster {
     36 
     37 class Keymaster1Engine {
     38   public:
     39     /**
     40      * Create a Keymaster1Engine, wrapping the provided keymaster1_device.  The engine takes
     41      * ownership of the device, and will close it during destruction.
     42      */
     43     Keymaster1Engine(const keymaster1_device_t* keymaster1_device);
     44     ~Keymaster1Engine();
     45 
     46     keymaster_error_t GenerateKey(const AuthorizationSet& key_description,
     47                                   KeymasterKeyBlob* key_material, AuthorizationSet* hw_enforced,
     48                                   AuthorizationSet* sw_enforced) const;
     49 
     50     keymaster_error_t ImportKey(const AuthorizationSet& key_description,
     51                                 keymaster_key_format_t input_key_material_format,
     52                                 const KeymasterKeyBlob& input_key_material,
     53                                 KeymasterKeyBlob* output_key_blob, AuthorizationSet* hw_enforced,
     54                                 AuthorizationSet* sw_enforced) const;
     55     keymaster_error_t DeleteKey(const KeymasterKeyBlob& blob) const;
     56     keymaster_error_t DeleteAllKeys() const;
     57 
     58     struct KeyData {
     59         KeyData(const KeymasterKeyBlob& blob, const AuthorizationSet& params)
     60             : op_handle(0), begin_params(params), key_material(blob), error(KM_ERROR_OK),
     61               expected_openssl_padding(-1) {}
     62 
     63         keymaster_operation_handle_t op_handle;
     64         AuthorizationSet begin_params;
     65         AuthorizationSet finish_params;
     66         KeymasterKeyBlob key_material;
     67         keymaster_error_t error;
     68         int expected_openssl_padding;
     69     };
     70 
     71     RSA* BuildRsaKey(const KeymasterKeyBlob& blob, const AuthorizationSet& additional_params,
     72                      keymaster_error_t* error) const;
     73     EC_KEY* BuildEcKey(const KeymasterKeyBlob& blob, const AuthorizationSet& additional_params,
     74                        keymaster_error_t* error) const;
     75 
     76     KeyData* GetData(EVP_PKEY* key) const;
     77     KeyData* GetData(const RSA* rsa) const;
     78     KeyData* GetData(const EC_KEY* rsa) const;
     79 
     80     const keymaster1_device_t* device() const { return keymaster1_device_; }
     81 
     82     EVP_PKEY* GetKeymaster1PublicKey(const KeymasterKeyBlob& blob,
     83                                      const AuthorizationSet& additional_params,
     84                                      keymaster_error_t* error) const;
     85 
     86   private:
     87     Keymaster1Engine(const Keymaster1Engine&);  // Uncopyable
     88     void operator=(const Keymaster1Engine&);    // Unassignable
     89 
     90     RSA_METHOD BuildRsaMethod();
     91     ECDSA_METHOD BuildEcdsaMethod();
     92     void ConfigureEngineForRsa();
     93     void ConfigureEngineForEcdsa();
     94 
     95     keymaster_error_t Keymaster1Finish(const KeyData* key_data, const keymaster_blob_t& input,
     96                                        keymaster_blob_t* output);
     97 
     98     static int duplicate_key_data(CRYPTO_EX_DATA* to, const CRYPTO_EX_DATA* from, void** from_d,
     99                                   int index, long argl, void* argp);
    100     static void free_key_data(void* parent, void* ptr, CRYPTO_EX_DATA* data, int index, long argl,
    101                               void* argp);
    102 
    103     static int rsa_sign_raw(RSA* rsa, size_t* out_len, uint8_t* out, size_t max_out,
    104                             const uint8_t* in, size_t in_len, int padding);
    105     static int rsa_decrypt(RSA* rsa, size_t* out_len, uint8_t* out, size_t max_out,
    106                            const uint8_t* in, size_t in_len, int padding);
    107     static int ecdsa_sign(const uint8_t* digest, size_t digest_len, uint8_t* sig,
    108                           unsigned int* sig_len, EC_KEY* ec_key);
    109 
    110     const keymaster1_device_t* const keymaster1_device_;
    111     const std::unique_ptr<ENGINE, ENGINE_Delete> engine_;
    112     const int rsa_index_;
    113     const int ec_key_index_;
    114 
    115     const RSA_METHOD rsa_method_;
    116     const ECDSA_METHOD ecdsa_method_;
    117 
    118     static Keymaster1Engine* instance_;
    119 };
    120 
    121 }  // namespace keymaster
    122 
    123 #endif  // SYSTEM_KEYMASTER_KEYMASTER1_ENGINE_H_
    124