1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef ANDROID_VOLD_KEYMASTER_H 18 #define ANDROID_VOLD_KEYMASTER_H 19 20 #ifdef __cplusplus 21 22 #include "KeyBuffer.h" 23 24 #include <memory> 25 #include <string> 26 #include <utility> 27 28 #include <android/hardware/keymaster/3.0/IKeymasterDevice.h> 29 #include <android-base/macros.h> 30 #include <keystore/authorization_set.h> 31 32 namespace android { 33 namespace vold { 34 using ::android::hardware::keymaster::V3_0::IKeymasterDevice; 35 using ::keystore::ErrorCode; 36 using ::keystore::KeyPurpose; 37 using ::keystore::AuthorizationSet; 38 39 // C++ wrappers to the Keymaster hidl interface. 40 // This is tailored to the needs of KeyStorage, but could be extended to be 41 // a more general interface. 42 43 // Wrapper for a Keymaster operation handle representing an 44 // ongoing Keymaster operation. Aborts the operation 45 // in the destructor if it is unfinished. Methods log failures 46 // to LOG(ERROR). 47 class KeymasterOperation { 48 public: 49 ~KeymasterOperation(); 50 // Is this instance valid? This is false if creation fails, and becomes 51 // false on finish or if an update fails. 52 explicit operator bool() { return mError == ErrorCode::OK; } 53 ErrorCode errorCode() { return mError; } 54 // Call "update" repeatedly until all of the input is consumed, and 55 // concatenate the output. Return true on success. 56 template <class TI, class TO> 57 bool updateCompletely(TI& input, TO* output) { 58 if (output) output->clear(); 59 return updateCompletely(input.data(), input.size(), [&](const char* b, size_t n) { 60 if (output) std::copy(b, b+n, std::back_inserter(*output)); 61 }); 62 } 63 64 // Finish and write the output to this string, unless pointer is null. 65 bool finish(std::string* output); 66 // Move constructor 67 KeymasterOperation(KeymasterOperation&& rhs) { 68 mDevice = std::move(rhs.mDevice); 69 mOpHandle = std::move(rhs.mOpHandle); 70 mError = std::move(rhs.mError); 71 } 72 // Construct an object in an error state for error returns 73 KeymasterOperation() 74 : mDevice{nullptr}, mOpHandle{0}, 75 mError {ErrorCode::UNKNOWN_ERROR} {} 76 // Move Assignment 77 KeymasterOperation& operator= (KeymasterOperation&& rhs) { 78 mDevice = std::move(rhs.mDevice); 79 mOpHandle = std::move(rhs.mOpHandle); 80 mError = std::move(rhs.mError); 81 rhs.mError = ErrorCode::UNKNOWN_ERROR; 82 rhs.mOpHandle = 0; 83 return *this; 84 } 85 86 private: 87 KeymasterOperation(const sp<IKeymasterDevice>& d, uint64_t h) 88 : mDevice{d}, mOpHandle{h}, mError {ErrorCode::OK} {} 89 KeymasterOperation(ErrorCode error) 90 : mDevice{nullptr}, mOpHandle{0}, 91 mError {error} {} 92 93 bool updateCompletely(const char* input, size_t inputLen, 94 const std::function<void(const char*, size_t)> consumer); 95 96 sp<IKeymasterDevice> mDevice; 97 uint64_t mOpHandle; 98 ErrorCode mError; 99 DISALLOW_COPY_AND_ASSIGN(KeymasterOperation); 100 friend class Keymaster; 101 }; 102 103 // Wrapper for a Keymaster device for methods that start a KeymasterOperation or are not 104 // part of one. 105 class Keymaster { 106 public: 107 Keymaster(); 108 // false if we failed to open the keymaster device. 109 explicit operator bool() { return mDevice.get() != nullptr; } 110 // Generate a key in the keymaster from the given params. 111 bool generateKey(const AuthorizationSet& inParams, std::string* key); 112 // If the keymaster supports it, permanently delete a key. 113 bool deleteKey(const std::string& key); 114 // Replace stored key blob in response to KM_ERROR_KEY_REQUIRES_UPGRADE. 115 bool upgradeKey(const std::string& oldKey, const AuthorizationSet& inParams, 116 std::string* newKey); 117 // Begin a new cryptographic operation, collecting output parameters if pointer is non-null 118 KeymasterOperation begin(KeyPurpose purpose, const std::string& key, 119 const AuthorizationSet& inParams, AuthorizationSet* outParams); 120 bool isSecure(); 121 122 private: 123 sp<hardware::keymaster::V3_0::IKeymasterDevice> mDevice; 124 DISALLOW_COPY_AND_ASSIGN(Keymaster); 125 }; 126 127 } // namespace vold 128 } // namespace android 129 130 #endif // __cplusplus 131 132 133 /* 134 * The following functions provide C bindings to keymaster services 135 * needed by cryptfs scrypt. The compatibility check checks whether 136 * the keymaster implementation is considered secure, i.e., TEE backed. 137 * The create_key function generates an RSA key for signing. 138 * The sign_object function signes an object with the given keymaster 139 * key. 140 */ 141 __BEGIN_DECLS 142 143 int keymaster_compatibility_cryptfs_scrypt(); 144 int keymaster_create_key_for_cryptfs_scrypt(uint32_t rsa_key_size, 145 uint64_t rsa_exponent, 146 uint32_t ratelimit, 147 uint8_t* key_buffer, 148 uint32_t key_buffer_size, 149 uint32_t* key_out_size); 150 151 int keymaster_sign_object_for_cryptfs_scrypt(const uint8_t* key_blob, 152 size_t key_blob_size, 153 uint32_t ratelimit, 154 const uint8_t* object, 155 const size_t object_size, 156 uint8_t** signature_buffer, 157 size_t* signature_buffer_size); 158 159 __END_DECLS 160 161 #endif 162
