| /* |
| * Copyright (C) 2024 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| //! Implementation of the `IOpaqueKey` AIDL interface. It is used as a handle to key material |
| |
| use alloc::collections::btree_map::BTreeMap; |
| use android_hardware_security_see_hwcrypto::aidl::android::hardware::security::see::hwcrypto::types::{ |
| AesCipherMode::AesCipherMode, KeyLifetime::KeyLifetime, KeyPermissions::KeyPermissions, |
| KeyType::KeyType, KeyUse::KeyUse, OpaqueKeyToken::OpaqueKeyToken, OperationType::OperationType, |
| ProtectionId::ProtectionId, SymmetricCryptoParameters::SymmetricCryptoParameters, |
| SymmetricOperation::SymmetricOperation, |
| }; |
| use android_hardware_security_see_hwcrypto::aidl::android::hardware::security::see::hwcrypto::{ |
| IHwCryptoKey::{ |
| DeviceKeyId::DeviceKeyId, DiceBoundDerivationKey::DiceBoundDerivationKey, |
| DiceBoundKeyResult::DiceBoundKeyResult, |
| }, |
| IOpaqueKey::{BnOpaqueKey, IOpaqueKey}, |
| KeyPolicy::KeyPolicy, |
| }; |
| use android_hardware_security_see_hwcrypto::binder; |
| use binder::binder_impl::Binder; |
| use ciborium::Value; |
| use core::fmt; |
| use coset::{AsCborValue, CborSerializable, CoseError}; |
| use hwcryptohal_common::{ |
| aidl_enum_wrapper, cose_enum_gen, |
| err::HwCryptoError, |
| hwcrypto_err, |
| policy::{ |
| self, cbor_policy_to_aidl, cbor_serialize_key_policy, KeyLifetimeSerializable, |
| KeyTypeSerializable, KeyUseSerializable, |
| }, |
| }; |
| use kmr_common::{ |
| crypto::{self, Aes, CurveType, Hkdf, Hmac, KeyMaterial, OpaqueOr, Rng}, |
| explicit, FallibleAllocExt, |
| }; |
| use kmr_wire::{keymint::EcCurve, AsCborValue as _}; |
| use std::sync::{Mutex, OnceLock}; |
| use tipc::Uuid; |
| |
| use crate::crypto_provider; |
| use crate::helpers; |
| use crate::hwcrypto_device_key::HwCryptoKey; |
| use crate::service_encryption_key::{EncryptedContent, EncryptionHeader, EncryptionHeaderKey}; |
| |
| /// Number of bytes of unique value used to check if a key was created on current HWCrypto boot. |
| const UNIQUE_VALUE_SIZEOF: usize = 32; |
| |
| const SEALING_KEY_DERIVATION_HMAC_256_CTX: &[u8] = b"SEALING_KEY_DERIVATION_HMAC_256_CTX"; |
| |
| const HW_CRYPTO_WRAP_KEY_HMAC_256_CTX: &[u8] = b"HW_CRYPTO_WRAP_KEY_HMAC_256_CTX"; |
| |
| /// Struct to wrap boot unique counter. It is used to tag objects to the current boot. |
| #[derive(Clone)] |
| struct BootUniqueValue([u8; UNIQUE_VALUE_SIZEOF]); |
| |
| impl fmt::Debug for BootUniqueValue { |
| fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { |
| write!(f, "[BootUniqueValue size: {}; data redacted]", UNIQUE_VALUE_SIZEOF) |
| } |
| } |
| |
| impl PartialEq for BootUniqueValue { |
| fn eq(&self, other: &Self) -> bool { |
| openssl::memcmp::eq(&self.0, &other.0) |
| } |
| } |
| |
| impl Eq for BootUniqueValue {} |
| |
| impl BootUniqueValue { |
| fn new() -> Result<BootUniqueValue, HwCryptoError> { |
| get_boot_unique_value() |
| } |
| } |
| |
| // Boot unique value is lazily initialized on the first call to retrieve it |
| static BOOT_UNIQUE_VALUE: OnceLock<BootUniqueValue> = OnceLock::new(); |
| |
| /// Retrieves boot unique value used to check if the key material was created on this boot. It |
| /// lazily initializes it. |
| fn get_boot_unique_value() -> Result<BootUniqueValue, HwCryptoError> { |
| // The function returns a `Result` even if it is currently infallible to allow replacing its |
| // current implementation with one that can fail when trying to retrieve a random number. |
| // If the RNG changes to a fallible one we could use `get_or_try_init`. |
| let boot_unique_value = BOOT_UNIQUE_VALUE.get_or_init(|| { |
| let mut rng = crypto_provider::RngImpl::default(); |
| let mut new_boot_unique_value = BootUniqueValue([0u8; UNIQUE_VALUE_SIZEOF]); |
| rng.fill_bytes(&mut new_boot_unique_value.0[..]); |
| new_boot_unique_value |
| }); |
| Ok(boot_unique_value.clone()) |
| } |
| |
| #[derive(Copy, Clone)] |
| pub(crate) enum HkdfOperationType { |
| DiceBoundDerivation = 1, |
| ClearKeyDerivation = 3, |
| OpaqueKeyDerivation = 4, |
| InternalSealingKeyDerivation = 5, |
| } |
| |
| pub(crate) struct DerivationContext { |
| context_components: Vec<Value>, |
| } |
| |
| impl DerivationContext { |
| pub(crate) fn new(op_type: HkdfOperationType) -> Result<Self, HwCryptoError> { |
| let mut context_components = Vec::new(); |
| context_components.try_reserve(1)?; |
| context_components.push(Value::Integer((op_type as u8).into())); |
| Ok(Self { context_components }) |
| } |
| |
| pub(crate) fn add_binary_string(&mut self, binary_string: &[u8]) -> Result<(), HwCryptoError> { |
| self.context_components.try_reserve(1)?; |
| let mut context = Vec::new(); |
| context.try_reserve(binary_string.len())?; |
| context.extend_from_slice(binary_string); |
| self.context_components.push(Value::Bytes(context)); |
| Ok(()) |
| } |
| |
| pub(crate) fn add_owned_binary_string( |
| &mut self, |
| binary_string: Vec<u8>, |
| ) -> Result<(), HwCryptoError> { |
| self.context_components.try_reserve(1)?; |
| self.context_components.push(Value::Bytes(binary_string)); |
| Ok(()) |
| } |
| |
| pub(crate) fn add_unsigned_integer(&mut self, value: u64) -> Result<(), HwCryptoError> { |
| self.context_components.try_reserve(1)?; |
| self.context_components.push(Value::Integer(value.into())); |
| Ok(()) |
| } |
| |
| pub(crate) fn create_key_derivation_context(self) -> Result<Vec<u8>, HwCryptoError> { |
| let context = Value::Array(self.context_components); |
| Ok(context.to_vec()?) |
| } |
| } |
| |
| #[derive(Debug)] |
| struct KeyHeaderPolicy { |
| key_lifetime: KeyLifetimeSerializable, |
| key_permissions: Vec<KeyPermissions>, |
| key_usage: KeyUseSerializable, |
| key_type: KeyTypeSerializable, |
| management_key: bool, |
| } |
| |
| impl KeyHeaderPolicy { |
| fn new(policy: &KeyPolicy) -> Result<Self, HwCryptoError> { |
| let mut key_permissions = Vec::new(); |
| key_permissions.try_extend_from_slice(&policy.keyPermissions[..])?; |
| Ok(Self { |
| key_lifetime: KeyLifetimeSerializable(policy.keyLifetime), |
| key_permissions, |
| key_usage: KeyUseSerializable(policy.usage), |
| key_type: KeyTypeSerializable(policy.keyType), |
| management_key: policy.keyManagementKey, |
| }) |
| } |
| |
| fn get_policy(&self) -> Result<KeyPolicy, HwCryptoError> { |
| let mut key_permissions = Vec::new(); |
| key_permissions.try_extend_from_slice(&self.key_permissions[..])?; |
| Ok(KeyPolicy { |
| usage: self.key_usage.0, |
| keyLifetime: self.key_lifetime.0, |
| keyPermissions: key_permissions, |
| keyType: self.key_type.0, |
| keyManagementKey: self.management_key, |
| }) |
| } |
| |
| fn try_clone(&self) -> Result<Self, HwCryptoError> { |
| let mut key_permissions = Vec::new(); |
| key_permissions.try_extend_from_slice(&self.key_permissions[..])?; |
| Ok(Self { |
| key_lifetime: self.key_lifetime, |
| key_permissions, |
| key_usage: self.key_usage, |
| key_type: self.key_type, |
| management_key: self.management_key, |
| }) |
| } |
| } |
| |
| fn check_protection_id_settings( |
| protection_id: &ProtectionIdSerializable, |
| settings: &ProtectionSetting, |
| ) -> Result<bool, HwCryptoError> { |
| match protection_id.0 { |
| ProtectionId::WIDEVINE_OUTPUT_BUFFER => { |
| // For Widevine buffers we cannot create a key that can read into this area |
| Ok(!settings.read_protection) |
| } |
| _ => Err(hwcrypto_err!(BAD_PARAMETER, "unsupported protection_id {:?}", protection_id,)), |
| } |
| } |
| |
| #[derive(Debug)] |
| struct KeyHeaderMetadata { |
| expiration_time: Option<u64>, |
| protection_id_settings: BTreeMap<ProtectionIdSerializable, ProtectionSetting>, |
| } |
| |
| impl KeyHeaderMetadata { |
| fn new() -> Self { |
| Self { expiration_time: None, protection_id_settings: BTreeMap::new() } |
| } |
| |
| // While the current metadata definition wouldn't fail on this operation, we are doing this |
| // division to add an element to metadata that could fail while ying to clone |
| fn try_clone(&self) -> Result<Self, HwCryptoError> { |
| let mut protection_id_settings = BTreeMap::new(); |
| protection_id_settings.extend(self.protection_id_settings.iter()); |
| Ok(Self { expiration_time: None, protection_id_settings }) |
| } |
| |
| fn add_protection_id( |
| &mut self, |
| protection_id: ProtectionId, |
| allowed_operations: &[OperationType], |
| ) -> Result<(), HwCryptoError> { |
| if allowed_operations.is_empty() { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "didn't receive any allowed operations for add_protection_id", |
| )); |
| } |
| let protection_id = ProtectionIdSerializable::try_from(protection_id)?; |
| if !self.protection_id_settings.contains_key(&protection_id) { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "settings for protection id {:?} have already been set", |
| protection_id |
| )); |
| } |
| let mut protection_setting = |
| ProtectionSetting { write_protection: false, read_protection: false }; |
| for operation in allowed_operations { |
| match *operation { |
| OperationType::READ => protection_setting.read_protection = true, |
| OperationType::WRITE => protection_setting.write_protection = true, |
| _ => { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "received unsupported OperationType {:?}", |
| operation |
| )) |
| } |
| } |
| } |
| if !check_protection_id_settings(&protection_id, &protection_setting)? { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "unsupported setting for permissions {:?}: {:?}", |
| protection_id, |
| protection_setting |
| )); |
| } |
| self.protection_id_settings.insert(protection_id, protection_setting); |
| Ok(()) |
| } |
| |
| fn get_metadata_as_cbor(&self) -> Result<Value, HwCryptoError> { |
| let mut cbor_map = Vec::<(Value, Value)>::new(); |
| cbor_map.try_reserve(2)?; |
| |
| // Adding expiration time |
| let expiration_time_value = if let Some(expiration_time) = self.expiration_time { |
| Value::Integer(expiration_time.into()) |
| } else { |
| Value::Null |
| }; |
| let key = Value::Integer((KeyMetadataCoseLabels::KeyExpirationPeriod as i64).into()); |
| cbor_map.push((key, expiration_time_value)); |
| |
| // Adding protection IDs |
| let mut protection_id_cbor_map = Vec::<(Value, Value)>::new(); |
| protection_id_cbor_map.try_reserve(self.protection_id_settings.len())?; |
| for (protection_id, protection_id_setting) in &self.protection_id_settings { |
| let protection_id_key = ciborium::Value::Integer((*protection_id).into()); |
| protection_id_cbor_map.push(( |
| protection_id_key, |
| protection_id_setting.to_cbor_value().map_err(|_| { |
| hwcrypto_err!( |
| BAD_PARAMETER, |
| "couldn't get cbor representation of protection id setting" |
| ) |
| })?, |
| )) |
| } |
| let key = Value::Integer((KeyMetadataCoseLabels::ProtectionIdSettings as i64).into()); |
| cbor_map.push((key, ciborium::Value::Map(protection_id_cbor_map))); |
| Ok(Value::Map(cbor_map)) |
| } |
| |
| fn set_metadata_from_cbor(&mut self, metadata_as_cbor: Value) -> Result<(), HwCryptoError> { |
| let metadata = metadata_as_cbor |
| .into_map() |
| .map_err(|_| hwcrypto_err!(BAD_PARAMETER, "received cbor wasn't a map"))?; |
| |
| let mut protection_id_settings: Option< |
| BTreeMap<ProtectionIdSerializable, ProtectionSetting>, |
| > = None; |
| let mut expiration_time: Option<Option<u64>> = None; |
| |
| for (map_key, map_val) in metadata { |
| let key = map_key |
| .into_integer() |
| .map_err(|_| hwcrypto_err!(BAD_PARAMETER, "received map key wasn't an integer"))?; |
| match key.try_into()? { |
| KeyMetadataCoseLabels::KeyExpirationPeriod => { |
| expiration_time = if map_val.is_null() { |
| Some(None) |
| } else { |
| let value = map_val |
| .into_integer() |
| .map_err(|_| { |
| hwcrypto_err!(BAD_PARAMETER, "protection id key wasn't an integer") |
| })? |
| .try_into() |
| .map_err(|_| { |
| hwcrypto_err!(BAD_PARAMETER, "couldn't decode expiration time") |
| })?; |
| Some(Some(value)) |
| } |
| } |
| KeyMetadataCoseLabels::ProtectionIdSettings => { |
| let mut settings = BTreeMap::new(); |
| for (protection_id, protection_setting) in map_val |
| .into_map() |
| .map_err(|_| hwcrypto_err!(BAD_PARAMETER, "received cbor wasn't a map"))? |
| { |
| //settings.try_reserve(1).map_err(|_| CoseError::EncodeFailed)?; |
| let protection_id: ProtectionIdSerializable = protection_id |
| .into_integer() |
| .map_err(|_| { |
| hwcrypto_err!(BAD_PARAMETER, "protection id key wasn't an integer") |
| })? |
| .try_into() |
| .map_err(|_| { |
| hwcrypto_err!(BAD_PARAMETER, "couldn't decode protection ID") |
| })?; |
| let protection_setting = |
| ProtectionSetting::from_cbor_value(protection_setting)?; |
| if settings.contains_key(&protection_id) { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "received duplicated protection ID entry" |
| )); |
| } |
| settings.insert(protection_id, protection_setting); |
| } |
| protection_id_settings = Some(settings); |
| } |
| } |
| } |
| self.expiration_time = expiration_time |
| .ok_or(hwcrypto_err!(BAD_PARAMETER, "didn't find expiration time on metadata"))?; |
| self.protection_id_settings = protection_id_settings.ok_or(hwcrypto_err!( |
| BAD_PARAMETER, |
| "didn't find protection_ id settings on metadata" |
| ))?; |
| Ok(()) |
| } |
| } |
| |
| /// Header for a `ClearKey` which contains the key policy along with some data needed to manipulate |
| /// the key. |
| #[derive(Debug)] |
| pub(crate) struct KeyHeader { |
| boot_unique_value: BootUniqueValue, |
| key_policy: KeyHeaderPolicy, |
| key_metadata: Mutex<KeyHeaderMetadata>, |
| } |
| |
| impl KeyHeader { |
| fn new(policy: &KeyPolicy) -> Result<Self, HwCryptoError> { |
| let boot_unique_value = BootUniqueValue::new()?; |
| Self::new_with_boot_value(policy, boot_unique_value) |
| } |
| |
| fn new_with_boot_value( |
| policy: &KeyPolicy, |
| boot_unique_value: BootUniqueValue, |
| ) -> Result<Self, HwCryptoError> { |
| let key_policy = KeyHeaderPolicy::new(policy)?; |
| let key_metadata = Mutex::new(KeyHeaderMetadata::new()); |
| Ok(Self { boot_unique_value, key_policy, key_metadata }) |
| } |
| |
| fn get_policy(&self) -> Result<KeyPolicy, HwCryptoError> { |
| self.key_policy.get_policy() |
| } |
| |
| fn try_clone(&self) -> Result<Self, HwCryptoError> { |
| let key_policy = self.key_policy.try_clone()?; |
| let key_metadata = self.key_metadata.lock()?.try_clone()?; |
| Ok(Self { |
| boot_unique_value: self.boot_unique_value.clone(), |
| key_policy, |
| key_metadata: Mutex::new(key_metadata), |
| }) |
| } |
| |
| fn get_metadata_as_cbor(&self) -> Result<Value, HwCryptoError> { |
| self.key_metadata.lock()?.get_metadata_as_cbor() |
| } |
| |
| fn set_metadata_from_cbor(&mut self, metadata_as_cbor: Value) -> Result<(), HwCryptoError> { |
| self.key_metadata.lock()?.set_metadata_from_cbor(metadata_as_cbor) |
| } |
| } |
| |
| cose_enum_gen! { |
| enum OpaqueKeyCoseLabels { |
| KeyMaterial = -66000, |
| KeyPolicy = -66001, |
| BootValue = -66002, |
| KeyMetadata = -66003, |
| } |
| } |
| |
| cose_enum_gen! { |
| enum ProtectionSettingsCoseLabels { |
| WriteProtection = -67000, |
| ReadProtection = -67001, |
| } |
| } |
| |
| cose_enum_gen! { |
| enum KeyMetadataCoseLabels { |
| KeyExpirationPeriod = -68000, |
| ProtectionIdSettings = -68001, |
| } |
| } |
| |
| aidl_enum_wrapper! { |
| aidl_name: ProtectionId, |
| wrapper_name: ProtectionIdSerializable, |
| fields: [WIDEVINE_OUTPUT_BUFFER] |
| } |
| |
| #[derive(Debug, Copy, Clone)] |
| struct ProtectionSetting { |
| write_protection: bool, |
| read_protection: bool, |
| } |
| |
| impl AsCborValue for ProtectionSetting { |
| fn to_cbor_value(self) -> Result<Value, CoseError> { |
| let mut cbor_map = Vec::<(Value, Value)>::new(); |
| cbor_map.try_reserve(2).map_err(|_| CoseError::EncodeFailed)?; |
| |
| let key = Value::Integer((ProtectionSettingsCoseLabels::WriteProtection as i64).into()); |
| let value = Value::Bool(self.write_protection.into()); |
| cbor_map.push((key, value)); |
| |
| let key = Value::Integer((ProtectionSettingsCoseLabels::ReadProtection as i64).into()); |
| let value = Value::Bool(self.read_protection.into()); |
| cbor_map.push((key, value)); |
| |
| Ok(Value::Map(cbor_map)) |
| } |
| |
| fn from_cbor_value(value: Value) -> Result<Self, CoseError> { |
| let opaque_key_map = value.into_map().map_err(|_| CoseError::ExtraneousData)?; |
| if opaque_key_map.len() != 2 { |
| return Err(CoseError::ExtraneousData); |
| } |
| |
| let mut write_protection: Option<bool> = None; |
| let mut read_protection: Option<bool> = None; |
| for (map_key, map_val) in opaque_key_map { |
| match map_key { |
| Value::Integer(key) => match key.try_into()? { |
| ProtectionSettingsCoseLabels::WriteProtection => { |
| write_protection = Some(map_val.as_bool().ok_or(CoseError::EncodeFailed)?); |
| } |
| ProtectionSettingsCoseLabels::ReadProtection => { |
| read_protection = Some(map_val.as_bool().ok_or(CoseError::EncodeFailed)?); |
| } |
| }, |
| _ => return Err(CoseError::ExtraneousData), |
| } |
| } |
| |
| let write_protection = write_protection.ok_or(CoseError::EncodeFailed)?; |
| let read_protection = read_protection.ok_or(CoseError::EncodeFailed)?; |
| |
| Ok(Self { write_protection, read_protection }) |
| } |
| } |
| |
| fn get_dice_sealing_key_derivation_context() -> Result<Vec<u8>, HwCryptoError> { |
| let mut context = Vec::<u8>::new(); |
| |
| context.try_reserve(SEALING_KEY_DERIVATION_HMAC_256_CTX.len() + UNIQUE_VALUE_SIZEOF)?; |
| context.extend_from_slice(SEALING_KEY_DERIVATION_HMAC_256_CTX); |
| context.extend_from_slice(&get_boot_unique_value()?.0); |
| |
| Ok(context) |
| } |
| |
| /// `IOpaqueKey` implementation. |
| pub struct OpaqueKey { |
| pub(crate) key_header: KeyHeader, |
| pub(crate) key_material: KeyMaterial, |
| pub(crate) key_in_owner_control: bool, |
| } |
| |
| impl From<OpaqueKey> for binder::Strong<dyn IOpaqueKey> { |
| fn from(value: OpaqueKey) -> binder::Strong<dyn IOpaqueKey> { |
| BnOpaqueKey::new_binder(value, binder::BinderFeatures::default()) |
| } |
| } |
| |
| impl TryFrom<&binder::Strong<dyn IOpaqueKey>> for OpaqueKey { |
| type Error = HwCryptoError; |
| |
| fn try_from(value: &binder::Strong<dyn IOpaqueKey>) -> Result<OpaqueKey, Self::Error> { |
| let binder = value.as_binder(); |
| let remote = binder.is_remote(); |
| if remote { |
| return Err(hwcrypto_err!(UNSUPPORTED, "binder is not local")); |
| } |
| let binder_key: Binder<BnOpaqueKey> = |
| binder.try_into().expect("because binder is local this should not fail"); |
| let opaque_key_material = (*binder_key).downcast_binder::<OpaqueKey>(); |
| match opaque_key_material { |
| Some(key) => key.try_clone(), |
| None => Err(hwcrypto_err!(UNSUPPORTED, "couldn't cast back key")), |
| } |
| } |
| } |
| |
| impl AsCborValue for OpaqueKey { |
| fn to_cbor_value(self) -> Result<Value, CoseError> { |
| let mut cbor_map = Vec::<(Value, Value)>::new(); |
| cbor_map.try_reserve(4).map_err(|_| CoseError::EncodeFailed)?; |
| let key = Value::Integer((OpaqueKeyCoseLabels::KeyPolicy as i64).into()); |
| let key_policy = self.getKeyPolicy().map_err(|_| CoseError::EncodeFailed)?; |
| let cbor_key_policy = |
| cbor_serialize_key_policy(&key_policy).map_err(|_| CoseError::EncodeFailed)?; |
| cbor_map.push((key, Value::Bytes(cbor_key_policy))); |
| |
| let key = Value::Integer((OpaqueKeyCoseLabels::KeyMaterial as i64).into()); |
| cbor_map |
| .push((key, self.key_material.to_cbor_value().map_err(|_| CoseError::EncodeFailed)?)); |
| |
| let key = Value::Integer((OpaqueKeyCoseLabels::BootValue as i64).into()); |
| let mut boot_value = Vec::new(); |
| boot_value |
| .try_reserve(self.key_header.boot_unique_value.0.len()) |
| .map_err(|_| CoseError::EncodeFailed)?; |
| boot_value.extend_from_slice(&self.key_header.boot_unique_value.0); |
| cbor_map.push((key, Value::Bytes(boot_value))); |
| |
| let key = Value::Integer((OpaqueKeyCoseLabels::KeyMetadata as i64).into()); |
| cbor_map.push(( |
| key, |
| self.key_header.get_metadata_as_cbor().map_err(|_| CoseError::EncodeFailed)?, |
| )); |
| |
| Ok(Value::Map(cbor_map)) |
| } |
| |
| fn from_cbor_value(value: Value) -> Result<Self, CoseError> { |
| let opaque_key_map = value.into_map().map_err(|_| CoseError::ExtraneousData)?; |
| if opaque_key_map.len() != 4 { |
| return Err(CoseError::ExtraneousData); |
| } |
| let mut key_material: Option<KeyMaterial> = None; |
| let mut key_policy: Option<KeyPolicy> = None; |
| let mut boot_value: Option<BootUniqueValue> = None; |
| let mut key_metadata: Option<Value> = None; |
| for (map_key, map_val) in opaque_key_map { |
| match map_key { |
| Value::Integer(key) => match key.try_into()? { |
| OpaqueKeyCoseLabels::KeyMaterial => { |
| key_material = Some( |
| KeyMaterial::from_cbor_value(map_val) |
| .map_err(|_| CoseError::EncodeFailed)?, |
| ) |
| } |
| OpaqueKeyCoseLabels::KeyPolicy => { |
| let policy_bytes = map_val.as_bytes().ok_or(CoseError::EncodeFailed)?; |
| key_policy = Some( |
| cbor_policy_to_aidl(policy_bytes.as_slice()) |
| .map_err(|_| CoseError::EncodeFailed)?, |
| ) |
| } |
| OpaqueKeyCoseLabels::BootValue => { |
| let boot_value_bytes = map_val.as_bytes().ok_or(CoseError::EncodeFailed)?; |
| boot_value = Some(BootUniqueValue( |
| (boot_value_bytes.clone()) |
| .try_into() |
| .map_err(|_| CoseError::EncodeFailed)?, |
| )) |
| } |
| OpaqueKeyCoseLabels::KeyMetadata => key_metadata = Some(map_val), |
| }, |
| _ => return Err(CoseError::ExtraneousData), |
| } |
| } |
| let key_material = key_material.ok_or(CoseError::EncodeFailed)?; |
| let key_policy = key_policy.ok_or(CoseError::EncodeFailed)?; |
| let boot_value = boot_value.ok_or(CoseError::EncodeFailed)?; |
| let mut key_header = KeyHeader::new_with_boot_value(&key_policy, boot_value) |
| .map_err(|_| CoseError::EncodeFailed)?; |
| let key_metadata = key_metadata.ok_or(CoseError::EncodeFailed)?; |
| key_header.set_metadata_from_cbor(key_metadata).map_err(|_| CoseError::EncodeFailed)?; |
| Ok(OpaqueKey { key_material, key_header, key_in_owner_control: false }) |
| } |
| } |
| |
| impl OpaqueKey { |
| pub(crate) fn new_binder( |
| policy: &KeyPolicy, |
| key_material: KeyMaterial, |
| _connection_info: Uuid, |
| ) -> binder::Result<binder::Strong<dyn IOpaqueKey>> { |
| let key_header = KeyHeader::new(policy)?; |
| check_key_material_with_policy(&key_material, policy)?; |
| let opaque_key = OpaqueKey { key_header, key_material, key_in_owner_control: true }; |
| let opaque_keybinder = |
| BnOpaqueKey::new_binder(opaque_key, binder::BinderFeatures::default()); |
| Ok(opaque_keybinder) |
| } |
| |
| fn check_clear_import_policy(policy: &KeyPolicy) -> Result<(), HwCryptoError> { |
| if policy.keyLifetime != KeyLifetime::PORTABLE { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "imported clear keys should have a PORTABLE lifetime" |
| )); |
| } |
| Ok(()) |
| } |
| |
| pub(crate) fn import_key_material( |
| policy: &KeyPolicy, |
| key_material: KeyMaterial, |
| connection_info: Uuid, |
| ) -> binder::Result<binder::Strong<dyn IOpaqueKey>> { |
| check_key_material_with_policy(&key_material, policy)?; |
| Self::check_clear_import_policy(policy)?; |
| Self::new_binder(policy, key_material, connection_info) |
| } |
| |
| fn check_ownership(&self) -> bool { |
| self.key_in_owner_control |
| } |
| |
| // Create a key token sealed using the receiver DICE policy. This means that only the |
| // intended token receiver can import this token. The token has 2 levels of encryption, |
| // the outer layer is provided by a device key bounded to the HwCrypto service and the |
| // outer layer is generated using the receiver DICE policy. |
| fn create_token(&self, sealing_dice_policy: &[u8]) -> Result<Vec<u8>, HwCryptoError> { |
| if !self.check_ownership() { |
| // We haven't created this key, so we cannot export it |
| // TODO: Change the error type to UNAUTORIZED |
| return Err(hwcrypto_err!(GENERIC_ERROR, "only the owner of a key can export it")); |
| } |
| let key: OpaqueKey = self.try_clone()?; |
| let token_creator = EncryptionHeader::generate(EncryptedContent::KeyMaterial)?; |
| |
| // This is a temporary workaround to create a DICE bound key because we will move to |
| // using DICE policies and the AuthMgr instead of UUIDs. |
| let hw_device_key = HwCryptoKey { |
| uuid: Uuid::new_from_string("ffffffff-ffff-ffff-ffff-ffffffffffff") |
| .expect("shouldn't happen, string can be parsed to uuid"), |
| }; |
| |
| // Create a DICE key bound to the receiver policy. |
| let DiceBoundKeyResult { diceBoundKey: sealing_dice_key, dicePolicyWasCurrent: _ } = |
| hw_device_key.derive_dice_policy_bound_key( |
| &DiceBoundDerivationKey::KeyId(DeviceKeyId::DEVICE_BOUND_KEY), |
| sealing_dice_policy, |
| false, |
| )?; |
| let sealing_dice_key: OpaqueKey = sealing_dice_key |
| .as_ref() |
| .ok_or(hwcrypto_err!(GENERIC_ERROR, "shouldn't happen, sealing key is local"))? |
| .try_into()?; |
| let context = get_dice_sealing_key_derivation_context()?; |
| let sealing_key = sealing_dice_key |
| .derive_internal_sealing_key(&context, get_key_size_in_bytes(&KeyType::HMAC_SHA256)?)?; |
| // Inner encryption using the DICE policy bound key |
| let inner_content = token_creator.encrypt_content_service_encryption_key( |
| EncryptionHeaderKey::ProvidedHkdfKey(sealing_key), |
| key, |
| )?; |
| |
| // External encryption using the HwCrypto service key |
| let token_creator = EncryptionHeader::generate(EncryptedContent::WrappedKeyMaterial)?; |
| let content = token_creator.encrypt_content_service_encryption_key( |
| EncryptionHeaderKey::KeyGenerationContext(HW_CRYPTO_WRAP_KEY_HMAC_256_CTX), |
| Value::Bytes(inner_content), |
| )?; |
| Ok(content) |
| } |
| |
| pub(crate) fn import_token( |
| key_token: &[u8], |
| sealing_dice_key: OpaqueKey, |
| _connection_information: Uuid, |
| ) -> Result<Self, HwCryptoError> { |
| // External encryption layer used a HwCrypto service device key |
| let (_, content) = EncryptionHeader::decrypt_content_service_encryption_key( |
| key_token, |
| EncryptionHeaderKey::KeyGenerationContext(HW_CRYPTO_WRAP_KEY_HMAC_256_CTX), |
| EncryptedContent::WrappedKeyMaterial, |
| )?; |
| |
| let context = get_dice_sealing_key_derivation_context()?; |
| // Preparing internal encryption DICE policy bound key |
| let sealing_key = sealing_dice_key |
| .derive_internal_sealing_key(&context, get_key_size_in_bytes(&KeyType::HMAC_SHA256)?)?; |
| |
| let cbor_bytes = Value::from_slice(content.as_slice())?; |
| let inner_content = cbor_bytes.as_bytes().ok_or(hwcrypto_err!( |
| GENERIC_ERROR, |
| "shouldn't happen, inner content was encrypted by us" |
| ))?; |
| |
| let (_, inner_key) = EncryptionHeader::decrypt_content_service_encryption_key( |
| &inner_content, |
| EncryptionHeaderKey::ProvidedHkdfKey(sealing_key), |
| EncryptedContent::KeyMaterial, |
| )?; |
| |
| let opaque_key = Self::from_cbor_value(Value::from_slice(inner_key.as_slice())?)?; |
| Ok(opaque_key) |
| } |
| |
| #[allow(unused)] |
| pub(crate) fn generate_opaque_key( |
| policy: &KeyPolicy, |
| connection_info: Uuid, |
| ) -> binder::Result<binder::Strong<dyn IOpaqueKey>> { |
| let key_material = generate_key_material(&policy.keyType, None)?; |
| OpaqueKey::new_binder(policy, key_material, connection_info) |
| } |
| |
| fn try_clone(&self) -> Result<Self, HwCryptoError> { |
| let key_header = self.key_header.try_clone()?; |
| let key_material = self.key_material.clone(); |
| Ok(OpaqueKey { key_header, key_material, key_in_owner_control: self.key_in_owner_control }) |
| } |
| |
| pub(crate) fn new_opaque_key_from_raw_bytes( |
| policy: &KeyPolicy, |
| key_material: Vec<u8>, |
| connection_info: Uuid, |
| ) -> binder::Result<binder::Strong<dyn IOpaqueKey>> { |
| let key_material = generate_key_material(&policy.keyType, Some(key_material))?; |
| OpaqueKey::new_binder(policy, key_material, connection_info) |
| } |
| |
| pub(crate) fn check_key_derivation_parameters( |
| &self, |
| policy: &KeyPolicy, |
| ) -> Result<(), HwCryptoError> { |
| // Check that we are trying to derive a supported key type |
| check_type_derived_key(policy.keyType)?; |
| // Check that the requested lifetime is compatible with the provided key lifetime |
| if !self.derivation_allowed_lifetime(policy.keyLifetime)? { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "requested lifetime cannot be used {:?}", |
| &policy.keyLifetime |
| )); |
| } |
| // Check that the derivation key can be used to derive keys (KeyPermissions/KeyPolicies) |
| self.key_can_be_used_for_derivation() |
| } |
| |
| // All key derivation functions that uses an `OpaqueKey` as key material should use this |
| // function. If the key derivation do not fit one of the current use cases defined in |
| // `HkdfOperationType`, a new enum value should be added to `HkdfOperationType` for the use |
| // case. |
| fn derive_raw_key_material( |
| &self, |
| context: DerivationContext, |
| derived_key_size: usize, |
| ) -> Result<Vec<u8>, HwCryptoError> { |
| let context_with_op_type = context.create_key_derivation_context()?; |
| match &self.key_material { |
| KeyMaterial::Hmac(key) => { |
| let hkdf = crypto_provider::HmacImpl; |
| let explicit_key = explicit!(key).map_err(|_| { |
| hwcrypto_err!(BAD_PARAMETER, "only explicit HMAC keys supported") |
| })?; |
| let raw_key = hkdf |
| .hkdf(&[], &explicit_key.0, context_with_op_type.as_slice(), derived_key_size) |
| .map_err(|e| hwcrypto_err!(GENERIC_ERROR, "couldn't derive key {:?}", e))?; |
| Ok(raw_key) |
| } |
| _ => Err(hwcrypto_err!(BAD_PARAMETER, "only HMAC keys supported")), |
| } |
| } |
| |
| fn derive_clear_key_from_derivation_context( |
| &self, |
| mut op_context: DerivationContext, |
| context: &[u8], |
| derived_key_size: usize, |
| ) -> Result<Vec<u8>, HwCryptoError> { |
| op_context.add_unsigned_integer(derived_key_size as u64)?; |
| op_context.add_binary_string(context)?; |
| self.derive_raw_key_material(op_context, derived_key_size) |
| } |
| |
| pub(crate) fn derive_internal_sealing_key( |
| &self, |
| context: &[u8], |
| derived_key_size: usize, |
| ) -> Result<Vec<u8>, HwCryptoError> { |
| let op_context = DerivationContext::new(HkdfOperationType::InternalSealingKeyDerivation)?; |
| self.derive_clear_key_from_derivation_context(op_context, context, derived_key_size) |
| } |
| |
| pub(crate) fn derive_clear_key_material( |
| &self, |
| context: &[u8], |
| derived_key_size: usize, |
| ) -> Result<Vec<u8>, HwCryptoError> { |
| let op_context = DerivationContext::new(HkdfOperationType::ClearKeyDerivation)?; |
| self.derive_clear_key_from_derivation_context(op_context, context, derived_key_size) |
| } |
| |
| pub(crate) fn derive_opaque_key( |
| &self, |
| policy: &[u8], |
| context: &[u8], |
| connection_info: Uuid, |
| ) -> binder::Result<binder::Strong<dyn IOpaqueKey>> { |
| let aidl_policy = policy::cbor_policy_to_aidl(policy)?; |
| self.check_key_derivation_parameters(&aidl_policy)?; |
| let derived_key_size = get_key_size_in_bytes(&aidl_policy.keyType)?; |
| let mut op_context = DerivationContext::new(HkdfOperationType::OpaqueKeyDerivation)?; |
| op_context.add_binary_string(policy)?; |
| op_context.add_binary_string(context)?; |
| let raw_key_material = self.derive_raw_key_material(op_context, derived_key_size)?; |
| Self::new_opaque_key_from_raw_bytes(&aidl_policy, raw_key_material, connection_info) |
| } |
| |
| fn derivation_allowed_lifetime( |
| &self, |
| derived_key_lifetime: KeyLifetime, |
| ) -> Result<bool, HwCryptoError> { |
| validate_lifetime(self.key_header.key_policy.key_lifetime.0)?; |
| validate_lifetime(derived_key_lifetime)?; |
| match self.key_header.key_policy.key_lifetime.0 { |
| //ephemeral keys can be used to derive/wrap any other key |
| KeyLifetime::EPHEMERAL => Ok(true), |
| KeyLifetime::HARDWARE => { |
| // Hardware keys cannot be used to derive/wrap ephemeral keys |
| if derived_key_lifetime.0 == KeyLifetime::EPHEMERAL.0 { |
| Ok(false) |
| } else { |
| Ok(true) |
| } |
| } |
| KeyLifetime::PORTABLE => { |
| // portable keys can only derive/wrap other portable keys |
| if derived_key_lifetime.0 == KeyLifetime::PORTABLE.0 { |
| Ok(true) |
| } else { |
| Ok(false) |
| } |
| } |
| _ => Err(hwcrypto_err!( |
| UNSUPPORTED, |
| "unsupported Key lifetime {:?}", |
| self.key_header.key_policy.key_lifetime |
| )), |
| } |
| } |
| |
| fn key_can_be_used_for_derivation(&self) -> Result<(), HwCryptoError> { |
| match self.key_material { |
| KeyMaterial::Hmac(_) => Ok(()), |
| _ => Err(hwcrypto_err!(UNSUPPORTED, "Only HMAC keys can be used for key derivation")), |
| }?; |
| if self.key_header.key_policy.key_usage.0 != KeyUse::DERIVE { |
| return Err(hwcrypto_err!(BAD_PARAMETER, "key was not exclusively a derive key")); |
| } |
| Ok(()) |
| } |
| |
| pub(crate) fn key_usage_supported(&self, usage: KeyUse) -> bool { |
| (usage.0 & self.key_header.key_policy.key_usage.0 .0) == usage.0 |
| } |
| |
| pub fn get_key_type(&self) -> KeyType { |
| self.key_header.key_policy.key_type.0 |
| } |
| |
| pub fn supports_pattern_encryption(&self) -> Result<(), HwCryptoError> { |
| match self.key_header.key_policy.key_type.0 { |
| KeyType::AES_128_CBC_NO_PADDING => Ok(()), |
| _ => Err(hwcrypto_err!(BAD_PARAMETER, "only AES CBC supports pattern encryption")), |
| } |
| } |
| |
| /// Checks if the requested operation (encrypt/decrypt) can be done with this key |
| pub(crate) fn symmetric_operation_is_compatible( |
| &self, |
| direction: SymmetricOperation, |
| ) -> Result<(), HwCryptoError> { |
| let dir = helpers::direction_to_key_usage(&direction)?; |
| if !self.key_usage_supported(dir) { |
| Err(hwcrypto_err!(BAD_PARAMETER, "provided key do not support {:?}", dir)) |
| } else { |
| Ok(()) |
| } |
| } |
| |
| /// Checks if the requested algorithm parameters are compatible with this key |
| pub(crate) fn parameters_are_compatible_symmetric_cipher( |
| &self, |
| parameters: &SymmetricCryptoParameters, |
| ) -> Result<(), HwCryptoError> { |
| match parameters { |
| SymmetricCryptoParameters::Aes(aes_parameters) => match aes_parameters { |
| AesCipherMode::Cbc(_) => match self.get_key_type() { |
| KeyType::AES_128_CBC_NO_PADDING |
| | KeyType::AES_128_CBC_PKCS7_PADDING |
| | KeyType::AES_256_CBC_NO_PADDING |
| | KeyType::AES_256_CBC_PKCS7_PADDING => Ok(()), |
| _ => Err(hwcrypto_err!(BAD_PARAMETER, "provided incompatible AES key for CBC")), |
| }, |
| AesCipherMode::Ctr(_) => match self.get_key_type() { |
| KeyType::AES_128_CTR | KeyType::AES_256_CTR => Ok(()), |
| _ => Err(hwcrypto_err!(BAD_PARAMETER, "provided incompatible AES key for CTR")), |
| }, |
| }, |
| } |
| } |
| |
| fn add_protection_id( |
| &self, |
| protection_id: ProtectionId, |
| allowed_operations: &[OperationType], |
| ) -> Result<(), HwCryptoError> { |
| if !self.check_ownership() { |
| // We haven't created this key, so we cannot export it |
| // TODO: Change the error type to UNAUTORIZED |
| return Err(hwcrypto_err!( |
| GENERIC_ERROR, |
| "only the owner of a key can modify protection IDs" |
| )); |
| } |
| self.key_header.key_metadata.lock()?.add_protection_id(protection_id, allowed_operations) |
| } |
| } |
| |
| impl binder::Interface for OpaqueKey {} |
| |
| impl IOpaqueKey for OpaqueKey { |
| fn exportWrappedKey( |
| &self, |
| _wrapping_key: &binder::Strong<dyn IOpaqueKey>, |
| ) -> binder::Result<Vec<u8>> { |
| Err(binder::Status::new_exception_str( |
| binder::ExceptionCode::UNSUPPORTED_OPERATION, |
| Some("export_wrapped_key has not been implemented yet"), |
| )) |
| } |
| |
| fn getKeyPolicy(&self) -> binder::Result<KeyPolicy> { |
| Ok(self.key_header.get_policy()?) |
| } |
| |
| fn getPublicKey(&self) -> binder::Result<Vec<u8>> { |
| Err(binder::Status::new_exception_str( |
| binder::ExceptionCode::UNSUPPORTED_OPERATION, |
| Some("get_public_key has not been implemented yet"), |
| )) |
| } |
| |
| fn getShareableToken(&self, sealing_dice_policy: &[u8]) -> binder::Result<OpaqueKeyToken> { |
| Ok(OpaqueKeyToken { keyToken: self.create_token(sealing_dice_policy)? }) |
| } |
| |
| fn setProtectionId( |
| &self, |
| protection_id: ProtectionId, |
| allowed_operations: &[OperationType], |
| ) -> Result<(), binder::Status> { |
| Ok(self.add_protection_id(protection_id, allowed_operations)?) |
| } |
| } |
| |
| pub(crate) fn check_key_material_with_policy( |
| key_material: &KeyMaterial, |
| policy: &KeyPolicy, |
| ) -> Result<(), HwCryptoError> { |
| let key_type = &policy.keyType; |
| // `KeyMaterial` doesn't fully describe the cryptographic algorithm as `KeyType` does, so we can |
| // only check if both of them are compatible, not provide a 1:1 mapping |
| match key_material { |
| KeyMaterial::Aes(aes_key) => match aes_key { |
| OpaqueOr::Opaque(_) => Err(hwcrypto_err!(BAD_PARAMETER, "opaque aes key provided")), |
| OpaqueOr::Explicit(aes_key) => match aes_key { |
| crypto::aes::Key::Aes128(km) => match *key_type { |
| KeyType::AES_128_CBC_NO_PADDING |
| | KeyType::AES_128_CBC_PKCS7_PADDING |
| | KeyType::AES_128_CTR |
| | KeyType::AES_128_GCM |
| | KeyType::AES_128_CMAC => Ok(()), |
| _ => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "type mismatch: key material {:?} key type: {:?}", |
| km, |
| key_type |
| )), |
| }, |
| crypto::aes::Key::Aes192(_) => { |
| Err(hwcrypto_err!(BAD_PARAMETER, "AES keys of length 192 are not supported")) |
| } |
| crypto::aes::Key::Aes256(km) => match *key_type { |
| KeyType::AES_256_CBC_NO_PADDING |
| | KeyType::AES_256_CBC_PKCS7_PADDING |
| | KeyType::AES_256_CTR |
| | KeyType::AES_256_GCM |
| | KeyType::AES_256_CMAC => Ok(()), |
| _ => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "type mismatch: key material {:?} key type: {:?}", |
| km, |
| key_type |
| )), |
| }, |
| }, |
| }, |
| KeyMaterial::TripleDes(_) => { |
| Err(hwcrypto_err!(BAD_PARAMETER, "TDES is not currently supported")) |
| } |
| KeyMaterial::Hmac(hmac_key) => match hmac_key { |
| OpaqueOr::Opaque(_) => Err(hwcrypto_err!(BAD_PARAMETER, "opaque HMAC key provided")), |
| OpaqueOr::Explicit(km) => match *key_type { |
| KeyType::HMAC_SHA256 | KeyType::HMAC_SHA512 => { |
| let expected_size = get_key_size_in_bytes(key_type)?; |
| let km_size = km.0.len(); |
| match policy.usage { |
| KeyUse::SIGN | KeyUse::DERIVE => Ok(()), |
| _ => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "wrong key use for hmac key, received {:?}", |
| policy.usage |
| )), |
| }?; |
| if km_size == expected_size { |
| Ok(()) |
| } else { |
| Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "bad len for hmac key received {} bytes, expected {} bytes", |
| km_size, |
| expected_size |
| )) |
| } |
| } |
| _ => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "type mismatch for HMAC key key type: {:?}", |
| key_type |
| )), |
| }, |
| }, |
| KeyMaterial::Rsa(rsa_key) => match rsa_key { |
| OpaqueOr::Opaque(_) => Err(hwcrypto_err!(BAD_PARAMETER, "opaque RSA key provided")), |
| OpaqueOr::Explicit(rsa_key) => { |
| let key_size = rsa_key.size(); |
| match (key_size, *key_type) { |
| (2048, KeyType::RSA2048_PSS_SHA256) => Ok(()), |
| (2048, KeyType::RSA2048_PKCS1_5_SHA256) => Ok(()), |
| _ => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "type mismatch for RSA key length {} and type: {:?}", |
| key_size, |
| key_type |
| )), |
| } |
| } |
| }, |
| KeyMaterial::Ec(curve, curve_type, _) => match (curve, *key_type) { |
| (EcCurve::P256, KeyType::ECC_NIST_P256_SIGN_NO_PADDING) => Ok(()), |
| (EcCurve::P256, KeyType::ECC_NIST_P256_SIGN_SHA256) => Ok(()), |
| (EcCurve::P521, KeyType::ECC_NIST_P521_SIGN_NO_PADDING) => Ok(()), |
| (EcCurve::P521, KeyType::ECC_NIST_P521_SIGN_SHA512) => Ok(()), |
| (EcCurve::Curve25519, _) => match (curve_type, *key_type) { |
| (CurveType::EdDsa, KeyType::ECC_ED25519_SIGN) => Ok(()), |
| _ => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "type mismatch for Ec Key curve {:?} and type: {:?}", |
| curve, |
| key_type |
| )), |
| }, |
| _ => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "type mismatch for Ec Key curve {:?} and type: {:?}", |
| curve, |
| key_type |
| )), |
| }, |
| } |
| } |
| |
| // Get key size given the backend AES key type. Used to check if we received enough bytes from the |
| // caller for an AES key. |
| fn get_aes_variant_key_size(variant: &crypto::aes::Variant) -> usize { |
| match variant { |
| crypto::aes::Variant::Aes128 => 16, |
| crypto::aes::Variant::Aes192 => 24, |
| crypto::aes::Variant::Aes256 => 32, |
| } |
| } |
| |
| // Translating a policy AES `KeyType` into the type understood by the cryptographic backend we are |
| // currently used |
| // TODO: change this into a `TryFrom` once we refactor `KeyType` to be a newtype. |
| fn get_aes_variant(key_type: &KeyType) -> Result<crypto::aes::Variant, HwCryptoError> { |
| match *key_type { |
| KeyType::AES_128_CBC_NO_PADDING |
| | KeyType::AES_128_CBC_PKCS7_PADDING |
| | KeyType::AES_128_CTR |
| | KeyType::AES_128_GCM |
| | KeyType::AES_128_CMAC => Ok(crypto::aes::Variant::Aes128), |
| KeyType::AES_256_CBC_NO_PADDING |
| | KeyType::AES_256_CBC_PKCS7_PADDING |
| | KeyType::AES_256_CTR |
| | KeyType::AES_256_GCM |
| | KeyType::AES_256_CMAC => Ok(crypto::aes::Variant::Aes256), |
| _ => Err(hwcrypto_err!(BAD_PARAMETER, "not an AES key type: {:?}", key_type)), |
| } |
| } |
| |
| // Return a keysize given a `KeyType`. Because HMAC key sizes can be defined by the |
| // caller, `key_size_bits` is needed to cover all cases. |
| pub(crate) fn get_key_size_in_bytes(key_type: &KeyType) -> Result<usize, HwCryptoError> { |
| match *key_type { |
| KeyType::AES_128_CBC_NO_PADDING |
| | KeyType::AES_128_CBC_PKCS7_PADDING |
| | KeyType::AES_128_CTR |
| | KeyType::AES_128_GCM |
| | KeyType::AES_128_CMAC => Ok(16), |
| KeyType::AES_256_CBC_NO_PADDING |
| | KeyType::AES_256_CBC_PKCS7_PADDING |
| | KeyType::AES_256_CTR |
| | KeyType::AES_256_GCM |
| | KeyType::AES_256_CMAC => Ok(32), |
| KeyType::HMAC_SHA256 => Ok(32), |
| KeyType::HMAC_SHA512 => Ok(64), |
| _ => unimplemented!("Only AES and HMAC has been implemented"), |
| } |
| } |
| |
| fn validate_lifetime(lifetime: KeyLifetime) -> Result<(), HwCryptoError> { |
| match lifetime { |
| KeyLifetime::EPHEMERAL | KeyLifetime::HARDWARE | KeyLifetime::PORTABLE => Ok(()), |
| // AIDL structure have more values added than the ones defined on the AIDL file |
| _ => Err(hwcrypto_err!(UNSUPPORTED, "unsupported Key lifetime {:?}", lifetime)), |
| } |
| } |
| |
| fn check_type_derived_key(key_type: KeyType) -> Result<(), HwCryptoError> { |
| match key_type { |
| KeyType::AES_128_CBC_NO_PADDING |
| | KeyType::AES_128_CBC_PKCS7_PADDING |
| | KeyType::AES_128_CTR |
| | KeyType::AES_128_GCM |
| | KeyType::AES_128_CMAC |
| | KeyType::AES_256_CBC_NO_PADDING |
| | KeyType::AES_256_CBC_PKCS7_PADDING |
| | KeyType::AES_256_CTR |
| | KeyType::AES_256_GCM |
| | KeyType::AES_256_CMAC |
| | KeyType::HMAC_SHA256 |
| | KeyType::HMAC_SHA512 => Ok(()), |
| _ => Err(hwcrypto_err!(BAD_PARAMETER, "Only HMAC and AES keys are supported")), |
| } |
| } |
| |
| fn key_vec_to_array<T, U: std::convert::TryInto<T>>(input: U) -> Result<T, HwCryptoError> { |
| input |
| .try_into() |
| .map_err(|_| hwcrypto_err!(BAD_PARAMETER, "couldn't transform vector into array")) |
| } |
| |
| // Create a backend-compatible cryptographic key from either a provided vector of uniform random |
| // bytes or, if this not provided, use the cryptographic backend to create it. The type is based on |
| // the policy `KeyType`. Because HMAC keys can have arbitrary sizes, include an optional |
| // `key_size_bits` for that case. |
| pub(crate) fn generate_key_material( |
| key_type: &KeyType, |
| key_random_bytes: Option<Vec<u8>>, |
| ) -> Result<KeyMaterial, HwCryptoError> { |
| let aes = crypto_provider::AesImpl; |
| let hmac = crypto_provider::HmacImpl; |
| let mut rng = crypto_provider::RngImpl::default(); |
| match *key_type { |
| KeyType::AES_128_CBC_NO_PADDING |
| | KeyType::AES_128_CBC_PKCS7_PADDING |
| | KeyType::AES_128_CTR |
| | KeyType::AES_128_GCM |
| | KeyType::AES_128_CMAC |
| | KeyType::AES_256_CBC_NO_PADDING |
| | KeyType::AES_256_CBC_PKCS7_PADDING |
| | KeyType::AES_256_CTR |
| | KeyType::AES_256_GCM |
| | KeyType::AES_256_CMAC => { |
| let variant = get_aes_variant(key_type)?; |
| if let Some(key_bytes) = key_random_bytes { |
| if key_bytes.len() != get_aes_variant_key_size(&variant) { |
| return Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "for aes key needed {} bytes, received {}", |
| key_bytes.len(), |
| get_aes_variant_key_size(&variant) |
| )); |
| } |
| match variant { |
| crypto::aes::Variant::Aes128 => Ok(KeyMaterial::Aes( |
| crypto::aes::Key::Aes128(key_vec_to_array(key_bytes)?).into(), |
| )), |
| crypto::aes::Variant::Aes192 => Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "AES keys of length 192 are not supported", |
| )), |
| crypto::aes::Variant::Aes256 => Ok(KeyMaterial::Aes( |
| crypto::aes::Key::Aes256(key_vec_to_array(key_bytes)?).into(), |
| )), |
| } |
| } else { |
| Ok(aes.generate_key(&mut rng, variant, &[])?) |
| } |
| } |
| KeyType::HMAC_SHA256 | KeyType::HMAC_SHA512 => { |
| let key_size_bytes = get_key_size_in_bytes(key_type)?; |
| if let Some(key_bytes) = key_random_bytes { |
| if key_bytes.len() != key_size_bytes { |
| Err(hwcrypto_err!( |
| BAD_PARAMETER, |
| "for hmac key needed {} bytes, received {}", |
| key_bytes.len(), |
| key_size_bytes |
| )) |
| } else { |
| Ok(KeyMaterial::Hmac(crypto::hmac::Key::new(key_bytes).into())) |
| } |
| } else { |
| Ok(hmac.generate_key( |
| &mut rng, |
| kmr_wire::KeySizeInBits((key_size_bytes * 8).try_into().map_err(|_| { |
| hwcrypto_err!( |
| GENERIC_ERROR, |
| "shouldn't happen, key_size_bytes * 8 should fit on an u32" |
| ) |
| })?), |
| &[], |
| )?) |
| } |
| } |
| _ => unimplemented!("key material other than AES and HMAC not implemented yet"), |
| } |
| } |
| |
| #[cfg(test)] |
| mod tests { |
| use super::*; |
| use test::{expect, expect_eq}; |
| |
| #[test] |
| fn boot_unique_values_match() { |
| let boot_value = BootUniqueValue::new().expect("couldn't get boot unique value"); |
| let boot_value2 = BootUniqueValue::new().expect("couldn't get boot unique value"); |
| expect_eq!(boot_value, boot_value2, "boot unique values should match"); |
| } |
| |
| #[test] |
| fn generate_key_material_test() { |
| let usage = KeyUse::ENCRYPT; |
| let key_type = KeyType::AES_256_GCM; |
| let policy = KeyPolicy { |
| usage, |
| keyLifetime: KeyLifetime::EPHEMERAL, |
| keyPermissions: Vec::new(), |
| keyType: key_type, |
| keyManagementKey: false, |
| }; |
| let key_material = generate_key_material(&policy.keyType, None); |
| expect!(key_material.is_ok(), "couldn't retrieve key material"); |
| let key_material = key_material.unwrap(); |
| let check_result = check_key_material_with_policy(&key_material, &policy); |
| expect!(check_result.is_ok(), "wrong key type"); |
| } |
| } |
