Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix Android Keystore KeyPairGenerator for RSA PSS keys." into mnc-dev

Browse Source
This commit is contained in:
Alex Klyubin
2015-06-12 19:54:18 +00:00
committed by Android (Google) Code Review
parent 768695a899 7c475cc7c3
commit 6cb8e30bb7
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java
View File

@@ -691,6 +691,36 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
}
case KeymasterDefs.KM_ALGORITHM_RSA:
{
// Check whether this key is authorized for PKCS#1 signature padding.
// We use Bouncy Castle to generate self-signed RSA certificates. Bouncy Castle
// only supports RSA certificates signed using PKCS#1 padding scheme. The key needs
// to be authorized for PKCS#1 padding or padding NONE which means any padding.
boolean pkcs1SignaturePaddingSupported = false;
for (int keymasterPadding : KeyProperties.SignaturePadding.allToKeymaster(
spec.getSignaturePaddings())) {
if ((keymasterPadding == KeymasterDefs.KM_PAD_RSA_PKCS1_1_5_SIGN)
|| (keymasterPadding == KeymasterDefs.KM_PAD_NONE)) {
pkcs1SignaturePaddingSupported = true;
break;
}
}
if (!pkcs1SignaturePaddingSupported) {
// Keymaster doesn't distinguish between encryption padding NONE and signature
// padding NONE. In the Android Keystore API only encryption padding NONE is
// exposed.
for (int keymasterPadding : KeyProperties.EncryptionPadding.allToKeymaster(
spec.getEncryptionPaddings())) {
if (keymasterPadding == KeymasterDefs.KM_PAD_NONE) {
pkcs1SignaturePaddingSupported = true;
break;
}
}
}
if (!pkcs1SignaturePaddingSupported) {
// Key not authorized for PKCS#1 signature padding -- can't sign
return null;
}
Set<Integer> availableKeymasterDigests = getAvailableKeymasterSignatureDigests(
spec.getDigests(),
AndroidKeyStoreBCWorkaroundProvider.getSupportedEcdsaSignatureDigests());