From 10770c150969527b8740337b5f4c0ea39b442d50 Mon Sep 17 00:00:00 2001 From: Eran Messeri Date: Sat, 31 Dec 2022 20:25:54 +0000 Subject: [PATCH] Handle unparsable public keys Handle the case where a KeyMint implementation produced an invalid X.509 certificate that is the container for the generated key's public portion. There's not much for the caller to do other than re-generate the key. Bug: 261788762 Test: Not tested yet. Change-Id: Ia883df4f5e29a7d75929d37a68b015e857b90560 --- .../security/keystore2/AndroidKeyStoreProvider.java | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java b/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java index 9947d34495ab0..c55a781ce2a48 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java @@ -38,6 +38,7 @@ import java.security.PublicKey; import java.security.Security; import java.security.Signature; import java.security.UnrecoverableKeyException; +import java.security.cert.X509Certificate; import java.security.interfaces.ECPublicKey; import java.security.interfaces.RSAPublicKey; @@ -221,7 +222,14 @@ public class AndroidKeyStoreProvider extends Provider { } final byte[] x509PublicCert = metadata.certificate; - PublicKey publicKey = AndroidKeyStoreSpi.toCertificate(x509PublicCert).getPublicKey(); + final X509Certificate parsedX509Certificate = + AndroidKeyStoreSpi.toCertificate(x509PublicCert); + if (parsedX509Certificate == null) { + throw new UnrecoverableKeyException("Failed to parse the X.509 certificate containing" + + " the public key. This likely indicates a hardware problem."); + } + + PublicKey publicKey = parsedX509Certificate.getPublicKey(); String jcaKeyAlgorithm = publicKey.getAlgorithm();