From e5b6686b49c47678f5057b6702da67a42a5d8c7f Mon Sep 17 00:00:00 2001 From: Max Bires Date: Tue, 3 Mar 2020 21:05:02 -0800 Subject: [PATCH] Fixing default behavior for keys requiring auth The default timeout and authentication type is being updated to offer a correct default that matches the old behavior. Bug: 149931201 Test: CtsVerifier Change-Id: I3f3d4f8d5b02455c285a882933fd6c37739ee44a --- .../java/android/security/keystore/KeyGenParameterSpec.java | 5 +++-- keystore/java/android/security/keystore/KeyProtection.java | 5 +++-- keystore/java/android/security/keystore/KeymasterUtils.java | 3 +-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/keystore/java/android/security/keystore/KeyGenParameterSpec.java b/keystore/java/android/security/keystore/KeyGenParameterSpec.java index d683041fbfdcd..926ab27f3c226 100644 --- a/keystore/java/android/security/keystore/KeyGenParameterSpec.java +++ b/keystore/java/android/security/keystore/KeyGenParameterSpec.java @@ -764,8 +764,9 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu private @KeyProperties.BlockModeEnum String[] mBlockModes; private boolean mRandomizedEncryptionRequired = true; private boolean mUserAuthenticationRequired; - private int mUserAuthenticationValidityDurationSeconds = -1; - private @KeyProperties.AuthEnum int mUserAuthenticationType; + private int mUserAuthenticationValidityDurationSeconds = 0; + private @KeyProperties.AuthEnum int mUserAuthenticationType = + KeyProperties.AUTH_BIOMETRIC_STRONG; private boolean mUserPresenceRequired = false; private byte[] mAttestationChallenge = null; private boolean mUniqueIdIncluded = false; diff --git a/keystore/java/android/security/keystore/KeyProtection.java b/keystore/java/android/security/keystore/KeyProtection.java index e230b7c3708bd..7ef7b1a7edcb9 100644 --- a/keystore/java/android/security/keystore/KeyProtection.java +++ b/keystore/java/android/security/keystore/KeyProtection.java @@ -562,8 +562,9 @@ public final class KeyProtection implements ProtectionParameter, UserAuthArgs { private @KeyProperties.BlockModeEnum String[] mBlockModes; private boolean mRandomizedEncryptionRequired = true; private boolean mUserAuthenticationRequired; - private @KeyProperties.AuthEnum int mUserAuthenticationType; - private int mUserAuthenticationValidityDurationSeconds = -1; + private @KeyProperties.AuthEnum int mUserAuthenticationType = + KeyProperties.AUTH_BIOMETRIC_STRONG; + private int mUserAuthenticationValidityDurationSeconds = 0; private boolean mUserPresenceRequired = false; private boolean mUserAuthenticationValidWhileOnBody; private boolean mInvalidatedByBiometricEnrollment = true; diff --git a/keystore/java/android/security/keystore/KeymasterUtils.java b/keystore/java/android/security/keystore/KeymasterUtils.java index 4ead253f3eea5..bc933ff13825f 100644 --- a/keystore/java/android/security/keystore/KeymasterUtils.java +++ b/keystore/java/android/security/keystore/KeymasterUtils.java @@ -165,8 +165,7 @@ public abstract class KeymasterUtils { } args.addUnsignedLong(KeymasterDefs.KM_TAG_USER_SECURE_ID, KeymasterArguments.toUint64(sid)); - args.addEnum(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, - KeymasterDefs.HW_AUTH_PASSWORD | KeymasterDefs.HW_AUTH_BIOMETRIC); + args.addEnum(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, spec.getUserAuthenticationType()); args.addUnsignedInt(KeymasterDefs.KM_TAG_AUTH_TIMEOUT, spec.getUserAuthenticationValidityDurationSeconds()); if (spec.isUserAuthenticationValidWhileOnBody()) {