From d7e1bc711f25a0e72847264ec53a1714abd9ea13 Mon Sep 17 00:00:00 2001 From: Prashant Patil Date: Fri, 3 Feb 2023 16:59:02 +0000 Subject: [PATCH] Keystore: Attestation fix in non AOSP builds After adding attestation properties for AOSP/GSI builds their comparison in Spi layer missed one condition. If these values were not set they were assigned as Build.UNKNOWN. Hence additional check is added in Spi layer. Bug: 267643193 Test: atest CtsKeystoreTestCases:android.keystore.cts.KeyAttestationTest CtsKeystoreTestCases:DeviceOwnerKeyManagementTest Change-Id: I5b3ef0a308bbb12bc4cac2efcf04468f65db1ef8 --- .../AndroidKeyStoreKeyPairGeneratorSpi.java | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java index 4715045886730..c1f6c29ca86e6 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java @@ -801,7 +801,8 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato )); if (mSpec.isDevicePropertiesAttestationIncluded()) { - final String platformReportedBrand = TextUtils.isEmpty(Build.BRAND_FOR_ATTESTATION) + final String platformReportedBrand = + isPropertyEmptyOrUnknown(Build.BRAND_FOR_ATTESTATION) ? Build.BRAND : Build.BRAND_FOR_ATTESTATION; params.add(KeyStore2ParameterUtils.makeBytes( KeymasterDefs.KM_TAG_ATTESTATION_ID_BRAND, @@ -812,8 +813,8 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato Build.DEVICE.getBytes(StandardCharsets.UTF_8) )); final String platformReportedProduct = - TextUtils.isEmpty(Build.PRODUCT_FOR_ATTESTATION) ? Build.PRODUCT : - Build.PRODUCT_FOR_ATTESTATION; + isPropertyEmptyOrUnknown(Build.PRODUCT_FOR_ATTESTATION) + ? Build.PRODUCT : Build.PRODUCT_FOR_ATTESTATION; params.add(KeyStore2ParameterUtils.makeBytes( KeymasterDefs.KM_TAG_ATTESTATION_ID_PRODUCT, platformReportedProduct.getBytes(StandardCharsets.UTF_8) @@ -822,7 +823,8 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato KeymasterDefs.KM_TAG_ATTESTATION_ID_MANUFACTURER, Build.MANUFACTURER.getBytes(StandardCharsets.UTF_8) )); - final String platformReportedModel = TextUtils.isEmpty(Build.MODEL_FOR_ATTESTATION) + final String platformReportedModel = + isPropertyEmptyOrUnknown(Build.MODEL_FOR_ATTESTATION) ? Build.MODEL : Build.MODEL_FOR_ATTESTATION; params.add(KeyStore2ParameterUtils.makeBytes( KeymasterDefs.KM_TAG_ATTESTATION_ID_MODEL, @@ -1227,4 +1229,8 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato result.retainAll(authorizedKeymasterKeyDigests); return result; } + + private boolean isPropertyEmptyOrUnknown(String property) { + return TextUtils.isEmpty(property) || property.equals(Build.UNKNOWN); + } }