Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not allow -1 duration in setUserAuthenticationParameters

Browse Source 
This is a completely new API so callers can follow the new pattern of
using 0 to require auth for every use of the key.

Supporting both -1 and 0 to require auth for every use of the key
increases CtsVerifier complexity exponentially (strongbox,
invalidated by enrollment, etc).

Fixes: 150823346
Test: builds
Change-Id: Ieef53a8b50f5119c5e52656e930bf16b1e8e3d89
This commit is contained in:
Kevin Chyn
2020-03-05 11:04:15 -08:00
parent abe3d7bde4
commit 9f49e8df2a
3 changed files with 10 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/current.txt
View File

@@ -42783,7 +42783,7 @@ package android.security.keystore {
method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setRandomizedEncryptionRequired(boolean);
method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setSignaturePaddings(java.lang.String...);
method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUnlockedDeviceRequired(boolean);
method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUserAuthenticationParameters(@IntRange(from=0xffffffff) int, int);
method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUserAuthenticationParameters(@IntRange(from=0) int, int);
method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUserAuthenticationRequired(boolean);
method @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUserAuthenticationValidWhileOnBody(boolean);
method @Deprecated @NonNull public android.security.keystore.KeyGenParameterSpec.Builder setUserAuthenticationValidityDurationSeconds(@IntRange(from=0xffffffff) int);
@@ -42901,7 +42901,7 @@ package android.security.keystore {
method @NonNull public android.security.keystore.KeyProtection.Builder setRandomizedEncryptionRequired(boolean);
method @NonNull public android.security.keystore.KeyProtection.Builder setSignaturePaddings(java.lang.String...);
method @NonNull public android.security.keystore.KeyProtection.Builder setUnlockedDeviceRequired(boolean);
method @NonNull public android.security.keystore.KeyProtection.Builder setUserAuthenticationParameters(@IntRange(from=0xffffffff) int, int);
method @NonNull public android.security.keystore.KeyProtection.Builder setUserAuthenticationParameters(@IntRange(from=0) int, int);
method @NonNull public android.security.keystore.KeyProtection.Builder setUserAuthenticationRequired(boolean);
method @NonNull public android.security.keystore.KeyProtection.Builder setUserAuthenticationValidWhileOnBody(boolean);
method @Deprecated @NonNull public android.security.keystore.KeyProtection.Builder setUserAuthenticationValidityDurationSeconds(@IntRange(from=0xffffffff) int);

11
keystore/java/android/security/keystore/KeyGenParameterSpec.java
View File

@@ -1264,8 +1264,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
* successfully.
*
* @param timeout duration in seconds or {@code 0} if user authentication must take place
* for every use of the key. {@code -1} is also accepted for legacy purposes. It is
* functionally the same as {@code 0}.
* for every use of the key.
* @param type set of authentication types which can authorize use of the key. See
* {@link KeyProperties}.{@code AUTH} flags.
*
@@ -1275,12 +1274,10 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu
* @see KeyguardManager
*/
@NonNull
public Builder setUserAuthenticationParameters(@IntRange(from = -1) int timeout,
public Builder setUserAuthenticationParameters(@IntRange(from = 0) int timeout,
@KeyProperties.AuthEnum int type) {
if (timeout < -1) {
throw new IllegalArgumentException("timeout must be -1 or larger");
} else if (timeout == -1) {
timeout = 0;
if (timeout < 0) {
throw new IllegalArgumentException("timeout must be 0 or larger");
}
mUserAuthenticationValidityDurationSeconds = timeout;
mUserAuthenticationType = type;

11
keystore/java/android/security/keystore/KeyProtection.java
View File

@@ -894,8 +894,7 @@ public final class KeyProtection implements ProtectionParameter, UserAuthArgs {
* successfully.
*
* @param timeout duration in seconds or {@code 0} if user authentication must take place
* for every use of the key. {@code -1} is also accepted for legacy purposes. It is
* functionally the same as {@code 0}.
* for every use of the key.
* @param type set of authentication types which can authorize use of the key. See
* {@link KeyProperties}.{@code AUTH} flags.
*
@@ -905,12 +904,10 @@ public final class KeyProtection implements ProtectionParameter, UserAuthArgs {
* @see KeyguardManager
*/
@NonNull
public Builder setUserAuthenticationParameters(@IntRange(from = -1) int timeout,
public Builder setUserAuthenticationParameters(@IntRange(from = 0) int timeout,
@KeyProperties.AuthEnum int type) {
if (timeout < -1) {
throw new IllegalArgumentException("timeout must be -1 or larger");
} else if (timeout == -1) {
timeout = 0;
if (timeout < 0) {
throw new IllegalArgumentException("timeout must be 0 or larger");
}
mUserAuthenticationValidityDurationSeconds = timeout;
mUserAuthenticationType = type;