From 2ed9b9b276c4df477cfd6c749f9d4deeed209a0d Mon Sep 17 00:00:00 2001 From: Janis Danisevskis Date: Tue, 20 Oct 2020 09:30:51 -0700 Subject: [PATCH 1/2] Keystore 2.0 SPI: Make Recoverable keystore tolerate the Keystore 2.0 SPI This patch adds support for using the Legacy Keystore provider when the Keystore 2.0 provider is installed. This is the first step towards the transition to Keystore 2.0. Installation of the new provider can be triggered by setting the platform property ro.android.security.keystore2.enable=true. Bug: 171305545 Test: None Change-Id: I3825f40558b4c25cb64caa25c0029cea76333c44 --- .../KeyStoreProxyImpl.java | 23 +++++++++++++++---- .../PlatformKeyManager.java | 4 +--- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/KeyStoreProxyImpl.java b/services/core/java/com/android/server/locksettings/recoverablekeystore/KeyStoreProxyImpl.java index 285e722886c28..9857fb637b596 100644 --- a/services/core/java/com/android/server/locksettings/recoverablekeystore/KeyStoreProxyImpl.java +++ b/services/core/java/com/android/server/locksettings/recoverablekeystore/KeyStoreProxyImpl.java @@ -16,23 +16,38 @@ package com.android.server.locksettings.recoverablekeystore; +import android.security.keystore2.AndroidKeyStoreProvider; + import java.io.IOException; -import java.security.cert.CertificateException; import java.security.Key; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; -import java.security.NoSuchAlgorithmException; import java.security.UnrecoverableKeyException; +import java.security.cert.CertificateException; /** * Implementation of {@link KeyStoreProxy} that delegates all method calls to the {@link KeyStore}. */ public class KeyStoreProxyImpl implements KeyStoreProxy { - private static final String ANDROID_KEY_STORE_PROVIDER = "AndroidKeyStore"; private final KeyStore mKeyStore; + /** + * TODO This function redirects keystore access to the legacy keystore during a transitional + * phase during which not all calling code has been adjusted to use Keystore 2.0. + * This can be reverted to a constant of "AndroidKeyStore" when b/171305684 is complete. + * The specific bug for this component is b/171305545. + */ + static String androidKeystoreProviderName() { + if (AndroidKeyStoreProvider.isInstalled()) { + return "AndroidKeyStoreLegacy"; + } else { + return "AndroidKeyStore"; + } + + } + /** * A new instance, delegating to {@code keyStore}. */ @@ -69,7 +84,7 @@ public class KeyStoreProxyImpl implements KeyStoreProxy { * @throws KeyStoreException if there was a problem getting or initializing the key store. */ public static KeyStore getAndLoadAndroidKeyStore() throws KeyStoreException { - KeyStore keyStore = KeyStore.getInstance(ANDROID_KEY_STORE_PROVIDER); + KeyStore keyStore = KeyStore.getInstance(androidKeystoreProviderName()); try { keyStore.load(/*param=*/ null); } catch (CertificateException | IOException | NoSuchAlgorithmException e) { diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/PlatformKeyManager.java b/services/core/java/com/android/server/locksettings/recoverablekeystore/PlatformKeyManager.java index 0761cde825b66..569b7098bb6cd 100644 --- a/services/core/java/com/android/server/locksettings/recoverablekeystore/PlatformKeyManager.java +++ b/services/core/java/com/android/server/locksettings/recoverablekeystore/PlatformKeyManager.java @@ -86,8 +86,6 @@ public class PlatformKeyManager { private final KeyStoreProxy mKeyStore; private final RecoverableKeyStoreDb mDatabase; - private static final String ANDROID_KEY_STORE_PROVIDER = "AndroidKeyStore"; - /** * A new instance operating on behalf of {@code userId}, storing its prefs in the location * defined by {@code context}. @@ -486,7 +484,7 @@ public class PlatformKeyManager { * @throws KeyStoreException if there was a problem getting or initializing the key store. */ private static KeyStore getAndLoadAndroidKeyStore() throws KeyStoreException { - KeyStore keyStore = KeyStore.getInstance(ANDROID_KEY_STORE_PROVIDER); + KeyStore keyStore = KeyStore.getInstance(KeyStoreProxyImpl.androidKeystoreProviderName()); try { keyStore.load(/*param=*/ null); } catch (CertificateException | IOException | NoSuchAlgorithmException e) { From bc119dfb2be9c1f4385fb66e7396578b099958ff Mon Sep 17 00:00:00 2001 From: Janis Danisevskis Date: Mon, 26 Oct 2020 14:42:49 -0700 Subject: [PATCH 2/2] Keystore 2.0 SPI: Use KeyMint AIDL types. We are now using KeyMint types for KeyParameter and SecurityLevel. Test: None Change-Id: I3db72c17a9cb999a0248df4c37588dfc2ad84f74 --- .../java/android/security/KeyStoreOperation.java | 2 +- .../java/android/security/KeyStoreSecurityLevel.java | 2 +- .../keystore2/AndroidKeyStore3DESCipherSpi.java | 2 +- .../AndroidKeyStoreAuthenticatedAESCipherSpi.java | 2 +- .../keystore2/AndroidKeyStoreCipherSpiBase.java | 2 +- .../keystore2/AndroidKeyStoreECDSASignatureSpi.java | 2 +- .../security/keystore2/AndroidKeyStoreHmacSpi.java | 2 +- .../keystore2/AndroidKeyStoreKeyGeneratorSpi.java | 4 ++-- .../AndroidKeyStoreKeyPairGeneratorSpi.java | 4 ++-- .../keystore2/AndroidKeyStoreRSACipherSpi.java | 2 +- .../keystore2/AndroidKeyStoreRSASignatureSpi.java | 2 +- .../keystore2/AndroidKeyStoreSignatureSpiBase.java | 2 +- .../security/keystore2/AndroidKeyStoreSpi.java | 12 +++++------- .../AndroidKeyStoreUnauthenticatedAESCipherSpi.java | 2 +- .../security/keystore2/KeyStore2ParameterUtils.java | 4 ++-- 15 files changed, 22 insertions(+), 24 deletions(-) diff --git a/keystore/java/android/security/KeyStoreOperation.java b/keystore/java/android/security/KeyStoreOperation.java index 9af15a5f4a160..49a48871fd305 100644 --- a/keystore/java/android/security/KeyStoreOperation.java +++ b/keystore/java/android/security/KeyStoreOperation.java @@ -17,11 +17,11 @@ package android.security; import android.annotation.NonNull; +import android.hardware.keymint.KeyParameter; import android.os.RemoteException; import android.os.ServiceSpecificException; import android.security.keymaster.KeymasterDefs; import android.system.keystore2.IKeystoreOperation; -import android.system.keystore2.KeyParameter; import android.system.keystore2.ResponseCode; import android.util.Log; diff --git a/keystore/java/android/security/KeyStoreSecurityLevel.java b/keystore/java/android/security/KeyStoreSecurityLevel.java index 9d3b62278ba01..7c3de8bee475b 100644 --- a/keystore/java/android/security/KeyStoreSecurityLevel.java +++ b/keystore/java/android/security/KeyStoreSecurityLevel.java @@ -18,6 +18,7 @@ package android.security; import android.annotation.NonNull; import android.app.compat.CompatChanges; +import android.hardware.keymint.KeyParameter; import android.os.RemoteException; import android.os.ServiceSpecificException; import android.security.keystore.BackendBusyException; @@ -27,7 +28,6 @@ import android.system.keystore2.CreateOperationResponse; import android.system.keystore2.IKeystoreSecurityLevel; import android.system.keystore2.KeyDescriptor; import android.system.keystore2.KeyMetadata; -import android.system.keystore2.KeyParameter; import android.system.keystore2.ResponseCode; import android.util.Log; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStore3DESCipherSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStore3DESCipherSpi.java index 70713a47ad6d1..69c7a2589d6fd 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStore3DESCipherSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStore3DESCipherSpi.java @@ -17,10 +17,10 @@ package android.security.keystore2; import android.annotation.NonNull; +import android.hardware.keymint.KeyParameter; import android.security.keymaster.KeymasterDefs; import android.security.keystore.ArrayUtils; import android.security.keystore.KeyProperties; -import android.system.keystore2.KeyParameter; import java.security.AlgorithmParameters; import java.security.InvalidAlgorithmParameterException; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreAuthenticatedAESCipherSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreAuthenticatedAESCipherSpi.java index dd094b7a5fd09..2b5f6c31607bf 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreAuthenticatedAESCipherSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreAuthenticatedAESCipherSpi.java @@ -18,13 +18,13 @@ package android.security.keystore2; import android.annotation.NonNull; import android.annotation.Nullable; +import android.hardware.keymint.KeyParameter; import android.security.KeyStoreException; import android.security.KeyStoreOperation; import android.security.keymaster.KeymasterDefs; import android.security.keystore.ArrayUtils; import android.security.keystore.KeyProperties; import android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer.Stream; -import android.system.keystore2.KeyParameter; import libcore.util.EmptyArray; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java b/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java index b785ee5c69668..18d26922f1aed 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java @@ -19,11 +19,11 @@ package android.security.keystore2; import android.annotation.CallSuper; import android.annotation.NonNull; import android.annotation.Nullable; +import android.hardware.keymint.KeyParameter; import android.security.KeyStoreException; import android.security.KeyStoreOperation; import android.security.keymaster.KeymasterDefs; import android.security.keystore.KeyStoreCryptoOperation; -import android.system.keystore2.KeyParameter; import libcore.util.EmptyArray; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreECDSASignatureSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreECDSASignatureSpi.java index 9f7f2383a416b..2250c89aac41e 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreECDSASignatureSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreECDSASignatureSpi.java @@ -17,12 +17,12 @@ package android.security.keystore2; import android.annotation.NonNull; +import android.hardware.keymint.KeyParameter; import android.security.KeyStoreException; import android.security.KeyStoreOperation; import android.security.keymaster.KeymasterDefs; import android.security.keystore.KeyProperties; import android.system.keystore2.Authorization; -import android.system.keystore2.KeyParameter; import libcore.util.EmptyArray; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreHmacSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreHmacSpi.java index 3dde2e592259c..eea45c2876221 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreHmacSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreHmacSpi.java @@ -16,12 +16,12 @@ package android.security.keystore2; +import android.hardware.keymint.KeyParameter; import android.security.KeyStoreException; import android.security.KeyStoreOperation; import android.security.keymaster.KeymasterDefs; import android.security.keystore.KeyStoreCryptoOperation; import android.security.keystore.KeymasterUtils; -import android.system.keystore2.KeyParameter; import java.security.InvalidAlgorithmParameterException; import java.security.InvalidKeyException; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyGeneratorSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyGeneratorSpi.java index ccd0a4bf92ffb..479fd8a6a73a1 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyGeneratorSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyGeneratorSpi.java @@ -16,6 +16,8 @@ package android.security.keystore2; +import android.hardware.keymint.KeyParameter; +import android.hardware.keymint.SecurityLevel; import android.security.KeyStore2; import android.security.KeyStoreSecurityLevel; import android.security.keymaster.KeymasterArguments; @@ -29,8 +31,6 @@ import android.system.keystore2.Domain; import android.system.keystore2.IKeystoreSecurityLevel; import android.system.keystore2.KeyDescriptor; import android.system.keystore2.KeyMetadata; -import android.system.keystore2.KeyParameter; -import android.system.keystore2.SecurityLevel; import android.util.Log; import libcore.util.EmptyArray; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java index a747a0e727d87..61725e3e8c24c 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java @@ -18,6 +18,8 @@ package android.security.keystore2; import android.annotation.NonNull; import android.annotation.Nullable; +import android.hardware.keymint.KeyParameter; +import android.hardware.keymint.SecurityLevel; import android.os.Build; import android.security.KeyPairGeneratorSpec; import android.security.KeyStore2; @@ -35,9 +37,7 @@ import android.system.keystore2.Domain; import android.system.keystore2.IKeystoreSecurityLevel; import android.system.keystore2.KeyDescriptor; import android.system.keystore2.KeyMetadata; -import android.system.keystore2.KeyParameter; import android.system.keystore2.ResponseCode; -import android.system.keystore2.SecurityLevel; import android.util.Log; import libcore.util.EmptyArray; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java index a6ea9723db247..2686ddc20c1d7 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java @@ -18,11 +18,11 @@ package android.security.keystore2; import android.annotation.NonNull; import android.annotation.Nullable; +import android.hardware.keymint.KeyParameter; import android.security.keymaster.KeymasterDefs; import android.security.keystore.KeyProperties; import android.security.keystore.KeymasterUtils; import android.system.keystore2.Authorization; -import android.system.keystore2.KeyParameter; import java.security.AlgorithmParameters; import java.security.InvalidAlgorithmParameterException; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreRSASignatureSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreRSASignatureSpi.java index 5f1b9c0586a1f..444dad4cffbea 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreRSASignatureSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreRSASignatureSpi.java @@ -17,9 +17,9 @@ package android.security.keystore2; import android.annotation.NonNull; +import android.hardware.keymint.KeyParameter; import android.security.keymaster.KeymasterDefs; import android.security.keystore.KeyProperties; -import android.system.keystore2.KeyParameter; import java.security.InvalidKeyException; import java.security.SignatureSpi; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreSignatureSpiBase.java b/keystore/java/android/security/keystore2/AndroidKeyStoreSignatureSpiBase.java index 55414b70d4031..a168f8feb3dbb 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreSignatureSpiBase.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreSignatureSpiBase.java @@ -18,12 +18,12 @@ package android.security.keystore2; import android.annotation.CallSuper; import android.annotation.NonNull; +import android.hardware.keymint.KeyParameter; import android.security.KeyStoreException; import android.security.KeyStoreOperation; import android.security.keymaster.KeymasterDefs; import android.security.keystore.ArrayUtils; import android.security.keystore.KeyStoreCryptoOperation; -import android.system.keystore2.KeyParameter; import libcore.util.EmptyArray; diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java index 4c26864cb02be..9790a4ae5b652 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java @@ -18,6 +18,9 @@ package android.security.keystore2; import android.annotation.NonNull; import android.hardware.biometrics.BiometricManager; +import android.hardware.keymint.HardwareAuthenticatorType; +import android.hardware.keymint.KeyParameter; +import android.hardware.keymint.SecurityLevel; import android.security.GateKeeper; import android.security.KeyStore2; import android.security.KeyStoreParameter; @@ -36,9 +39,7 @@ import android.system.keystore2.IKeystoreSecurityLevel; import android.system.keystore2.KeyDescriptor; import android.system.keystore2.KeyEntryResponse; import android.system.keystore2.KeyMetadata; -import android.system.keystore2.KeyParameter; import android.system.keystore2.ResponseCode; -import android.system.keystore2.SecurityLevel; import android.util.Log; import java.io.ByteArrayInputStream; @@ -871,16 +872,13 @@ public class AndroidKeyStoreSpi extends KeyStoreSpi { List authenticatorSpecs = new ArrayList<>(); AuthenticatorSpec authenticatorSpec = new AuthenticatorSpec(); - // TODO Replace with HardwareAuthenticatorType.PASSWORD when KeyMint AIDL spec has landed. - authenticatorSpec.authenticatorType = 1; // HardwareAuthenticatorType.PASSWORD + authenticatorSpec.authenticatorType = HardwareAuthenticatorType.PASSWORD; authenticatorSpec.authenticatorId = GateKeeper.getSecureUserId(); authenticatorSpecs.add(authenticatorSpec); for (long sid : biometricSids) { AuthenticatorSpec authSpec = new AuthenticatorSpec(); - // TODO Replace with HardwareAuthenticatorType.FINGERPRINT when KeyMint AIDL spec has - // landed. - authSpec.authenticatorType = 2; // HardwareAuthenticatorType.FINGERPRINT + authSpec.authenticatorType = HardwareAuthenticatorType.FINGERPRINT; authSpec.authenticatorId = sid; authenticatorSpecs.add(authSpec); } diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreUnauthenticatedAESCipherSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreUnauthenticatedAESCipherSpi.java index 3d5a8f63e7f99..a2d4528b99fd0 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreUnauthenticatedAESCipherSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreUnauthenticatedAESCipherSpi.java @@ -18,10 +18,10 @@ package android.security.keystore2; import android.annotation.NonNull; import android.annotation.Nullable; +import android.hardware.keymint.KeyParameter; import android.security.keymaster.KeymasterDefs; import android.security.keystore.ArrayUtils; import android.security.keystore.KeyProperties; -import android.system.keystore2.KeyParameter; import java.security.AlgorithmParameters; import java.security.InvalidAlgorithmParameterException; diff --git a/keystore/java/android/security/keystore2/KeyStore2ParameterUtils.java b/keystore/java/android/security/keystore2/KeyStore2ParameterUtils.java index ee67ed3f76d8d..8fa532b6e1887 100644 --- a/keystore/java/android/security/keystore2/KeyStore2ParameterUtils.java +++ b/keystore/java/android/security/keystore2/KeyStore2ParameterUtils.java @@ -18,13 +18,13 @@ package android.security.keystore2; import android.annotation.NonNull; import android.hardware.biometrics.BiometricManager; +import android.hardware.keymint.KeyParameter; +import android.hardware.keymint.SecurityLevel; import android.security.GateKeeper; import android.security.keymaster.KeymasterDefs; import android.security.keystore.KeyProperties; import android.security.keystore.UserAuthArgs; import android.system.keystore2.Authorization; -import android.system.keystore2.KeyParameter; -import android.system.keystore2.SecurityLevel; import java.security.ProviderException; import java.util.ArrayList;