Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Keystore 2.0: Remove attestKey from KeyChain." am: eb45aabc03 am: c5792c3904

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1559810

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ie6a096ec2f220c60b27b1e26f81817b00ae6af35
This commit is contained in:
Treehugger Robot
2021-02-24 22:19:42 +00:00
committed by Automerger Merge Worker
parent 1d191d3251 c5792c3904
commit ccef3d8305
4 changed files with 95 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
keystore/java/android/security/IKeyChainService.aidl
View File

@@ -37,8 +37,6 @@ interface IKeyChainService {
void setUserSelectable(String alias, boolean isUserSelectable);
int generateKeyPair(in String algorithm, in ParcelableKeyGenParameterSpec spec);
int attestKey(in String alias, in byte[] challenge, in int[] idAttestationFlags,
out KeymasterCertificateChain chain);
boolean setKeyPairCertificate(String alias, in byte[] userCert, in byte[] certChain);
// APIs used by CertInstaller and DevicePolicyManager

50
keystore/java/android/security/KeyChain.java
View File

@@ -40,6 +40,8 @@ import android.os.UserManager;
import android.security.keystore.AndroidKeyStoreProvider;
import android.security.keystore.KeyPermanentlyInvalidatedException;
import android.security.keystore.KeyProperties;
import android.system.keystore2.Domain;
import android.system.keystore2.KeyDescriptor;
import com.android.org.conscrypt.TrustedCertificateStore;
@@ -622,6 +624,33 @@ public final class KeyChain {
return null;
}
/**
* This prefix is used to disambiguate grant aliase strings from normal key alias strings.
* Technically, a key alias string can use the same prefix. However, a collision does not
* lead to privilege escalation, because grants are access controlled in the Keystore daemon.
* @hide
*/
public static final String GRANT_ALIAS_PREFIX = "ks2_keychain_grant_id:";
private static KeyDescriptor getGrantDescriptor(String keyid) {
KeyDescriptor result = new KeyDescriptor();
result.domain = Domain.GRANT;
result.blob = null;
result.alias = null;
try {
result.nspace = Long.parseUnsignedLong(
keyid.substring(GRANT_ALIAS_PREFIX.length()), 16 /* radix */);
} catch (NumberFormatException e) {
return null;
}
return result;
}
/** @hide */
public static String getGrantString(KeyDescriptor key) {
return String.format(GRANT_ALIAS_PREFIX + "%016X", key.nspace);
}
/** @hide */
@Nullable @WorkerThread
public static KeyPair getKeyPair(@NonNull Context context, @NonNull String alias)
@@ -645,11 +674,23 @@ public final class KeyChain {
if (keyId == null) {
return null;
}
if (AndroidKeyStoreProvider.isKeystore2Enabled()) {
try {
return android.security.keystore2.AndroidKeyStoreProvider
.loadAndroidKeyStoreKeyPairFromKeystore(
KeyStore2.getInstance(),
getGrantDescriptor(keyId));
} catch (UnrecoverableKeyException | KeyPermanentlyInvalidatedException e) {
throw new KeyChainException(e);
}
} else {
try {
return AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(
KeyStore.getInstance(), keyId, KeyStore.UID_SELF);
} catch (RuntimeException | UnrecoverableKeyException | KeyPermanentlyInvalidatedException e) {
} catch (RuntimeException | UnrecoverableKeyException
| KeyPermanentlyInvalidatedException e) {
throw new KeyChainException(e);
}
}
@@ -767,11 +808,8 @@ public final class KeyChain {
@Deprecated
public static boolean isBoundKeyAlgorithm(
@NonNull @KeyProperties.KeyAlgorithmEnum String algorithm) {
if (!isKeyAlgorithmSupported(algorithm)) {
return false;
}
return KeyStore.getInstance().isHardwareBacked(algorithm);
// All supported algorithms are hardware backed. Individual keys may not be.
return true;
}
/** @hide */

20
keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java
View File

@@ -273,10 +273,10 @@ public class AndroidKeyStoreProvider extends Provider {
/** @hide **/
@NonNull
public static KeyPair loadAndroidKeyStoreKeyPairFromKeystore(
@NonNull KeyStore2 keyStore, @NonNull String privateKeyAlias, int namespace)
@NonNull KeyStore2 keyStore, @NonNull KeyDescriptor descriptor)
throws UnrecoverableKeyException, KeyPermanentlyInvalidatedException {
AndroidKeyStoreKey key =
loadAndroidKeyStoreKeyFromKeystore(keyStore, privateKeyAlias, namespace);
loadAndroidKeyStoreKeyFromKeystore(keyStore, descriptor);
if (key instanceof AndroidKeyStorePublicKey) {
AndroidKeyStorePublicKey publicKey = (AndroidKeyStorePublicKey) key;
return new KeyPair(publicKey, publicKey.getPrivateKey());
@@ -336,7 +336,7 @@ public class AndroidKeyStoreProvider extends Provider {
@NonNull
public static AndroidKeyStoreKey loadAndroidKeyStoreKeyFromKeystore(
@NonNull KeyStore2 keyStore, @NonNull String alias, int namespace)
throws UnrecoverableKeyException, KeyPermanentlyInvalidatedException {
throws UnrecoverableKeyException, KeyPermanentlyInvalidatedException {
KeyDescriptor descriptor = new KeyDescriptor();
if (namespace == KeyProperties.NAMESPACE_APPLICATION) {
@@ -348,6 +348,18 @@ public class AndroidKeyStoreProvider extends Provider {
}
descriptor.alias = alias;
descriptor.blob = null;
final AndroidKeyStoreKey key = loadAndroidKeyStoreKeyFromKeystore(keyStore, descriptor);
if (key instanceof AndroidKeyStorePublicKey) {
return ((AndroidKeyStorePublicKey) key).getPrivateKey();
} else {
return key;
}
}
private static AndroidKeyStoreKey loadAndroidKeyStoreKeyFromKeystore(
@NonNull KeyStore2 keyStore, @NonNull KeyDescriptor descriptor)
throws UnrecoverableKeyException, KeyPermanentlyInvalidatedException {
KeyEntryResponse response = null;
try {
response = keyStore.getKeyEntry(descriptor);
@@ -397,7 +409,7 @@ public class AndroidKeyStoreProvider extends Provider {
keymasterAlgorithm == KeymasterDefs.KM_ALGORITHM_EC) {
return makeAndroidKeyStorePublicKeyFromKeyEntryResponse(descriptor, response.metadata,
new KeyStoreSecurityLevel(response.iSecurityLevel),
keymasterAlgorithm).getPrivateKey();
keymasterAlgorithm);
} else {
throw new UnrecoverableKeyException("Key algorithm unknown");
}

60
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -310,6 +310,7 @@ import org.xmlpull.v1.XmlPullParser;
import org.xmlpull.v1.XmlPullParserException;
import org.xmlpull.v1.XmlSerializer;
import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.FileDescriptor;
import java.io.FileInputStream;
@@ -319,6 +320,9 @@ import java.io.IOException;
import java.io.PrintWriter;
import java.lang.reflect.Constructor;
import java.nio.charset.StandardCharsets;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.text.DateFormat;
import java.time.LocalDate;
import java.util.ArrayList;
@@ -6502,7 +6506,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
enforceCanManageScope(who, callerPackage, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER,
DELEGATION_CERT_INSTALL);
}
final KeyGenParameterSpec keySpec = parcelableKeySpec.getSpec();
KeyGenParameterSpec keySpec = parcelableKeySpec.getSpec();
final String alias = keySpec.getKeystoreAlias();
if (TextUtils.isEmpty(alias)) {
throw new IllegalArgumentException("Empty alias provided.");
@@ -6514,9 +6518,15 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
return false;
}
if (deviceIdAttestationRequired && (keySpec.getAttestationChallenge() == null)) {
throw new IllegalArgumentException(
"Requested Device ID attestation but challenge is empty.");
if (deviceIdAttestationRequired) {
if (keySpec.getAttestationChallenge() == null) {
throw new IllegalArgumentException(
"Requested Device ID attestation but challenge is empty.");
}
KeyGenParameterSpec.Builder specBuilder = new KeyGenParameterSpec.Builder(keySpec);
specBuilder.setAttestationIds(attestationUtilsFlags);
specBuilder.setDevicePropertiesAttestationIncluded(true);
keySpec = specBuilder.build();
}
final UserHandle userHandle = mInjector.binderGetCallingUserHandle();
@@ -6526,15 +6536,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
KeyChain.bindAsUser(mContext, userHandle)) {
IKeyChainService keyChain = keyChainConnection.getService();
// Copy the provided keySpec, excluding the attestation challenge, which will be
// used later for requesting key attestation record.
final KeyGenParameterSpec noAttestationSpec =
new KeyGenParameterSpec.Builder(keySpec)
.setAttestationChallenge(null)
.build();
final int generationResult = keyChain.generateKeyPair(algorithm,
new ParcelableKeyGenParameterSpec(noAttestationSpec));
new ParcelableKeyGenParameterSpec(keySpec));
if (generationResult != KeyChain.KEY_GEN_SUCCESS) {
Log.e(LOG_TAG, String.format(
"KeyChain failed to generate a keypair, error %d.", generationResult));
@@ -6543,6 +6546,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
throw new ServiceSpecificException(
DevicePolicyManager.KEY_GEN_STRONGBOX_UNAVAILABLE,
String.format("KeyChain error: %d", generationResult));
case KeyChain.KEY_ATTESTATION_CANNOT_ATTEST_IDS:
throw new UnsupportedOperationException(
"Device does not support Device ID attestation.");
default:
return false;
}
@@ -6555,22 +6561,26 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
// that UID.
keyChain.setGrant(callingUid, alias, true);
final byte[] attestationChallenge = keySpec.getAttestationChallenge();
if (attestationChallenge != null) {
final int attestationResult = keyChain.attestKey(
alias, attestationChallenge, attestationUtilsFlags, attestationChain);
if (attestationResult != KeyChain.KEY_ATTESTATION_SUCCESS) {
Log.e(LOG_TAG, String.format(
"Attestation for %s failed (rc=%d), deleting key.",
alias, attestationResult));
keyChain.removeKeyPair(alias);
if (attestationResult == KeyChain.KEY_ATTESTATION_CANNOT_ATTEST_IDS) {
throw new UnsupportedOperationException(
"Device does not support Device ID attestation.");
try {
final List<byte[]> encodedCerts = new ArrayList();
final CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
final byte[] certChainBytes = keyChain.getCaCertificates(alias);
encodedCerts.add(keyChain.getCertificate(alias));
if (certChainBytes != null) {
final Collection<X509Certificate> certs =
(Collection<X509Certificate>) certFactory.generateCertificates(
new ByteArrayInputStream(certChainBytes));
for (X509Certificate cert : certs) {
encodedCerts.add(cert.getEncoded());
}
return false;
}
attestationChain.shallowCopyFrom(new KeymasterCertificateChain(encodedCerts));
} catch (CertificateException e) {
Log.e(LOG_TAG, "While retrieving certificate chain.", e);
return false;
}
final boolean isDelegate = (who == null);
DevicePolicyEventLogger
.createEvent(DevicePolicyEnums.GENERATE_KEY_PAIR)