Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Rsa-Oaep operation begin on T+GSI build

Browse Source 
Mixed build of Android T + U GSI misses to add RSA_OAEP_MGF_DIGEST in
key begin operation parameters and hence RSA cipher operation fails.
This was due to Keymint 200 implementation in Android T supported
RSA_OAEP_MGF_DIGEST tag but did not included into key characteristics and
the check in AndroidKeyStoreRSACipherSpi fails on Android T + U GSI
builds.

To fix this issue additional condition added to check if key
characteristics do not have RSA_OAEP_MGF_DIGEST tag but the KeyMint
version is 200 then it has to include in operation parameters.

Bug: 289859292
Bug: 289749312
Bug: 287891167
Bug: 287532460
Test: atest  CtsKeystoreWycheproofTestCases:com.google.security.wycheproof.RsaOaepTest
Test: atest CtsKeystoreTestCases:android.keystore.cts.CipherTest#testKatBasicWithDifferentProviders
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:d8b18413ade6ba13817caae52abdffc609a92d89)
Merged-In: I13ca50a45e733276d1451d17904780eff86bf296
Change-Id: I13ca50a45e733276d1451d17904780eff86bf296
This commit is contained in:
Prashant Patil
2023-07-10 17:46:16 +00:00
committed by Android Build Cherrypicker Worker
parent bc38028c8d
commit dde5ebaa58
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java
View File

@@ -18,6 +18,7 @@ package android.security.keystore2;
import android.annotation.NonNull;
import android.annotation.Nullable;
import android.content.pm.PackageManager;
import android.hardware.security.keymint.KeyParameter;
import android.security.keymaster.KeymasterDefs;
import android.security.keystore.KeyProperties;
@@ -299,6 +300,12 @@ abstract class AndroidKeyStoreRSACipherSpi extends AndroidKeyStoreCipherSpiBase
return false;
}
private static boolean hasKeyMintV2() {
PackageManager pm = android.app.AppGlobals.getInitialApplication().getPackageManager();
return pm.hasSystemFeature(PackageManager.FEATURE_HARDWARE_KEYSTORE, 200)
&& !pm.hasSystemFeature(PackageManager.FEATURE_HARDWARE_KEYSTORE, 300);
}
@Override
protected final void addAlgorithmSpecificParametersToBegin(
@NonNull List<KeyParameter> parameters, Authorization[] keyCharacteristics) {
@@ -307,11 +314,12 @@ abstract class AndroidKeyStoreRSACipherSpi extends AndroidKeyStoreCipherSpiBase
KeymasterDefs.KM_TAG_DIGEST, mKeymasterDigest
));
// Only add the KM_TAG_RSA_OAEP_MGF_DIGEST tag to begin() if the MGF Digest is
// present in the key properties. Keys generated prior to Android 14 did not have
// this tag (Keystore didn't add it) so specifying any MGF digest tag would cause
// a begin() operation (on an Android 14 device) to fail (with a key that was generated
// on Android 13 or below).
if (isMgfDigestTagPresentInKeyProperties(keyCharacteristics)) {
// present in the key properties or KeyMint version is 200. Keys generated prior to
// Android 14 did not have this tag (Keystore didn't add it) and hence not present in
// imported key as well, so specifying any MGF digest tag would cause a begin()
// operation (on an Android 14 device) to fail (with a key that was generated on
// Android 13 or below).
if (isMgfDigestTagPresentInKeyProperties(keyCharacteristics) || hasKeyMintV2()) {
parameters.add(KeyStore2ParameterUtils.makeEnum(
KeymasterDefs.KM_TAG_RSA_OAEP_MGF_DIGEST, mKeymasterMgf1Digest
));