Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Enable per-use user authenticated keys to be used." into mnc-dev

Browse Source
This commit is contained in:
Alex Klyubin
2015-04-30 02:46:29 +00:00
committed by Android (Google) Code Review
parent 9e4dbf0557 058de02073
commit f0abe000eb
3 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
keystore/java/android/security/KeyStore.java
View File

@@ -543,6 +543,8 @@ public class KeyStore {
return new KeyStoreException(errorCode, "Key not found");
case VALUE_CORRUPTED:
return new KeyStoreException(errorCode, "Key blob corrupted");
case OP_AUTH_NEEDED:
return new KeyStoreException(errorCode, "Operation requires authorization");
default:
return new KeyStoreException(errorCode, String.valueOf(errorCode));
}
@@ -572,6 +574,7 @@ public class KeyStore {
case KeymasterDefs.KM_ERROR_KEY_NOT_YET_VALID:
return new KeyNotYetValidException();
case KeymasterDefs.KM_ERROR_KEY_USER_NOT_AUTHENTICATED:
case OP_AUTH_NEEDED:
{
// We now need to determine whether the key/operation can become usable if user
// authentication is performed, or whether it can never become usable again.

5
keystore/java/android/security/KeyStoreCipherSpi.java
View File

@@ -298,7 +298,8 @@ public abstract class KeyStoreCipherSpi extends CipherSpi implements KeyStoreCry
mAdditionalEntropyForBegin = null;
if (opResult == null) {
throw new KeyStoreConnectException();
} else if (opResult.resultCode != KeyStore.NO_ERROR) {
} else if ((opResult.resultCode != KeyStore.NO_ERROR)
&& (opResult.resultCode != KeyStore.OP_AUTH_NEEDED)) {
switch (opResult.resultCode) {
case KeymasterDefs.KM_ERROR_INVALID_NONCE:
throw new InvalidAlgorithmParameterException("Invalid IV");
@@ -309,6 +310,8 @@ public abstract class KeyStoreCipherSpi extends CipherSpi implements KeyStoreCry
if (opResult.token == null) {
throw new IllegalStateException("Keystore returned null operation token");
}
// The operation handle/token is now either valid for use immediately or needs to be
// authorized through user authentication (if the error code was OP_AUTH_NEEDED).
mOperationToken = opResult.token;
mOperationHandle = opResult.operationHandle;
loadAlgorithmSpecificParametersFromBeginResult(keymasterOutputArgs);

6
keystore/java/android/security/KeyStoreHmacSpi.java
View File

@@ -168,12 +168,16 @@ public abstract class KeyStoreHmacSpi extends MacSpi implements KeyStoreCryptoOp
new KeymasterArguments());
if (opResult == null) {
throw new KeyStoreConnectException();
} else if (opResult.resultCode != KeyStore.NO_ERROR) {
} else if ((opResult.resultCode != KeyStore.NO_ERROR)
&& (opResult.resultCode != KeyStore.OP_AUTH_NEEDED)) {
throw mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode);
}
if (opResult.token == null) {
throw new IllegalStateException("Keystore returned null operation token");
}
// The operation handle/token is now either valid for use immediately or needs to be
// authorized through user authentication (if the error code was OP_AUTH_NEEDED).
mOperationToken = opResult.token;
mOperationHandle = opResult.operationHandle;
mChunkedStreamer = new KeyStoreCryptoOperationChunkedStreamer(