Enforce IND-CPA requirement when generating asymmetric keys.

This enforces the randomized encryption requirement (IND-CPA), if
requested, when generating asymmetric key pairs. Whether randomized
encryption is used depends on the encryption padding modes authorized
for the key pair. Thus, if randomized encryption is required, the
KeyPairGenerator must reject attempts to generate keys authorized for
encryption using non-compliant padding schemes.

This is similar to the existing check in AndroidKeyStoreImpl during
asymmetric key import.

Bug: 22179911
Change-Id: I3d85367259c17bd44198a736ace853d0d3567d5e

keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java

@@ -287,6 +287,22 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
                 mKeymasterBlockModes = KeyProperties.BlockMode.allToKeymaster(spec.getBlockModes());
                 mKeymasterEncryptionPaddings = KeyProperties.EncryptionPadding.allToKeymaster(
                         spec.getEncryptionPaddings());
+                if (((spec.getPurposes() & KeyProperties.PURPOSE_ENCRYPT) != 0)
+                        && (spec.isRandomizedEncryptionRequired())) {
+                    for (int keymasterPadding : mKeymasterEncryptionPaddings) {
+                        if (!KeymasterUtils
+                                .isKeymasterPaddingSchemeIndCpaCompatibleWithAsymmetricCrypto(
+                                        keymasterPadding)) {
+                            throw new InvalidAlgorithmParameterException(
+                                    "Randomized encryption (IND-CPA) required but may be violated"
+                                    + " by padding scheme: "
+                                    + KeyProperties.EncryptionPadding.fromKeymaster(
+                                            keymasterPadding)
+                                    + ". See " + KeyGenParameterSpec.class.getName()
+                                    + " documentation.");
+                        }
+                    }
+                }
                 mKeymasterSignaturePaddings = KeyProperties.SignaturePadding.allToKeymaster(
                         spec.getSignaturePaddings());
                 if (spec.isDigestsSpecified()) {

keystore/java/android/security/keystore/KeymasterUtils.java

@@ -74,7 +74,7 @@ public abstract class KeymasterUtils {
                 return true;
             default:
                 throw new IllegalArgumentException(
-                        "Unsupported encryption padding scheme: " + keymasterPadding);
+                        "Unsupported asymmetric encryption padding scheme: " + keymasterPadding);
         }
     }