This is the first in a set of changes that get RKP error data directly
from keystore.
Starting with Android U, we get detailed RKP error information directly
in the ResponseCode from keystore. This means mRkpStatus and related
logic can be removed after AOSP fully switches over to using rkpd
from the old RemoteProvisioner.
Test: RkpdAppUnitTests
Bug: 264888027
Change-Id: I32e128cca51b2d7dfdd67824ecb100f4e1cd4341
We are adding the error codes ERROR_DEVICE_UNREGISTERED and
ERROR_DEVICE_POTENTIALLY_VULNERABLE to reflect the new changes
described in go/surface-rkp-status.
Test: Unit test and Cts test added to KeystoreExceptionTest and run using atest CtsKeystoreTestCases
Change-Id: Ie93814aaa5422e323d5a643e10e9fe4a51c07560
On systems that rely solely on remotely-provisioned keys (RKP),
the attestation keys may run out or be unavailable for attesting
a newly-generated key. This could happen when:
* the device first connects to the Internet
* The device had all the keys used and:
** It hadn't yet completed obtaining new ones.
** The RKP server declines to issue new keys.
In these cases, the caller must be informed that their key generation
request failed (likely temporarily), and that they should retry it.
The retry policy returned tells the caller when to re-try.
Bug: 227306369
Test: atest android.keystore.cts.KeyStoreExceptionTest
Merged-In: Ief30a3ab97da95b68d172e725c38acbefab92fa9
Change-Id: I0b2619fcbcb3ac4d94ed85f3ce5934e015c0828c
Surface the service-specific error message. To avoid API changes, the
error message is surfaced in the toString / getMessage methods.
Test: atest android.security.keystore.KeyStoreExceptionTest
Bug: 217593122
Change-Id: Id4090564b46db9b3b10ea390390f6683f7314463
Report KeyStore/KeyMint error messages via public API.
This lets developers find out:
* Whether an error is transient or not.
* Whether a failure is due to a system error
(system configuration/state/capabilities), or a key-related error.
* Whether user authentication is required to use the key.
Test: atest CtsKeystorePerformanceTestCases CtsKeystoreTestCases
Bug: 197890905
Merged-In: I776d9e9cc01a9dc3542a63000ee0709847760963
Change-Id: Ica0c93fdd4b89255ee0a03a9b9b948202777d4d4
The code in question talks to KeyStore which returns error codes
which are a mix of keystore and keymaster error codes. To better
match the layering of KeyStore on top of keystore and keymaster,
this CL renames KeymasterException into KeyStoreException. It also
adds human-readable error messages to exceptions raised by keystore
rather than keymaster (e.g., key not found).
Bug: 18088752
Change-Id: I4cd1235e16518c9f2e8c5557a457774c6e687b88
