Key derivation for session encryption and MACing now involves mixing
in SessionTranscriptBytes. Update docs to reflect this.
Also, the standard changed such that instead of DeviceAuthentication
being MACed or signed, it's instead DeviceAuthenticationBytes which is
defined as #6.24(bstr .cbor DeviceAuthentication). The same also for
ReaderAuthentication, now ReaderAuthenticationBytes is the CBOR which
is signed by the reader.
Also make a note that the encryptMessageToReader() and
decryptMessageFromReader() should NOT be used and applications should
instead implement these themselves. This is because we don't have the
SessionTranscript available and it's way too late to start adding
public API now. For the next Android version these methods will be
deprecated. Realistically this shouldn't be a problem because
applications are expected to use the Jetpack anyway.
Bug: 159482543
Test: atest android.security.identity.cts
Merged-In: I380a973a0cc78f1206fd7a33d0bd4896a0b16c6d
Change-Id: I8b2931b4f44a398bcbeb753fafa91a509cf68780
This change contains no actual syntactical or semantic changes, just
clarifications on the inputs and outputs.
Test: N/A
Bug: 151082886
Merged-In: Ic7797aa53d292abdeb779cb55b404f8a433bce79
Change-Id: I90279c1ba434a9305b991863086b867309549ce8
The Identity Credential APIs provides an interface to a secure store
for user identity documents. These APIs are deliberately fairly
general and abstract. To the extent possible, specification of the
message formats and semantics of communication with credential
verification devices and Issuing Authorities (IAs) is out of scope for
these APIs.
The Identity Credential APIs rely on user authentication to protect
data elements in credentials which is implemented through
auth-tokens. This CL contains changes to CryptoObject to allow this.
Bug: 111446262
Test: CtsIdentityTestCases
Change-Id: I48f21a561b762d86c9ca8d229962782572412f47
