The legacy provider is obsolete now that all calling code has
been fixed.
Bug: 183100147
Bug: 183093711
Bug: 171305684
Test: N/A
Merged-In: I0d71d3c9cdd586a508827eb26120c872cb8643ea
Change-Id: I0d71d3c9cdd586a508827eb26120c872cb8643ea
KeyChain supports device id attestation through KeyGenParameterSpec now.
No need to call attest key individually. Also calling attest key
individually is no longer supported by Keystore 2.0 and KeyMint.
Also isBoundKeyAlgorithm returns true.
Test: atest FrameworksServicesTests:DevicePolicyManagerTest
Bug: 171305387
Merged-In: I759fe245b48fe435153fded2c74c9ae99634c146
Change-Id: I759fe245b48fe435153fded2c74c9ae99634c146
AndroidKeyStoreKeyPairGeneratorSpi used the Uid as namespace which is
wrong, and ParcelableKeyGenParameterSpec inadvertently used the Uid as
namespace specifier during conversion.
Bug: 160623310
Test: com.android.keychain.tests.BasicKeyChainServiceTest#testGenerateKeyPairErrorsOnBadUid
Change-Id: I84b4c69c639e42922449e00a3708cef89b82f63e
This allows apps to request that AndroidKeyStore generate attestation
keys that can be used to sign attestations of other keys that the app
generates or imports.
Bug: 163606833
Test: atest CtsKeystoreTests
Change-Id: I943a6922271cbe909cb3a9d67021663b5646aa70
Now that attestation and generation of keys occurs in the same step, the
device ID attestation parameters need to be passed into the
KeyPairGeneratorSpi. This change shifts functionality that was
previously in AttestationUtils into KeyGenParameterSpec and the
keystore2 KeyPairGeneratorSpi. The API changes should be gated to
Platform APIs and hidden from less privileged components.
Test: atest cts/tests/tests/keystore/src/android/keystore/cts/KeyGenParameterSpecTest.java
Bug: 177369988
Change-Id: Iafbc1661583bdf61da644b2c0838b9024018ee82
* Add missing purpose to HMAC operations.
* Pass correct key descriptor to wrapped key import.
* Corrected error message on Import wrapped key failure due to missing
wrapping key.
* Do not bail out on missing attestation challenge when device
properties are requested.
* Fix AndroidKeyStoreKey.equals(). It is sufficient to compare the
unique key ID.
Test: Keystore CTS tests.
Change-Id: Id3b93b18486e3a818ae8e91be6344294ec592e68
Bug: b/174140443
Test: atest CtsKeystoreTestCases
The new CTS tests for this feature is introduced in aosp/1556464
Change-Id: I9620c4a3e5d2c10ed8a50d494e63eb2fb19dabef
Merged-In: I9620c4a3e5d2c10ed8a50d494e63eb2fb19dabef
* The Keystore SPI needs to return null if getKeyEntry is called on a
pure certificate entry.
* Also checked the wrong purpose.
Test: Keystore CTS tests.
Change-Id: Ib668447a9ff56fc4cea550f547c6cbfea3590cb3
Certificate subject, serial, not before and not after information is now
passed to keystore/keymint for certificate generation.
Also makeDate accepts negative time values for dates predating Jan 1970
because the CTS tests likes to generate historic certificates.
Test: Keystore CTS tests.
Change-Id: I7ce664b010222298bda8049aad48f7db155a836d
AndroidKeyStorePublicKey now returns the encoded key instead of the
encoded certificate.
Test: Keystore CTS tests.
Bug: 178456047
Change-Id: I2c9b44bd13c702545b33ed0fb4c7e802c13851f6
The chunked streamer sent the chunk buffer prematurely leading to
oversized and garbage data sent to keystore.
Test: atest android.keystore.cts.SignatureTest#testSmallMsgKat
Change-Id: I84e40766b735f05b3fb7e0e692d26a25a0496649
* Correctly recover public key from certificate.
* KeyStore2ParameterUtils: iterate through set flags instead of unset
flags.
* Return private key on Keystore.getKey() instead of public key.
Test: Keystore CTS tests
Change-Id: I99c1bd49ff5cf7a2d89b54559504e67b3def0cd3
With this patch we install the old Keystore provider as
AndroidKeyStoreLegacy when the Keystore 2.0 provider is installed as
AndroidKeyStore. This allows system components to keep using the old
keystore while we can run CTS tests against the new provider.
The tests are still mostly failing at this point. Installing the new SPI
can be enabled by setting the property
ro.android.security.keystore2.enable=true
Bug: 159476414
Test: This enables running CTS tests against Keystore 2.0.
Change-Id: I9731d9783ccf8f2705a5ca7335e00c8f4c8debba
We delegate the generation of self signed certificates to the KeyMint
backend. Also we use the KeyParamter AIDL type instead of
KeymasterArguments to construct parameter lists.
Bug: 159476414
Test: None
Change-Id: I441a4d4df4ef04e3da8aeaff3274c609d549c979
We no longer need to get the key characteristics from the Keystore
daemon to construct the KeyInfo for a key. Also we have to extract the
key info from the KeyParameter AIDL type rather than from the hand
written KeymasterArguments.
This patch also exposes the correct security level for a key through
KeyInfo.
Bug: 159476414
Test: None
Change-Id: I86a85e481e19fdadfed38a42aeac4ffe5f8b83fa
This patch adjusts the AndroidKeyStoreProvider to register all services
with the correct packages names. And the utility functions load key
using the correct Keystore 2.0 methods.
Bug: 159476414
Test: None
Change-Id: I9268fd66d28e89e188e85991bcf90c7f19809232
This patch evolves the Crypto SPI to use the new Keystore 2.0 shim.
The main changes are:
* The SPI uses the AIDL defined KeyParameter instead of
KeymasterArguments.
* Operations are created directly from the KeystoreSecurityLevel that
is part of the AndroidKeyStoreKey object.
Also this patch deletes the DeletatingX509Certificate class. This is no
longer needed, because public key operations are no longer performed by
Keystore 2.0. We can delegate public certificate operations simply by
wrapping such certificates into public keys that are understood by other
providers, such as BouncyCastle.
Bug: 159476414
Test: None
Change-Id: Ice874a8121d80bf788da059b4e8420c7dd799d81
The wire type for key parameters is now generated from AIDL rather than
the hand written parcelable KeymasterArguments. So we need some of the
utilities for creating key parameters that the latter provided.
We also nicked some utility function from KeymasterUtils.
Bug: 159476414
Test: None
Change-Id: I12c674b6a00dd3abbed4972d80ceb766a73881e8
This patch makes the chunked streamer observe the simplified
Keystore 2.0 operation interface. Keystore is now required to consume
all supplied data or reject data outright if too much (more than 32KiB)
is supplied in a single transaction. This allows for a simplified
streamer logic and a simplified interface. We also no longer send
entropy to Keystore. This will be handled by the Keystore 2.0 daemon.
Test: None
Bug: 159476414
Change-Id: Ie75d10fd5d5ac0da60e23e35467d0a7873230dea
Keystore 2.0 does no longer report an error code if an operation
requires user authorization. Instead this is indicated by sending us
an operation challenge. In that case we have to check if the
authorization can possibly succeed. We changed the utility class by
adding a predicate function that checks exactly that, and we handle
other errors separately instead of having one exception handling path
that does all.
Test: None
Bug: 159476414
Change-Id: I9a373cf8f0a0b181df54c26fe314d71b6835bb97
KeyStoreKeys can now be constructed from key entry metadata and key
descriptors as defined by the new Keystore AIDL spec.
AndroidKeystorePublicKey can now create the private key proxy.
KeyStoreKeys also cache the key characteristic, which should drastically
reduce the frequency by which the SPI has to call into the Keystore 2.0
daemon.
Test: None
Bug: 159476414
Change-Id: Ia0a7841582621897760be49d39dd5442b70b3aa0
This patch copies the relevant portion of the Keystore SPI to the new
package name android.security.keystore2. The purpose of this is to
illustrate the evolution from the existing Keystore SPI to the
Keystore 2.0 SPI while keeping the existing Keystore SPI intact.
Reviewers are advised to check the equivalence of this code to the
corresponding files in
android/security/keystore (<-- no 2 here).
Subsequent patches can them be reviewed as evolution towards the new SPI
rather than completely new code.
Test: None. When the evolution is complete, Keystore CTS tests can be
used to check for regressions.
Bug: 159476414
Change-Id: I21a01a679e789868ce820b5f73221e616a456a61
