blob: 9105ee98f16fb60b3a9054554bcd5546e8fd283b [file] [log] [blame]
Shawn Willden9d645a02014-06-12 13:48:46 -06001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef ANDROID_HARDWARE_KEYMASTER_DEFS_H
18#define ANDROID_HARDWARE_KEYMASTER_DEFS_H
19
20#include <stdint.h>
21#include <stdlib.h>
22#include <string.h>
23
Shawn Willdenc51d01e2015-03-18 18:59:52 -060024#ifndef __cplusplus
25extern "C" {
26#endif // __cplusplus
Shawn Willden9d645a02014-06-12 13:48:46 -060027
Shawn Willden9d645a02014-06-12 13:48:46 -060028/**
29 * Authorization tags each have an associated type. This enumeration facilitates tagging each with
30 * a type, by using the high four bits (of an implied 32-bit unsigned enum value) to specify up to
31 * 16 data types. These values are ORed with tag IDs to generate the final tag ID values.
32 */
33typedef enum {
34 KM_INVALID = 0 << 28, /* Invalid type, used to designate a tag as uninitialized */
35 KM_ENUM = 1 << 28,
36 KM_ENUM_REP = 2 << 28, /* Repeatable enumeration value. */
37 KM_INT = 3 << 28,
38 KM_INT_REP = 4 << 28, /* Repeatable integer value */
39 KM_LONG = 5 << 28,
40 KM_DATE = 6 << 28,
41 KM_BOOL = 7 << 28,
42 KM_BIGNUM = 8 << 28,
43 KM_BYTES = 9 << 28,
Shawn Willden4719aca2015-03-14 07:54:52 -060044 KM_LONG_REP = 10 << 28, /* Repeatable long value */
Shawn Willden9d645a02014-06-12 13:48:46 -060045} keymaster_tag_type_t;
46
47typedef enum {
48 KM_TAG_INVALID = KM_INVALID | 0,
49
50 /*
51 * Tags that must be semantically enforced by hardware and software implementations.
52 */
53
54 /* Crypto parameters */
Shawn Willden79d79342015-02-10 14:29:46 -070055 KM_TAG_PURPOSE = KM_ENUM_REP | 1, /* keymaster_purpose_t. */
56 KM_TAG_ALGORITHM = KM_ENUM | 2, /* keymaster_algorithm_t. */
57 KM_TAG_KEY_SIZE = KM_INT | 3, /* Key size in bits. */
Shawn Willdenfe895d12015-02-25 17:33:40 -070058 KM_TAG_BLOCK_MODE = KM_ENUM_REP | 4, /* keymaster_block_mode_t. */
59 KM_TAG_DIGEST = KM_ENUM_REP | 5, /* keymaster_digest_t. */
60 KM_TAG_PADDING = KM_ENUM_REP | 6, /* keymaster_padding_t. */
61 KM_TAG_RETURN_UNAUTHED = KM_BOOL | 7, /* Allow AEAD decryption to return plaintext before it has
Shawn Willden79d79342015-02-10 14:29:46 -070062 been authenticated. WARNING: Not recommended. */
Shawn Willdenfe895d12015-02-25 17:33:40 -070063 KM_TAG_CALLER_NONCE = KM_BOOL | 8, /* Allow caller to specify nonce or IV. */
Shawn Willden9d645a02014-06-12 13:48:46 -060064
65 /* Other hardware-enforced. */
66 KM_TAG_RESCOPING_ADD = KM_ENUM_REP | 101, /* Tags authorized for addition via rescoping. */
67 KM_TAG_RESCOPING_DEL = KM_ENUM_REP | 102, /* Tags authorized for removal via rescoping. */
68 KM_TAG_BLOB_USAGE_REQUIREMENTS = KM_ENUM | 705, /* keymaster_key_blob_usage_requirements_t */
69
70 /* Algorithm-specific. */
71 KM_TAG_RSA_PUBLIC_EXPONENT = KM_LONG | 200, /* Defaults to 2^16+1 */
Shawn Willden9d645a02014-06-12 13:48:46 -060072
73 /*
74 * Tags that should be semantically enforced by hardware if possible and will otherwise be
75 * enforced by software (keystore).
76 */
77
78 /* Key validity period */
79 KM_TAG_ACTIVE_DATETIME = KM_DATE | 400, /* Start of validity */
80 KM_TAG_ORIGINATION_EXPIRE_DATETIME = KM_DATE | 401, /* Date when new "messages" should no
81 longer be created. */
82 KM_TAG_USAGE_EXPIRE_DATETIME = KM_DATE | 402, /* Date when existing "messages" should no
83 longer be trusted. */
84 KM_TAG_MIN_SECONDS_BETWEEN_OPS = KM_INT | 403, /* Minimum elapsed time between
85 cryptographic operations with the key. */
Shawn Willdendc0007b2015-01-23 01:01:21 -070086 KM_TAG_MAX_USES_PER_BOOT = KM_INT | 404, /* Number of times the key can be used per
87 boot. */
Shawn Willden9d645a02014-06-12 13:48:46 -060088
89 /* User authentication */
Shawn Willden4719aca2015-03-14 07:54:52 -060090 KM_TAG_ALL_USERS = KM_BOOL | 500, /* If key is usable by all users. */
91 KM_TAG_USER_ID = KM_INT | 501, /* ID of authorized user. Disallowed if
92 KM_TAG_ALL_USERS is present. */
93 KM_TAG_USER_SECURE_ID = KM_LONG_REP | 502, /* Secure ID of authorized user or authenticator(s).
94 Disallowed if KM_TAG_ALL_USERS or
95 KM_TAG_NO_AUTH_REQUIRED is present. */
96 KM_TAG_NO_AUTH_REQUIRED = KM_BOOL | 503, /* If key is usable without authentication. */
97 KM_TAG_USER_AUTH_TYPE = KM_ENUM | 504, /* Bitmask of authenticator types allowed when
98 * KM_TAG_USER_SECURE_ID contains a secure user ID,
99 * rather than a secure authenticator ID. Defined in
100 * hw_authenticator_type_t in hw_auth_token.h. */
101 KM_TAG_AUTH_TIMEOUT = KM_INT | 505, /* Required freshness of user authentication for
102 private/secret key operations, in seconds.
103 Public key operations require no authentication.
104 If absent, authentication is required for every
105 use. Authentication state is lost when the
106 device is powered off. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600107
108 /* Application access control */
109 KM_TAG_ALL_APPLICATIONS = KM_BOOL | 600, /* If key is usable by all applications. */
110 KM_TAG_APPLICATION_ID = KM_BYTES | 601, /* ID of authorized application. Disallowed if
111 KM_TAG_ALL_APPLICATIONS is present. */
112
113 /*
114 * Semantically unenforceable tags, either because they have no specific meaning or because
115 * they're informational only.
116 */
117 KM_TAG_APPLICATION_DATA = KM_BYTES | 700, /* Data provided by authorized application. */
118 KM_TAG_CREATION_DATETIME = KM_DATE | 701, /* Key creation time */
119 KM_TAG_ORIGIN = KM_ENUM | 702, /* keymaster_key_origin_t. */
120 KM_TAG_ROLLBACK_RESISTANT = KM_BOOL | 703, /* Whether key is rollback-resistant. */
121 KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704, /* Root of trust ID. Empty array means usable by all
122 roots. */
123
Shawn Willden67ba9e82015-02-06 17:04:53 -0700124 /* Tags used only to provide data to or receive data from operations */
125 KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000, /* Used to provide associated data for AEAD modes. */
Shawn Willden41e91e92015-01-30 06:23:26 -0700126 KM_TAG_NONCE = KM_BYTES | 1001, /* Nonce or Initialization Vector */
Shawn Willden79d79342015-02-10 14:29:46 -0700127 KM_TAG_CHUNK_LENGTH = KM_INT | 1002, /* AEAD mode chunk size, in bytes. 0 means no limit,
128 which requires KM_TAG_RETURN_UNAUTHED. */
Shawn Willdenc3ab05c2015-03-14 08:23:41 -0600129 KM_TAG_AUTH_TOKEN = KM_BYTES | 1003, /* Authentication token that proves secure user
130 authentication has been performed. Structure
131 defined in hw_auth_token_t in hw_auth_token.h. */
Shawn Willdenfe895d12015-02-25 17:33:40 -0700132 KM_TAG_MAC_LENGTH = KM_INT | 1004, /* MAC or AEAD authentication tag length in bits. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600133} keymaster_tag_t;
134
135/**
136 * Algorithms that may be provided by keymaster implementations. Those that must be provided by all
Shawn Willdenfd4b4d52015-02-24 09:17:38 -0700137 * implementations are tagged as "required".
Shawn Willden9d645a02014-06-12 13:48:46 -0600138 */
139typedef enum {
140 /* Asymmetric algorithms. */
Shawn Willdene9797a72015-04-07 13:39:12 -0600141 KM_ALGORITHM_RSA = 1,
142 // KM_ALGORITHM_DSA = 2, -- Removed, do not re-use value 2.
143 KM_ALGORITHM_EC = 3,
144
145 /* Block ciphers algorithms */
146 KM_ALGORITHM_AES = 32,
147
Shawn Willden9d645a02014-06-12 13:48:46 -0600148 /* MAC algorithms */
Shawn Willdene9797a72015-04-07 13:39:12 -0600149 KM_ALGORITHM_HMAC = 128,
Shawn Willden9d645a02014-06-12 13:48:46 -0600150} keymaster_algorithm_t;
151
152/**
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600153 * Symmetric block cipher modes provided by keymaster implementations.
Shawn Willden9d645a02014-06-12 13:48:46 -0600154 *
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600155 * KM_MODE_FIRST_UNAUTHENTICATED and KM_MODE_FIRST_AUTHENTICATED are not modes but markers used to
156 * separate the available modes into classes.
Shawn Willden9d645a02014-06-12 13:48:46 -0600157 */
158typedef enum {
159 /* Unauthenticated modes, usable only for encryption/decryption and not generally recommended
160 * except for compatibility with existing other protocols. */
161 KM_MODE_FIRST_UNAUTHENTICATED = 1,
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600162 KM_MODE_ECB = KM_MODE_FIRST_UNAUTHENTICATED,
163 KM_MODE_CBC = 2,
164 KM_MODE_CTR = 4,
165
Shawn Willden9d645a02014-06-12 13:48:46 -0600166 /* Authenticated modes, usable for encryption/decryption and signing/verification. Recommended
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600167 * over unauthenticated modes for all purposes. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600168 KM_MODE_FIRST_AUTHENTICATED = 32,
169 KM_MODE_GCM = KM_MODE_FIRST_AUTHENTICATED,
Shawn Willden9d645a02014-06-12 13:48:46 -0600170} keymaster_block_mode_t;
171
172/**
173 * Padding modes that may be applied to plaintext for encryption operations. This list includes
174 * padding modes for both symmetric and asymmetric algorithms. Note that implementations should not
175 * provide all possible combinations of algorithm and padding, only the
176 * cryptographically-appropriate pairs.
177 */
178typedef enum {
Shawn Willden8412fdc2015-04-07 13:41:30 -0600179 KM_PAD_NONE = 1, /* deprecated */
180 KM_PAD_RSA_OAEP = 2,
181 KM_PAD_RSA_PSS = 3,
Shawn Willden9d645a02014-06-12 13:48:46 -0600182 KM_PAD_RSA_PKCS1_1_5_ENCRYPT = 4,
183 KM_PAD_RSA_PKCS1_1_5_SIGN = 5,
Shawn Willden8412fdc2015-04-07 13:41:30 -0600184 KM_PAD_PKCS7 = 64,
Shawn Willden9d645a02014-06-12 13:48:46 -0600185} keymaster_padding_t;
186
187/**
Shawn Willdenfe6c4f02015-04-07 14:02:28 -0600188 * Digests provided by keymaster implementations.
Shawn Willden9d645a02014-06-12 13:48:46 -0600189 */
190typedef enum {
Shawn Willdenfe6c4f02015-04-07 14:02:28 -0600191 KM_DIGEST_NONE = 0,
192 KM_DIGEST_MD5 = 1, /* Optional, may not be implemented in hardware, will be handled in software
193 * if needed. */
194 KM_DIGEST_SHA1 = 2,
195 KM_DIGEST_SHA_2_224 = 3,
196 KM_DIGEST_SHA_2_256 = 4,
197 KM_DIGEST_SHA_2_384 = 5,
198 KM_DIGEST_SHA_2_512 = 6,
Shawn Willden9d645a02014-06-12 13:48:46 -0600199} keymaster_digest_t;
200
201/**
Shawn Willden8d6cf252015-04-07 13:56:30 -0600202 * The origin of a key (or pair), i.e. where it was generated. Note that KM_TAG_ORIGIN can be found
203 * in either the hardware-enforced or software-enforced list for a key, indicating whether the key
204 * is hardware or software-based. Specifically, a key with KM_ORIGIN_GENERATED in the
205 * hardware-enforced list is guaranteed never to have existed outide the secure hardware.
Shawn Willden9d645a02014-06-12 13:48:46 -0600206 */
207typedef enum {
Shawn Willden8d6cf252015-04-07 13:56:30 -0600208 KM_ORIGIN_GENERATED = 0, /* Generated in keymaster */
Shawn Willdend359b042015-04-13 11:07:24 -0600209 KM_ORIGIN_IMPORTED = 2, /* Imported, origin unknown */
210 KM_ORIGIN_UNKNOWN = 3, /* Keymaster did not record origin. This value can only be seen on
211 * keys in a keymaster0 implementation. The keymaster0 adapter uses
212 * this value to document the fact that it is unkown whether the key
213 * was generated inside or imported into keymaster. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600214} keymaster_key_origin_t;
215
216/**
217 * Usability requirements of key blobs. This defines what system functionality must be available
218 * for the key to function. For example, key "blobs" which are actually handles referencing
219 * encrypted key material stored in the file system cannot be used until the file system is
220 * available, and should have BLOB_REQUIRES_FILE_SYSTEM. Other requirements entries will be added
221 * as needed for implementations. This type is new in 0_4.
222 */
223typedef enum {
224 KM_BLOB_STANDALONE = 0,
225 KM_BLOB_REQUIRES_FILE_SYSTEM = 1,
226} keymaster_key_blob_usage_requirements_t;
227
228/**
229 * Possible purposes of a key (or pair). This type is new in 0_4.
230 */
231typedef enum {
232 KM_PURPOSE_ENCRYPT = 0,
233 KM_PURPOSE_DECRYPT = 1,
234 KM_PURPOSE_SIGN = 2,
235 KM_PURPOSE_VERIFY = 3,
236} keymaster_purpose_t;
237
238typedef struct {
239 const uint8_t* data;
240 size_t data_length;
241} keymaster_blob_t;
242
243typedef struct {
244 keymaster_tag_t tag;
245 union {
246 uint32_t enumerated; /* KM_ENUM and KM_ENUM_REP */
247 bool boolean; /* KM_BOOL */
248 uint32_t integer; /* KM_INT and KM_INT_REP */
249 uint64_t long_integer; /* KM_LONG */
250 uint64_t date_time; /* KM_DATE */
251 keymaster_blob_t blob; /* KM_BIGNUM and KM_BYTES*/
252 };
253} keymaster_key_param_t;
254
255typedef struct {
256 keymaster_key_param_t* params; /* may be NULL if length == 0 */
257 size_t length;
258} keymaster_key_param_set_t;
259
260/**
261 * Parameters that define a key's characteristics, including authorized modes of usage and access
262 * control restrictions. The parameters are divided into two categories, those that are enforced by
263 * secure hardware, and those that are not. For a software-only keymaster implementation the
264 * enforced array must NULL. Hardware implementations must enforce everything in the enforced
265 * array.
266 */
267typedef struct {
268 keymaster_key_param_set_t hw_enforced;
269 keymaster_key_param_set_t sw_enforced;
270} keymaster_key_characteristics_t;
271
272typedef struct {
273 const uint8_t* key_material;
274 size_t key_material_size;
275} keymaster_key_blob_t;
276
277/**
278 * Formats for key import and export. At present, only asymmetric key import/export is supported.
279 * In the future this list will expand greatly to accommodate asymmetric key import/export.
280 */
281typedef enum {
Shawn Willdencd640d12015-04-07 13:48:27 -0600282 KM_KEY_FORMAT_X509 = 0, /* for public key export */
283 KM_KEY_FORMAT_PKCS8 = 1, /* for asymmetric key pair import */
284 KM_KEY_FORMAT_RAW = 3, /* for symmetric key import */
Shawn Willden9d645a02014-06-12 13:48:46 -0600285} keymaster_key_format_t;
286
287/**
288 * The keymaster operation API consists of begin, update, finish and abort. This is the type of the
289 * handle used to tie the sequence of calls together. A 64-bit value is used because it's important
290 * that handles not be predictable. Implementations must use strong random numbers for handle
291 * values.
292 */
293typedef uint64_t keymaster_operation_handle_t;
294
295typedef enum {
296 KM_ERROR_OK = 0,
297 KM_ERROR_ROOT_OF_TRUST_ALREADY_SET = -1,
298 KM_ERROR_UNSUPPORTED_PURPOSE = -2,
299 KM_ERROR_INCOMPATIBLE_PURPOSE = -3,
300 KM_ERROR_UNSUPPORTED_ALGORITHM = -4,
301 KM_ERROR_INCOMPATIBLE_ALGORITHM = -5,
302 KM_ERROR_UNSUPPORTED_KEY_SIZE = -6,
303 KM_ERROR_UNSUPPORTED_BLOCK_MODE = -7,
304 KM_ERROR_INCOMPATIBLE_BLOCK_MODE = -8,
Shawn Willden6b424be2015-01-26 13:04:28 -0700305 KM_ERROR_UNSUPPORTED_MAC_LENGTH = -9,
Shawn Willden9d645a02014-06-12 13:48:46 -0600306 KM_ERROR_UNSUPPORTED_PADDING_MODE = -10,
307 KM_ERROR_INCOMPATIBLE_PADDING_MODE = -11,
308 KM_ERROR_UNSUPPORTED_DIGEST = -12,
309 KM_ERROR_INCOMPATIBLE_DIGEST = -13,
310 KM_ERROR_INVALID_EXPIRATION_TIME = -14,
311 KM_ERROR_INVALID_USER_ID = -15,
312 KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT = -16,
313 KM_ERROR_UNSUPPORTED_KEY_FORMAT = -17,
314 KM_ERROR_INCOMPATIBLE_KEY_FORMAT = -18,
315 KM_ERROR_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = -19, /* For PKCS8 & PKCS12 */
316 KM_ERROR_UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = -20, /* For PKCS8 & PKCS12 */
317 KM_ERROR_INVALID_INPUT_LENGTH = -21,
318 KM_ERROR_KEY_EXPORT_OPTIONS_INVALID = -22,
319 KM_ERROR_DELEGATION_NOT_ALLOWED = -23,
320 KM_ERROR_KEY_NOT_YET_VALID = -24,
321 KM_ERROR_KEY_EXPIRED = -25,
322 KM_ERROR_KEY_USER_NOT_AUTHENTICATED = -26,
323 KM_ERROR_OUTPUT_PARAMETER_NULL = -27,
324 KM_ERROR_INVALID_OPERATION_HANDLE = -28,
325 KM_ERROR_INSUFFICIENT_BUFFER_SPACE = -29,
326 KM_ERROR_VERIFICATION_FAILED = -30,
327 KM_ERROR_TOO_MANY_OPERATIONS = -31,
328 KM_ERROR_UNEXPECTED_NULL_POINTER = -32,
329 KM_ERROR_INVALID_KEY_BLOB = -33,
330 KM_ERROR_IMPORTED_KEY_NOT_ENCRYPTED = -34,
331 KM_ERROR_IMPORTED_KEY_DECRYPTION_FAILED = -35,
332 KM_ERROR_IMPORTED_KEY_NOT_SIGNED = -36,
333 KM_ERROR_IMPORTED_KEY_VERIFICATION_FAILED = -37,
334 KM_ERROR_INVALID_ARGUMENT = -38,
335 KM_ERROR_UNSUPPORTED_TAG = -39,
336 KM_ERROR_INVALID_TAG = -40,
337 KM_ERROR_MEMORY_ALLOCATION_FAILED = -41,
338 KM_ERROR_INVALID_RESCOPING = -42,
Shawn Willden9d645a02014-06-12 13:48:46 -0600339 KM_ERROR_IMPORT_PARAMETER_MISMATCH = -44,
340 KM_ERROR_SECURE_HW_ACCESS_DENIED = -45,
341 KM_ERROR_OPERATION_CANCELLED = -46,
342 KM_ERROR_CONCURRENT_ACCESS_CONFLICT = -47,
343 KM_ERROR_SECURE_HW_BUSY = -48,
344 KM_ERROR_SECURE_HW_COMMUNICATION_FAILED = -49,
345 KM_ERROR_UNSUPPORTED_EC_FIELD = -50,
Shawn Willdened941112015-03-11 21:53:59 -0600346 KM_ERROR_MISSING_NONCE = -51,
347 KM_ERROR_INVALID_NONCE = -52,
348 KM_ERROR_UNSUPPORTED_CHUNK_LENGTH = -53,
349 KM_ERROR_RESCOPABLE_KEY_NOT_USABLE = -54,
Shawn Willden4bdd7cb2015-04-28 00:00:27 -0600350 KM_ERROR_CALLER_NONCE_PROHIBITED = -55,
Shawn Willdened941112015-03-11 21:53:59 -0600351
Shawn Willden9d645a02014-06-12 13:48:46 -0600352 KM_ERROR_UNIMPLEMENTED = -100,
353 KM_ERROR_VERSION_MISMATCH = -101,
354
355 /* Additional error codes may be added by implementations, but implementers should coordinate
356 * with Google to avoid code collision. */
357 KM_ERROR_UNKNOWN_ERROR = -1000,
358} keymaster_error_t;
359
Shawn Willden9d645a02014-06-12 13:48:46 -0600360/* Convenience functions for manipulating keymaster tag types */
361
362static inline keymaster_tag_type_t keymaster_tag_get_type(keymaster_tag_t tag) {
363 return (keymaster_tag_type_t)(tag & (0xF << 28));
364}
365
366static inline uint32_t keymaster_tag_mask_type(keymaster_tag_t tag) {
367 return tag & 0x0FFFFFFF;
368}
369
370static inline bool keymaster_tag_type_repeatable(keymaster_tag_type_t type) {
371 switch (type) {
372 case KM_INT_REP:
373 case KM_ENUM_REP:
374 return true;
375 default:
376 return false;
377 }
378}
379
380static inline bool keymaster_tag_repeatable(keymaster_tag_t tag) {
381 return keymaster_tag_type_repeatable(keymaster_tag_get_type(tag));
382}
383
384/* Convenience functions for manipulating keymaster_key_param_t structs */
385
386inline keymaster_key_param_t keymaster_param_enum(keymaster_tag_t tag, uint32_t value) {
387 // assert(keymaster_tag_get_type(tag) == KM_ENUM || keymaster_tag_get_type(tag) == KM_ENUM_REP);
388 keymaster_key_param_t param;
389 memset(&param, 0, sizeof(param));
390 param.tag = tag;
391 param.enumerated = value;
392 return param;
393}
394
395inline keymaster_key_param_t keymaster_param_int(keymaster_tag_t tag, uint32_t value) {
396 // assert(keymaster_tag_get_type(tag) == KM_INT || keymaster_tag_get_type(tag) == KM_INT_REP);
397 keymaster_key_param_t param;
398 memset(&param, 0, sizeof(param));
399 param.tag = tag;
400 param.integer = value;
401 return param;
402}
403
404inline keymaster_key_param_t keymaster_param_long(keymaster_tag_t tag, uint64_t value) {
405 // assert(keymaster_tag_get_type(tag) == KM_LONG);
406 keymaster_key_param_t param;
407 memset(&param, 0, sizeof(param));
408 param.tag = tag;
409 param.long_integer = value;
410 return param;
411}
412
413inline keymaster_key_param_t keymaster_param_blob(keymaster_tag_t tag, const uint8_t* bytes,
414 size_t bytes_len) {
415 // assert(keymaster_tag_get_type(tag) == KM_BYTES || keymaster_tag_get_type(tag) == KM_BIGNUM);
416 keymaster_key_param_t param;
417 memset(&param, 0, sizeof(param));
418 param.tag = tag;
419 param.blob.data = (uint8_t*)bytes;
420 param.blob.data_length = bytes_len;
421 return param;
422}
423
424inline keymaster_key_param_t keymaster_param_bool(keymaster_tag_t tag) {
425 // assert(keymaster_tag_get_type(tag) == KM_BOOL);
426 keymaster_key_param_t param;
427 memset(&param, 0, sizeof(param));
428 param.tag = tag;
429 param.boolean = true;
430 return param;
431}
432
433inline keymaster_key_param_t keymaster_param_date(keymaster_tag_t tag, uint64_t value) {
434 // assert(keymaster_tag_get_type(tag) == KM_DATE);
435 keymaster_key_param_t param;
436 memset(&param, 0, sizeof(param));
437 param.tag = tag;
438 param.date_time = value;
439 return param;
440}
441
Shawn Willden67411d62015-03-04 10:00:38 -0700442#define KEYMASTER_SIMPLE_COMPARE(a, b) (a < b) ? -1 : ((a > b) ? 1 : 0)
443inline int keymaster_param_compare(const keymaster_key_param_t* a, const keymaster_key_param_t* b) {
444 int retval = KEYMASTER_SIMPLE_COMPARE(a->tag, b->tag);
445 if (retval != 0)
446 return retval;
447
448 switch (keymaster_tag_get_type(a->tag)) {
449 case KM_INVALID:
450 case KM_BOOL:
451 return 0;
452 case KM_ENUM:
453 case KM_ENUM_REP:
454 return KEYMASTER_SIMPLE_COMPARE(a->enumerated, b->enumerated);
455 case KM_INT:
456 case KM_INT_REP:
457 return KEYMASTER_SIMPLE_COMPARE(a->integer, b->integer);
458 case KM_LONG:
Shawn Willden4719aca2015-03-14 07:54:52 -0600459 case KM_LONG_REP:
Shawn Willden67411d62015-03-04 10:00:38 -0700460 return KEYMASTER_SIMPLE_COMPARE(a->long_integer, b->long_integer);
461 case KM_DATE:
462 return KEYMASTER_SIMPLE_COMPARE(a->date_time, b->date_time);
463 case KM_BIGNUM:
464 case KM_BYTES:
465 // Handle the empty cases.
466 if (a->blob.data_length != 0 && b->blob.data_length == 0)
467 return -1;
468 if (a->blob.data_length == 0 && b->blob.data_length == 0)
469 return 0;
470 if (a->blob.data_length == 0 && b->blob.data_length > 0)
471 return 1;
472
473 retval = memcmp(a->blob.data, b->blob.data, a->blob.data_length < b->blob.data_length
474 ? a->blob.data_length
475 : b->blob.data_length);
476 if (retval != 0)
477 return retval;
478 else if (a->blob.data_length != b->blob.data_length) {
479 // Equal up to the common length; longer one is larger.
480 if (a->blob.data_length < b->blob.data_length)
481 return -1;
482 if (a->blob.data_length > b->blob.data_length)
483 return 1;
484 };
485 }
486
487 return 0;
488}
489#undef KEYMASTER_SIMPLE_COMPARE
490
Shawn Willden9d645a02014-06-12 13:48:46 -0600491inline void keymaster_free_param_values(keymaster_key_param_t* param, size_t param_count) {
492 while (param_count-- > 0) {
493 switch (keymaster_tag_get_type(param->tag)) {
494 case KM_BIGNUM:
495 case KM_BYTES:
496 free((void*)param->blob.data);
497 param->blob.data = NULL;
498 break;
499 default:
500 // NOP
501 break;
502 }
503 ++param;
504 }
505}
506
507inline void keymaster_free_param_set(keymaster_key_param_set_t* set) {
508 if (set) {
509 keymaster_free_param_values(set->params, set->length);
510 free(set->params);
511 set->params = NULL;
512 }
513}
514
515inline void keymaster_free_characteristics(keymaster_key_characteristics_t* characteristics) {
516 if (characteristics) {
517 keymaster_free_param_set(&characteristics->hw_enforced);
518 keymaster_free_param_set(&characteristics->sw_enforced);
519 }
520}
521
Shawn Willdenc51d01e2015-03-18 18:59:52 -0600522#ifndef __cplusplus
523} // extern "C"
524#endif // __cplusplus
Shawn Willden9d645a02014-06-12 13:48:46 -0600525
526#endif // ANDROID_HARDWARE_KEYMASTER_DEFS_H