Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2015 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include "rsa_keymaster0_key.h" |
| 18 | |
| 19 | #include <memory> |
| 20 | |
Shawn Willden | 0629810 | 2015-05-25 23:12:48 -0600 | [diff] [blame] | 21 | #include <keymaster/android_keymaster_utils.h> |
| 22 | #include <keymaster/logger.h> |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 23 | #include <keymaster/soft_keymaster_context.h> |
| 24 | |
| 25 | #include "keymaster0_engine.h" |
| 26 | #include "openssl_utils.h" |
| 27 | |
| 28 | using std::unique_ptr; |
| 29 | |
| 30 | namespace keymaster { |
| 31 | |
| 32 | RsaKeymaster0KeyFactory::RsaKeymaster0KeyFactory(const SoftKeymasterContext* context, |
| 33 | const Keymaster0Engine* engine) |
Shawn Willden | d599b15 | 2015-07-27 16:58:30 -0600 | [diff] [blame] | 34 | : RsaKeyFactory(context), engine_(engine) {} |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 35 | |
| 36 | keymaster_error_t RsaKeymaster0KeyFactory::GenerateKey(const AuthorizationSet& key_description, |
| 37 | KeymasterKeyBlob* key_blob, |
| 38 | AuthorizationSet* hw_enforced, |
Shawn Willden | 0629810 | 2015-05-25 23:12:48 -0600 | [diff] [blame] | 39 | AuthorizationSet* sw_enforced) const { |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 40 | if (!key_blob || !hw_enforced || !sw_enforced) |
| 41 | return KM_ERROR_OUTPUT_PARAMETER_NULL; |
| 42 | |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 43 | uint64_t public_exponent; |
| 44 | if (!key_description.GetTagValue(TAG_RSA_PUBLIC_EXPONENT, &public_exponent)) { |
| 45 | LOG_E("%s", "No public exponent specified for RSA key generation"); |
| 46 | return KM_ERROR_INVALID_ARGUMENT; |
| 47 | } |
| 48 | |
| 49 | uint32_t key_size; |
| 50 | if (!key_description.GetTagValue(TAG_KEY_SIZE, &key_size)) { |
| 51 | LOG_E("%s", "No key size specified for RSA key generation"); |
| 52 | return KM_ERROR_UNSUPPORTED_KEY_SIZE; |
| 53 | } |
| 54 | |
| 55 | KeymasterKeyBlob key_material; |
| 56 | if (!engine_->GenerateRsaKey(public_exponent, key_size, &key_material)) |
| 57 | return KM_ERROR_UNKNOWN_ERROR; |
| 58 | |
| 59 | // These tags are hardware-enforced. Putting them in the hw_enforced set here will ensure that |
| 60 | // context_->CreateKeyBlob doesn't put them in sw_enforced. |
| 61 | hw_enforced->push_back(TAG_ALGORITHM, KM_ALGORITHM_RSA); |
| 62 | hw_enforced->push_back(TAG_RSA_PUBLIC_EXPONENT, public_exponent); |
| 63 | hw_enforced->push_back(TAG_KEY_SIZE, key_size); |
Shawn Willden | 34f09c5 | 2015-07-23 23:17:39 +0000 | [diff] [blame] | 64 | hw_enforced->push_back(TAG_ORIGIN, KM_ORIGIN_UNKNOWN); |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 65 | |
Shawn Willden | 34f09c5 | 2015-07-23 23:17:39 +0000 | [diff] [blame] | 66 | return context_->CreateKeyBlob(key_description, KM_ORIGIN_UNKNOWN, key_material, key_blob, |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 67 | hw_enforced, sw_enforced); |
| 68 | } |
| 69 | |
| 70 | keymaster_error_t RsaKeymaster0KeyFactory::ImportKey( |
| 71 | const AuthorizationSet& key_description, keymaster_key_format_t input_key_material_format, |
| 72 | const KeymasterKeyBlob& input_key_material, KeymasterKeyBlob* output_key_blob, |
Shawn Willden | 0629810 | 2015-05-25 23:12:48 -0600 | [diff] [blame] | 73 | AuthorizationSet* hw_enforced, AuthorizationSet* sw_enforced) const { |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 74 | if (!output_key_blob || !hw_enforced || !sw_enforced) |
| 75 | return KM_ERROR_OUTPUT_PARAMETER_NULL; |
| 76 | |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 77 | AuthorizationSet authorizations; |
| 78 | uint64_t public_exponent; |
| 79 | uint32_t key_size; |
| 80 | keymaster_error_t error = |
| 81 | UpdateImportKeyDescription(key_description, input_key_material_format, input_key_material, |
| 82 | &authorizations, &public_exponent, &key_size); |
| 83 | if (error != KM_ERROR_OK) |
| 84 | return error; |
| 85 | |
| 86 | KeymasterKeyBlob imported_hw_key; |
Shawn Willden | 6270aca | 2015-05-26 13:12:24 -0600 | [diff] [blame] | 87 | if (!engine_->ImportKey(input_key_material_format, input_key_material, &imported_hw_key)) |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 88 | return KM_ERROR_UNKNOWN_ERROR; |
| 89 | |
| 90 | // These tags are hardware-enforced. Putting them in the hw_enforced set here will ensure that |
| 91 | // context_->CreateKeyBlob doesn't put them in sw_enforced. |
| 92 | hw_enforced->push_back(TAG_ALGORITHM, KM_ALGORITHM_RSA); |
| 93 | hw_enforced->push_back(TAG_RSA_PUBLIC_EXPONENT, public_exponent); |
| 94 | hw_enforced->push_back(TAG_KEY_SIZE, key_size); |
Shawn Willden | 34f09c5 | 2015-07-23 23:17:39 +0000 | [diff] [blame] | 95 | hw_enforced->push_back(TAG_ORIGIN, KM_ORIGIN_UNKNOWN); |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 96 | |
Shawn Willden | 34f09c5 | 2015-07-23 23:17:39 +0000 | [diff] [blame] | 97 | return context_->CreateKeyBlob(authorizations, KM_ORIGIN_UNKNOWN, imported_hw_key, |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 98 | output_key_blob, hw_enforced, sw_enforced); |
| 99 | } |
| 100 | |
| 101 | keymaster_error_t RsaKeymaster0KeyFactory::LoadKey(const KeymasterKeyBlob& key_material, |
Shawn Willden | d599b15 | 2015-07-27 16:58:30 -0600 | [diff] [blame] | 102 | const AuthorizationSet& additional_params, |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 103 | const AuthorizationSet& hw_enforced, |
| 104 | const AuthorizationSet& sw_enforced, |
Shawn Willden | 0629810 | 2015-05-25 23:12:48 -0600 | [diff] [blame] | 105 | UniquePtr<Key>* key) const { |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 106 | if (!key) |
| 107 | return KM_ERROR_OUTPUT_PARAMETER_NULL; |
| 108 | |
| 109 | if (sw_enforced.GetTagCount(TAG_ALGORITHM) == 1) |
Shawn Willden | d599b15 | 2015-07-27 16:58:30 -0600 | [diff] [blame] | 110 | return super::LoadKey(key_material, additional_params, hw_enforced, sw_enforced, key); |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 111 | |
| 112 | unique_ptr<RSA, RSA_Delete> rsa(engine_->BlobToRsaKey(key_material)); |
| 113 | if (!rsa) |
| 114 | return KM_ERROR_UNKNOWN_ERROR; |
| 115 | |
| 116 | keymaster_error_t error; |
Shawn Willden | 0f906ec | 2015-06-20 09:16:30 -0600 | [diff] [blame] | 117 | key->reset(new (std::nothrow) |
| 118 | RsaKeymaster0Key(rsa.release(), hw_enforced, sw_enforced, engine_, &error)); |
Shawn Willden | d530305 | 2015-06-22 05:25:59 -0600 | [diff] [blame] | 119 | if (!key->get()) |
Shawn Willden | 0f906ec | 2015-06-20 09:16:30 -0600 | [diff] [blame] | 120 | error = KM_ERROR_MEMORY_ALLOCATION_FAILED; |
| 121 | |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 122 | if (error != KM_ERROR_OK) |
| 123 | return error; |
| 124 | |
| 125 | return KM_ERROR_OK; |
| 126 | } |
| 127 | |
| 128 | RsaKeymaster0Key::RsaKeymaster0Key(RSA* rsa_key, const AuthorizationSet& hw_enforced, |
| 129 | const AuthorizationSet& sw_enforced, |
| 130 | const Keymaster0Engine* engine, keymaster_error_t* error) |
Shawn Willden | 0f906ec | 2015-06-20 09:16:30 -0600 | [diff] [blame] | 131 | : RsaKey(rsa_key, hw_enforced, sw_enforced, error), engine_(engine) {} |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 132 | |
Shawn Willden | 2beb628 | 2015-05-20 16:36:24 -0600 | [diff] [blame] | 133 | } // namespace keymaster |