Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Robert Berry | 5397d4d | 2017-12-12 13:22:00 +0000 | [diff] [blame] | 17 | package com.android.server.locksettings.recoverablekeystore; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 18 | |
Robert Berry | cfc990a | 2017-12-22 15:54:30 +0000 | [diff] [blame] | 19 | import static junit.framework.Assert.assertNotNull; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 20 | |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 21 | import static org.junit.Assert.assertArrayEquals; |
Robert Berry | cfc990a | 2017-12-22 15:54:30 +0000 | [diff] [blame] | 22 | import static org.junit.Assert.assertEquals; |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 23 | |
| 24 | import android.content.Context; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 25 | import android.security.keystore.AndroidKeyStoreSecretKey; |
| 26 | import android.security.keystore.KeyGenParameterSpec; |
| 27 | import android.security.keystore.KeyProperties; |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 28 | import android.support.test.InstrumentationRegistry; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 29 | import android.support.test.filters.SmallTest; |
| 30 | import android.support.test.runner.AndroidJUnit4; |
| 31 | |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 32 | import com.android.server.locksettings.recoverablekeystore.storage.RecoverableKeyStoreDb; |
| 33 | |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 34 | import org.junit.After; |
| 35 | import org.junit.Before; |
| 36 | import org.junit.Test; |
| 37 | import org.junit.runner.RunWith; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 38 | |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 39 | import java.io.File; |
| 40 | import java.nio.charset.StandardCharsets; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 41 | import java.security.KeyStore; |
Bo Zhu | 2c8e538 | 2018-02-26 15:54:25 -0800 | [diff] [blame^] | 42 | import java.util.Random; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 43 | |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 44 | import javax.crypto.Cipher; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 45 | import javax.crypto.KeyGenerator; |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 46 | import javax.crypto.spec.GCMParameterSpec; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 47 | |
| 48 | @SmallTest |
| 49 | @RunWith(AndroidJUnit4.class) |
| 50 | public class RecoverableKeyGeneratorTest { |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 51 | private static final String DATABASE_FILE_NAME = "recoverablekeystore.db"; |
Robert Berry | 67b228c | 2017-12-18 19:26:22 +0000 | [diff] [blame] | 52 | private static final int TEST_GENERATION_ID = 3; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 53 | private static final String ANDROID_KEY_STORE_PROVIDER = "AndroidKeyStore"; |
| 54 | private static final String KEY_ALGORITHM = "AES"; |
Bo Zhu | 2c8e538 | 2018-02-26 15:54:25 -0800 | [diff] [blame^] | 55 | private static final int KEY_SIZE_BYTES = RecoverableKeyGenerator.KEY_SIZE_BITS / Byte.SIZE; |
Robert Berry | cfc990a | 2017-12-22 15:54:30 +0000 | [diff] [blame] | 56 | private static final String KEY_WRAP_ALGORITHM = "AES/GCM/NoPadding"; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 57 | private static final String TEST_ALIAS = "karlin"; |
| 58 | private static final String WRAPPING_KEY_ALIAS = "RecoverableKeyGeneratorTestWrappingKey"; |
Robert Berry | b7c06ea | 2017-12-21 13:37:23 +0000 | [diff] [blame] | 59 | private static final int TEST_USER_ID = 1000; |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 60 | private static final int KEYSTORE_UID_SELF = -1; |
| 61 | private static final int GCM_TAG_LENGTH_BITS = 128; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 62 | |
Robert Berry | 67b228c | 2017-12-18 19:26:22 +0000 | [diff] [blame] | 63 | private PlatformEncryptionKey mPlatformKey; |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 64 | private PlatformDecryptionKey mDecryptKey; |
| 65 | private RecoverableKeyStoreDb mRecoverableKeyStoreDb; |
| 66 | private File mDatabaseFile; |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 67 | private RecoverableKeyGenerator mRecoverableKeyGenerator; |
| 68 | |
| 69 | @Before |
| 70 | public void setUp() throws Exception { |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 71 | Context context = InstrumentationRegistry.getTargetContext(); |
| 72 | mDatabaseFile = context.getDatabasePath(DATABASE_FILE_NAME); |
| 73 | mRecoverableKeyStoreDb = RecoverableKeyStoreDb.newInstance(context); |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 74 | |
Bo Zhu | 2c8e538 | 2018-02-26 15:54:25 -0800 | [diff] [blame^] | 75 | AndroidKeyStoreSecretKey platformKey = generatePlatformKey(); |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 76 | mPlatformKey = new PlatformEncryptionKey(TEST_GENERATION_ID, platformKey); |
| 77 | mDecryptKey = new PlatformDecryptionKey(TEST_GENERATION_ID, platformKey); |
| 78 | mRecoverableKeyGenerator = RecoverableKeyGenerator.newInstance(mRecoverableKeyStoreDb); |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 79 | } |
| 80 | |
| 81 | @After |
| 82 | public void tearDown() throws Exception { |
| 83 | KeyStore keyStore = KeyStore.getInstance(ANDROID_KEY_STORE_PROVIDER); |
| 84 | keyStore.load(/*param=*/ null); |
| 85 | keyStore.deleteEntry(WRAPPING_KEY_ALIAS); |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 86 | |
| 87 | mRecoverableKeyStoreDb.close(); |
| 88 | mDatabaseFile.delete(); |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 89 | } |
| 90 | |
| 91 | @Test |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 92 | public void generateAndStoreKey_storesWrappedKey() throws Exception { |
Robert Berry | b7c06ea | 2017-12-21 13:37:23 +0000 | [diff] [blame] | 93 | mRecoverableKeyGenerator.generateAndStoreKey( |
| 94 | mPlatformKey, TEST_USER_ID, KEYSTORE_UID_SELF, TEST_ALIAS); |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 95 | |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 96 | WrappedKey wrappedKey = mRecoverableKeyStoreDb.getKey(KEYSTORE_UID_SELF, TEST_ALIAS); |
Robert Berry | cfc990a | 2017-12-22 15:54:30 +0000 | [diff] [blame] | 97 | assertNotNull(wrappedKey); |
| 98 | } |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 99 | |
Robert Berry | cfc990a | 2017-12-22 15:54:30 +0000 | [diff] [blame] | 100 | @Test |
| 101 | public void generateAndStoreKey_returnsRawMaterialOfCorrectLength() throws Exception { |
| 102 | byte[] rawKey = mRecoverableKeyGenerator.generateAndStoreKey( |
| 103 | mPlatformKey, TEST_USER_ID, KEYSTORE_UID_SELF, TEST_ALIAS); |
| 104 | |
| 105 | assertEquals(KEY_SIZE_BYTES, rawKey.length); |
| 106 | } |
| 107 | |
| 108 | @Test |
| 109 | public void generateAndStoreKey_storesTheWrappedVersionOfTheRawMaterial() throws Exception { |
| 110 | byte[] rawMaterial = mRecoverableKeyGenerator.generateAndStoreKey( |
| 111 | mPlatformKey, TEST_USER_ID, KEYSTORE_UID_SELF, TEST_ALIAS); |
| 112 | |
| 113 | WrappedKey wrappedKey = mRecoverableKeyStoreDb.getKey(KEYSTORE_UID_SELF, TEST_ALIAS); |
| 114 | Cipher cipher = Cipher.getInstance(KEY_WRAP_ALGORITHM); |
| 115 | cipher.init(Cipher.DECRYPT_MODE, mDecryptKey.getKey(), |
| 116 | new GCMParameterSpec(GCM_TAG_LENGTH_BITS, wrappedKey.getNonce())); |
| 117 | byte[] unwrappedMaterial = cipher.doFinal(wrappedKey.getKeyMaterial()); |
| 118 | assertArrayEquals(rawMaterial, unwrappedMaterial); |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 119 | } |
| 120 | |
Bo Zhu | 2c8e538 | 2018-02-26 15:54:25 -0800 | [diff] [blame^] | 121 | @Test |
| 122 | public void importKey_storesTheWrappedVersionOfTheRawMaterial() throws Exception { |
| 123 | byte[] rawMaterial = randomBytes(KEY_SIZE_BYTES); |
| 124 | mRecoverableKeyGenerator.importKey( |
| 125 | mPlatformKey, TEST_USER_ID, KEYSTORE_UID_SELF, TEST_ALIAS, rawMaterial); |
| 126 | |
| 127 | WrappedKey wrappedKey = mRecoverableKeyStoreDb.getKey(KEYSTORE_UID_SELF, TEST_ALIAS); |
| 128 | Cipher cipher = Cipher.getInstance(KEY_WRAP_ALGORITHM); |
| 129 | cipher.init(Cipher.DECRYPT_MODE, mDecryptKey.getKey(), |
| 130 | new GCMParameterSpec(GCM_TAG_LENGTH_BITS, wrappedKey.getNonce())); |
| 131 | byte[] unwrappedMaterial = cipher.doFinal(wrappedKey.getKeyMaterial()); |
| 132 | assertArrayEquals(rawMaterial, unwrappedMaterial); |
| 133 | } |
| 134 | |
| 135 | private AndroidKeyStoreSecretKey generatePlatformKey() throws Exception { |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 136 | KeyGenerator keyGenerator = KeyGenerator.getInstance( |
| 137 | KEY_ALGORITHM, |
| 138 | ANDROID_KEY_STORE_PROVIDER); |
| 139 | keyGenerator.init(new KeyGenParameterSpec.Builder( |
| 140 | WRAPPING_KEY_ALIAS, KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT) |
| 141 | .setBlockModes(KeyProperties.BLOCK_MODE_GCM) |
| 142 | .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) |
| 143 | .build()); |
| 144 | return (AndroidKeyStoreSecretKey) keyGenerator.generateKey(); |
| 145 | } |
Robert Berry | a244b2e | 2017-12-19 10:44:56 +0000 | [diff] [blame] | 146 | |
| 147 | private static byte[] getUtf8Bytes(String s) { |
| 148 | return s.getBytes(StandardCharsets.UTF_8); |
| 149 | } |
Bo Zhu | 2c8e538 | 2018-02-26 15:54:25 -0800 | [diff] [blame^] | 150 | |
| 151 | private static byte[] randomBytes(int n) { |
| 152 | byte[] bytes = new byte[n]; |
| 153 | new Random().nextBytes(bytes); |
| 154 | return bytes; |
| 155 | } |
Robert Berry | ce50cd3 | 2017-12-07 14:33:54 +0000 | [diff] [blame] | 156 | } |