Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package com.android.server.locksettings.recoverablekeystore; |
| 18 | |
| 19 | import static android.security.recoverablekeystore.KeyStoreRecoveryMetadata.TYPE_PASSWORD; |
| 20 | import static android.security.recoverablekeystore.KeyStoreRecoveryMetadata.TYPE_PATTERN; |
| 21 | import static android.security.recoverablekeystore.KeyStoreRecoveryMetadata.TYPE_PIN; |
| 22 | |
| 23 | import static com.android.internal.widget.LockPatternUtils.CREDENTIAL_TYPE_PASSWORD; |
| 24 | import static com.android.internal.widget.LockPatternUtils.CREDENTIAL_TYPE_PATTERN; |
| 25 | |
| 26 | import static org.junit.Assert.assertArrayEquals; |
| 27 | import static org.junit.Assert.assertEquals; |
| 28 | import static org.junit.Assert.assertFalse; |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 29 | import static org.junit.Assert.assertNull; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 30 | import static org.junit.Assert.assertTrue; |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 31 | import static org.mockito.Mockito.verify; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 32 | import static org.mockito.Mockito.when; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 33 | |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 34 | import android.content.Context; |
| 35 | import android.security.keystore.AndroidKeyStoreSecretKey; |
| 36 | import android.security.keystore.KeyGenParameterSpec; |
| 37 | import android.security.keystore.KeyProperties; |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 38 | import android.security.recoverablekeystore.KeyDerivationParameters; |
| 39 | import android.security.recoverablekeystore.KeyEntryRecoveryData; |
| 40 | import android.security.recoverablekeystore.KeyStoreRecoveryData; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 41 | import android.support.test.InstrumentationRegistry; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 42 | import android.support.test.filters.SmallTest; |
| 43 | import android.support.test.runner.AndroidJUnit4; |
| 44 | |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 45 | import com.android.server.locksettings.recoverablekeystore.storage.RecoverableKeyStoreDb; |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 46 | import com.android.server.locksettings.recoverablekeystore.storage.RecoverySnapshotStorage; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 47 | |
| 48 | import org.junit.After; |
| 49 | import org.junit.Before; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 50 | import org.junit.Test; |
| 51 | import org.junit.runner.RunWith; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 52 | import org.mockito.Mock; |
| 53 | import org.mockito.MockitoAnnotations; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 54 | |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 55 | import java.io.File; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 56 | import java.nio.charset.StandardCharsets; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 57 | import java.security.KeyPair; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 58 | import java.util.Arrays; |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 59 | import java.util.List; |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 60 | import java.util.Random; |
| 61 | |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 62 | import javax.crypto.KeyGenerator; |
| 63 | import javax.crypto.SecretKey; |
| 64 | |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 65 | @SmallTest |
| 66 | @RunWith(AndroidJUnit4.class) |
| 67 | public class KeySyncTaskTest { |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 68 | private static final String KEY_ALGORITHM = "AES"; |
| 69 | private static final String ANDROID_KEY_STORE_PROVIDER = "AndroidKeyStore"; |
| 70 | private static final String WRAPPING_KEY_ALIAS = "KeySyncTaskTest/WrappingKey"; |
| 71 | private static final String DATABASE_FILE_NAME = "recoverablekeystore.db"; |
| 72 | private static final int TEST_USER_ID = 1000; |
| 73 | private static final int TEST_APP_UID = 10009; |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 74 | private static final int TEST_RECOVERY_AGENT_UID = 90873; |
Robert Berry | 94ea4e4 | 2017-12-28 12:08:30 +0000 | [diff] [blame] | 75 | private static final long TEST_DEVICE_ID = 13295035643L; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 76 | private static final String TEST_APP_KEY_ALIAS = "rcleaver"; |
| 77 | private static final int TEST_GENERATION_ID = 2; |
| 78 | private static final int TEST_CREDENTIAL_TYPE = CREDENTIAL_TYPE_PASSWORD; |
| 79 | private static final String TEST_CREDENTIAL = "password1234"; |
| 80 | private static final byte[] THM_ENCRYPTED_RECOVERY_KEY_HEADER = |
| 81 | "V1 THM_encrypted_recovery_key".getBytes(StandardCharsets.UTF_8); |
| 82 | |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 83 | @Mock private PlatformKeyManager mPlatformKeyManager; |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 84 | @Mock private RecoverySnapshotListenersStorage mSnapshotListenersStorage; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 85 | |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 86 | private RecoverySnapshotStorage mRecoverySnapshotStorage; |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 87 | private RecoverableKeyStoreDb mRecoverableKeyStoreDb; |
| 88 | private File mDatabaseFile; |
| 89 | private KeyPair mKeyPair; |
| 90 | private AndroidKeyStoreSecretKey mWrappingKey; |
| 91 | private PlatformEncryptionKey mEncryptKey; |
| 92 | |
| 93 | private KeySyncTask mKeySyncTask; |
| 94 | |
| 95 | @Before |
| 96 | public void setUp() throws Exception { |
| 97 | MockitoAnnotations.initMocks(this); |
| 98 | |
| 99 | Context context = InstrumentationRegistry.getTargetContext(); |
| 100 | mDatabaseFile = context.getDatabasePath(DATABASE_FILE_NAME); |
| 101 | mRecoverableKeyStoreDb = RecoverableKeyStoreDb.newInstance(context); |
| 102 | mKeyPair = SecureBox.genKeyPair(); |
| 103 | |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 104 | mRecoverySnapshotStorage = new RecoverySnapshotStorage(); |
| 105 | |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 106 | mKeySyncTask = new KeySyncTask( |
| 107 | mRecoverableKeyStoreDb, |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 108 | mRecoverySnapshotStorage, |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 109 | mSnapshotListenersStorage, |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 110 | TEST_USER_ID, |
| 111 | TEST_CREDENTIAL_TYPE, |
| 112 | TEST_CREDENTIAL, |
Robert Berry | aa3f4ca | 2017-12-27 10:53:58 +0000 | [diff] [blame] | 113 | () -> mPlatformKeyManager); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 114 | |
| 115 | mWrappingKey = generateAndroidKeyStoreKey(); |
| 116 | mEncryptKey = new PlatformEncryptionKey(TEST_GENERATION_ID, mWrappingKey); |
Bo Zhu | 3462c83 | 2018-01-04 22:42:36 -0800 | [diff] [blame] | 117 | when(mPlatformKeyManager.getDecryptKey(TEST_USER_ID)).thenReturn( |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 118 | new PlatformDecryptionKey(TEST_GENERATION_ID, mWrappingKey)); |
| 119 | } |
| 120 | |
| 121 | @After |
| 122 | public void tearDown() { |
| 123 | mRecoverableKeyStoreDb.close(); |
| 124 | mDatabaseFile.delete(); |
| 125 | } |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 126 | |
| 127 | @Test |
| 128 | public void isPin_isTrueForNumericString() { |
| 129 | assertTrue(KeySyncTask.isPin("3298432574398654376547")); |
| 130 | } |
| 131 | |
| 132 | @Test |
| 133 | public void isPin_isFalseForStringContainingLetters() { |
| 134 | assertFalse(KeySyncTask.isPin("398i54369548654")); |
| 135 | } |
| 136 | |
| 137 | @Test |
| 138 | public void isPin_isFalseForStringContainingSymbols() { |
| 139 | assertFalse(KeySyncTask.isPin("-3987543643")); |
| 140 | } |
| 141 | |
| 142 | @Test |
| 143 | public void hashCredentials_returnsSameHashForSameCredentialsAndSalt() { |
| 144 | String credentials = "password1234"; |
| 145 | byte[] salt = randomBytes(16); |
| 146 | |
| 147 | assertArrayEquals( |
| 148 | KeySyncTask.hashCredentials(salt, credentials), |
| 149 | KeySyncTask.hashCredentials(salt, credentials)); |
| 150 | } |
| 151 | |
| 152 | @Test |
| 153 | public void hashCredentials_returnsDifferentHashForDifferentCredentials() { |
| 154 | byte[] salt = randomBytes(16); |
| 155 | |
| 156 | assertFalse( |
| 157 | Arrays.equals( |
| 158 | KeySyncTask.hashCredentials(salt, "password1234"), |
| 159 | KeySyncTask.hashCredentials(salt, "password12345"))); |
| 160 | } |
| 161 | |
| 162 | @Test |
| 163 | public void hashCredentials_returnsDifferentHashForDifferentSalt() { |
| 164 | String credentials = "wowmuch"; |
| 165 | |
| 166 | assertFalse( |
| 167 | Arrays.equals( |
| 168 | KeySyncTask.hashCredentials(randomBytes(64), credentials), |
| 169 | KeySyncTask.hashCredentials(randomBytes(64), credentials))); |
| 170 | } |
| 171 | |
| 172 | @Test |
| 173 | public void hashCredentials_returnsDifferentHashEvenIfConcatIsSame() { |
| 174 | assertFalse( |
| 175 | Arrays.equals( |
| 176 | KeySyncTask.hashCredentials(utf8Bytes("123"), "4567"), |
| 177 | KeySyncTask.hashCredentials(utf8Bytes("1234"), "567"))); |
| 178 | } |
| 179 | |
| 180 | @Test |
| 181 | public void getUiFormat_returnsPinIfPin() { |
| 182 | assertEquals(TYPE_PIN, |
| 183 | KeySyncTask.getUiFormat(CREDENTIAL_TYPE_PASSWORD, "1234")); |
| 184 | } |
| 185 | |
| 186 | @Test |
| 187 | public void getUiFormat_returnsPasswordIfPassword() { |
| 188 | assertEquals(TYPE_PASSWORD, |
| 189 | KeySyncTask.getUiFormat(CREDENTIAL_TYPE_PASSWORD, "1234a")); |
| 190 | } |
| 191 | |
| 192 | @Test |
| 193 | public void getUiFormat_returnsPatternIfPattern() { |
| 194 | assertEquals(TYPE_PATTERN, |
| 195 | KeySyncTask.getUiFormat(CREDENTIAL_TYPE_PATTERN, "1234")); |
| 196 | |
| 197 | } |
| 198 | |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 199 | @Test |
| 200 | public void run_doesNotSendAnythingIfNoKeysToSync() throws Exception { |
| 201 | // TODO: proper test here, once we have proper implementation for checking that keys need |
| 202 | // to be synced. |
| 203 | mKeySyncTask.run(); |
| 204 | |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 205 | assertNull(mRecoverySnapshotStorage.get(TEST_USER_ID)); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 206 | } |
| 207 | |
| 208 | @Test |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 209 | public void run_doesNotSendAnythingIfNoRecoveryAgentSet() throws Exception { |
| 210 | SecretKey applicationKey = generateKey(); |
| 211 | mRecoverableKeyStoreDb.setPlatformKeyGenerationId(TEST_USER_ID, TEST_GENERATION_ID); |
| 212 | mRecoverableKeyStoreDb.insertKey( |
| 213 | TEST_USER_ID, |
| 214 | TEST_APP_UID, |
| 215 | TEST_APP_KEY_ALIAS, |
| 216 | WrappedKey.fromSecretKey(mEncryptKey, applicationKey)); |
| 217 | when(mSnapshotListenersStorage.hasListener(TEST_RECOVERY_AGENT_UID)).thenReturn(true); |
| 218 | |
| 219 | mKeySyncTask.run(); |
| 220 | |
| 221 | assertNull(mRecoverySnapshotStorage.get(TEST_USER_ID)); |
| 222 | } |
| 223 | |
| 224 | @Test |
| 225 | public void run_doesNotSendAnythingIfNoRecoveryAgentPendingIntentRegistered() throws Exception { |
| 226 | SecretKey applicationKey = generateKey(); |
Robert Berry | 94ea4e4 | 2017-12-28 12:08:30 +0000 | [diff] [blame] | 227 | mRecoverableKeyStoreDb.setServerParameters( |
| 228 | TEST_USER_ID, TEST_RECOVERY_AGENT_UID, TEST_DEVICE_ID); |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 229 | mRecoverableKeyStoreDb.setPlatformKeyGenerationId(TEST_USER_ID, TEST_GENERATION_ID); |
| 230 | mRecoverableKeyStoreDb.insertKey( |
| 231 | TEST_USER_ID, |
| 232 | TEST_APP_UID, |
| 233 | TEST_APP_KEY_ALIAS, |
| 234 | WrappedKey.fromSecretKey(mEncryptKey, applicationKey)); |
| 235 | mRecoverableKeyStoreDb.setRecoveryServicePublicKey( |
| 236 | TEST_USER_ID, TEST_RECOVERY_AGENT_UID, mKeyPair.getPublic()); |
| 237 | |
| 238 | mKeySyncTask.run(); |
| 239 | |
| 240 | assertNull(mRecoverySnapshotStorage.get(TEST_USER_ID)); |
| 241 | } |
| 242 | |
| 243 | @Test |
Robert Berry | 94ea4e4 | 2017-12-28 12:08:30 +0000 | [diff] [blame] | 244 | public void run_doesNotSendAnythingIfNoDeviceIdIsSet() throws Exception { |
| 245 | SecretKey applicationKey = generateKey(); |
| 246 | mRecoverableKeyStoreDb.setPlatformKeyGenerationId(TEST_USER_ID, TEST_GENERATION_ID); |
| 247 | mRecoverableKeyStoreDb.insertKey( |
| 248 | TEST_USER_ID, |
| 249 | TEST_APP_UID, |
| 250 | TEST_APP_KEY_ALIAS, |
| 251 | WrappedKey.fromSecretKey(mEncryptKey, applicationKey)); |
| 252 | mRecoverableKeyStoreDb.setRecoveryServicePublicKey( |
| 253 | TEST_USER_ID, TEST_RECOVERY_AGENT_UID, mKeyPair.getPublic()); |
| 254 | when(mSnapshotListenersStorage.hasListener(TEST_RECOVERY_AGENT_UID)).thenReturn(true); |
| 255 | |
| 256 | mKeySyncTask.run(); |
| 257 | |
| 258 | assertNull(mRecoverySnapshotStorage.get(TEST_USER_ID)); |
| 259 | } |
| 260 | |
| 261 | @Test |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 262 | public void run_sendsEncryptedKeysIfAvailableToSync() throws Exception { |
| 263 | SecretKey applicationKey = generateKey(); |
Robert Berry | 94ea4e4 | 2017-12-28 12:08:30 +0000 | [diff] [blame] | 264 | mRecoverableKeyStoreDb.setServerParameters( |
| 265 | TEST_USER_ID, TEST_RECOVERY_AGENT_UID, TEST_DEVICE_ID); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 266 | mRecoverableKeyStoreDb.setPlatformKeyGenerationId(TEST_USER_ID, TEST_GENERATION_ID); |
| 267 | mRecoverableKeyStoreDb.insertKey( |
| 268 | TEST_USER_ID, |
| 269 | TEST_APP_UID, |
| 270 | TEST_APP_KEY_ALIAS, |
| 271 | WrappedKey.fromSecretKey(mEncryptKey, applicationKey)); |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 272 | mRecoverableKeyStoreDb.setRecoveryServicePublicKey( |
| 273 | TEST_USER_ID, TEST_RECOVERY_AGENT_UID, mKeyPair.getPublic()); |
| 274 | when(mSnapshotListenersStorage.hasListener(TEST_RECOVERY_AGENT_UID)).thenReturn(true); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 275 | |
| 276 | mKeySyncTask.run(); |
| 277 | |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 278 | KeyStoreRecoveryData recoveryData = mRecoverySnapshotStorage.get(TEST_USER_ID); |
| 279 | KeyDerivationParameters keyDerivationParameters = |
| 280 | recoveryData.getRecoveryMetadata().get(0).getKeyDerivationParameters(); |
| 281 | assertEquals(KeyDerivationParameters.ALGORITHM_SHA256, |
| 282 | keyDerivationParameters.getAlgorithm()); |
Robert Berry | 9104404 | 2017-12-27 12:05:58 +0000 | [diff] [blame] | 283 | verify(mSnapshotListenersStorage).recoverySnapshotAvailable(TEST_RECOVERY_AGENT_UID); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 284 | byte[] lockScreenHash = KeySyncTask.hashCredentials( |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 285 | keyDerivationParameters.getSalt(), |
| 286 | TEST_CREDENTIAL); |
Robert Berry | 94ea4e4 | 2017-12-28 12:08:30 +0000 | [diff] [blame] | 287 | // TODO: what should counter_id be here? |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 288 | byte[] recoveryKey = decryptThmEncryptedKey( |
| 289 | lockScreenHash, |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 290 | recoveryData.getEncryptedRecoveryKeyBlob(), |
Robert Berry | 94ea4e4 | 2017-12-28 12:08:30 +0000 | [diff] [blame] | 291 | /*vaultParams=*/ KeySyncUtils.packVaultParams( |
| 292 | mKeyPair.getPublic(), |
| 293 | /*counterId=*/ 1, |
| 294 | /*maxAttempts=*/ 10, |
| 295 | TEST_DEVICE_ID)); |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 296 | List<KeyEntryRecoveryData> applicationKeys = recoveryData.getApplicationKeyBlobs(); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 297 | assertEquals(1, applicationKeys.size()); |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 298 | KeyEntryRecoveryData keyData = applicationKeys.get(0); |
| 299 | assertArrayEquals(TEST_APP_KEY_ALIAS.getBytes(StandardCharsets.UTF_8), keyData.getAlias()); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 300 | byte[] appKey = KeySyncUtils.decryptApplicationKey( |
Robert Berry | bd086f1 | 2017-12-27 13:29:39 +0000 | [diff] [blame] | 301 | recoveryKey, keyData.getEncryptedKeyMaterial()); |
Robert Berry | f0a4bea | 2017-12-22 13:17:32 +0000 | [diff] [blame] | 302 | assertArrayEquals(applicationKey.getEncoded(), appKey); |
| 303 | } |
| 304 | |
| 305 | private byte[] decryptThmEncryptedKey( |
| 306 | byte[] lockScreenHash, byte[] encryptedKey, byte[] vaultParams) throws Exception { |
| 307 | byte[] locallyEncryptedKey = SecureBox.decrypt( |
| 308 | mKeyPair.getPrivate(), |
| 309 | /*sharedSecret=*/ KeySyncUtils.calculateThmKfHash(lockScreenHash), |
| 310 | /*header=*/ KeySyncUtils.concat(THM_ENCRYPTED_RECOVERY_KEY_HEADER, vaultParams), |
| 311 | encryptedKey |
| 312 | ); |
| 313 | return KeySyncUtils.decryptRecoveryKey(lockScreenHash, locallyEncryptedKey); |
| 314 | } |
| 315 | |
| 316 | private SecretKey generateKey() throws Exception { |
| 317 | KeyGenerator keyGenerator = KeyGenerator.getInstance(KEY_ALGORITHM); |
| 318 | keyGenerator.init(/*keySize=*/ 256); |
| 319 | return keyGenerator.generateKey(); |
| 320 | } |
| 321 | |
| 322 | private AndroidKeyStoreSecretKey generateAndroidKeyStoreKey() throws Exception { |
| 323 | KeyGenerator keyGenerator = KeyGenerator.getInstance( |
| 324 | KEY_ALGORITHM, |
| 325 | ANDROID_KEY_STORE_PROVIDER); |
| 326 | keyGenerator.init(new KeyGenParameterSpec.Builder( |
| 327 | WRAPPING_KEY_ALIAS, KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT) |
| 328 | .setBlockModes(KeyProperties.BLOCK_MODE_GCM) |
| 329 | .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) |
| 330 | .build()); |
| 331 | return (AndroidKeyStoreSecretKey) keyGenerator.generateKey(); |
| 332 | } |
| 333 | |
Robert Berry | 4a534ec | 2017-12-21 15:44:02 +0000 | [diff] [blame] | 334 | private static byte[] utf8Bytes(String s) { |
| 335 | return s.getBytes(StandardCharsets.UTF_8); |
| 336 | } |
| 337 | |
| 338 | private static byte[] randomBytes(int n) { |
| 339 | byte[] bytes = new byte[n]; |
| 340 | new Random().nextBytes(bytes); |
| 341 | return bytes; |
| 342 | } |
| 343 | } |