tests/attestation_record_test.cpp - platform/system/keymaster - Gitiles

 /*
  * Copyright 2016 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #include <fstream>

 #include <cppbor_parse.h>
 #include <gtest/gtest.h>

 #include <keymaster/contexts/soft_attestation_context.h>
 #include <keymaster/keymaster_context.h>
 #include <keymaster/km_openssl/attestation_record.h>

 #include "android_keymaster_test_utils.h"

 // Use TAG_KDF as an 'unknown tag', as it is not deliberately thrown out
 // in attestation_record.cpp, but still among the keymaster tag types.
 #define UNKNOWN_TAG static_cast<keymaster_tag_t>(KM_ULONG_REP | 50)
 #define UNKNOWN_TAG_VALUE 0

 namespace keymaster {
 namespace test {

 TypedTag<KM_ULONG_REP, UNKNOWN_TAG> UNKNOWN_TAG_T;

 class TestContext : public SoftAttestationContext {
   public:
     TestContext(KmVersion version) : SoftAttestationContext(version) {}

     keymaster_security_level_t GetSecurityLevel() const override {
         return KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT;
     }
     Buffer GenerateUniqueId(uint64_t /* creation_date_time */,
                             const keymaster_blob_t& application_id, bool /* reset_since_rotation */,
                             keymaster_error_t* error) const override {
         // Use the application ID directly as the unique ID.
         *error = KM_ERROR_OK;
         return {application_id.data, application_id.data_length};
     }
     const VerifiedBootParams* GetVerifiedBootParams(keymaster_error_t* error) const override {
         static VerifiedBootParams params{};
         params.verified_boot_key = {vboot_key_, sizeof(vboot_key_)};
         params.verified_boot_state = KM_VERIFIED_BOOT_VERIFIED;
         params.device_locked = true;
         *error = KM_ERROR_OK;
         return &params;
     }

     void VerifyRootOfTrust(const keymaster_blob_t& verified_boot_key,
                            keymaster_verified_boot_t verified_boot_state, bool device_locked) {
         EXPECT_EQ(sizeof(vboot_key_), verified_boot_key.data_length);
         if (sizeof(vboot_key_) == verified_boot_key.data_length) {
             EXPECT_EQ(0, memcmp(verified_boot_key.data, vboot_key_, sizeof(vboot_key_)));
         }
         EXPECT_TRUE(device_locked);
         EXPECT_EQ(KM_VERIFIED_BOOT_VERIFIED, verified_boot_state);
     }

   private:
     uint8_t vboot_key_[32]{"test_vboot_key"};
 };

 class KeymintTestContext : public TestContext {
   public:
     KeymintTestContext() : TestContext(KmVersion::KEYMINT_1) {}
 };

 class KeymasterTestContext : public TestContext {
   public:
     KeymasterTestContext() : TestContext(KmVersion::KEYMASTER_4_1) {}  // Last Keymaster version
 };

 TEST(AttestAsn1Test, Simple) {
     const char* fake_app_id = "fake_app_id";
     const char* fake_app_data = "fake_app_data";
     const char* fake_challenge = "fake_challenge";
     const char* fake_attest_app_id = "fake_attest_app_id";
     KeymasterTestContext context;
     AuthorizationSet hw_set(AuthorizationSetBuilder()
                                 .RsaSigningKey(512, 3)
                                 .Digest(KM_DIGEST_SHA_2_256)
                                 .Digest(KM_DIGEST_SHA_2_384)
                                 .Authorization(TAG_OS_VERSION, 60000)
                                 .Authorization(TAG_OS_PATCHLEVEL, 201512));
     AuthorizationSet sw_set(
         AuthorizationSetBuilder()
             .Authorization(TAG_ACTIVE_DATETIME, 10)
             .Authorization(TAG_CREATION_DATETIME, 10)
             .Authorization(TAG_APPLICATION_ID, fake_app_id, strlen(fake_app_id))
             .Authorization(TAG_APPLICATION_DATA, fake_app_data, strlen(fake_app_data)));

     UniquePtr<uint8_t[]> asn1;
     size_t asn1_len = 0;
     AuthorizationSet attest_params(
         AuthorizationSetBuilder()
             .Authorization(TAG_INCLUDE_UNIQUE_ID)
             .Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
             .Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
                            strlen(fake_attest_app_id)));
     ASSERT_EQ(KM_ERROR_OK,
               build_attestation_record(attest_params, sw_set, hw_set, context, &asn1, &asn1_len));
     EXPECT_GT(asn1_len, 0U);

     std::ofstream output("attest.der",
                          std::ofstream::out | std::ofstream::binary | std::ofstream::trunc);
     if (output) output.write(reinterpret_cast<const char*>(asn1.get()), asn1_len);
     output.close();

     AuthorizationSet parsed_hw_set;
     AuthorizationSet parsed_sw_set;
     uint32_t attestation_version;
     uint32_t keymaster_version;
     keymaster_security_level_t attestation_security_level;
     keymaster_security_level_t keymaster_security_level;
     keymaster_blob_t attestation_challenge = {};
     keymaster_blob_t unique_id = {};
     EXPECT_EQ(KM_ERROR_OK,
               parse_attestation_record(asn1.get(), asn1_len, &attestation_version,
                                        &attestation_security_level, &keymaster_version,
                                        &keymaster_security_level, &attestation_challenge,
                                        &parsed_sw_set, &parsed_hw_set, &unique_id));

     // Check that the challenge is consistent across build and parse.
     EXPECT_EQ(std::string(fake_challenge),
               std::string(reinterpret_cast<const char*>(attestation_challenge.data),
                           attestation_challenge.data_length));
     delete[] attestation_challenge.data;

     // Check that the unique id was populated as expected.
     EXPECT_EQ(std::string(fake_attest_app_id),
               std::string(reinterpret_cast<const char*>(unique_id.data), unique_id.data_length));
     delete[] unique_id.data;

     // The attestation ID is expected to appear in parsed_sw_set.
     sw_set.push_back(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
                      strlen(fake_attest_app_id));

     // The TAG_INCLUDE_UNIQUE_ID tag is not expected to appear in parsed_hw_set.
     hw_set.erase(hw_set.find(TAG_INCLUDE_UNIQUE_ID));

     // Application data is not expected to appear in parsed_sw_set.
     sw_set.erase(sw_set.find(TAG_APPLICATION_ID));
     sw_set.erase(sw_set.find(TAG_APPLICATION_DATA));

     // Check that the list of tags is consistent across build and parse.
     hw_set.Sort();
     sw_set.Sort();
     parsed_hw_set.Sort();
     parsed_sw_set.Sort();
     EXPECT_EQ(hw_set, parsed_hw_set);
     EXPECT_EQ(sw_set, parsed_sw_set);

     // Check the root of trust values.
     keymaster_blob_t verified_boot_key;
     keymaster_verified_boot_t verified_boot_state;
     bool device_locked;
     EXPECT_EQ(KM_ERROR_OK, parse_root_of_trust(asn1.get(), asn1_len, &verified_boot_key,
                                                &verified_boot_state, &device_locked));
     context.VerifyRootOfTrust(verified_boot_key, verified_boot_state, device_locked);
     delete[] verified_boot_key.data;
 }

 TEST(EatTest, Simple) {
     const char* fake_imei = "490154203237518";
     const char* fake_app_id = "fake_app_id";
     const char* fake_app_data = "fake_app_data";
     const char* fake_challenge = "fake_challenge";
     const char* fake_attest_app_id = "fake_attest_app_id";
     KeymintTestContext context;
     AuthorizationSet hw_set(
         AuthorizationSetBuilder()
             .RsaSigningKey(512, 3)
             .Digest(KM_DIGEST_SHA_2_256)
             .Digest(KM_DIGEST_SHA_2_384)
             .Authorization(TAG_OS_VERSION, 60000)
             .Authorization(TAG_OS_PATCHLEVEL, 201512)
             .Authorization(TAG_ATTESTATION_ID_IMEI, fake_imei, strlen(fake_imei)));
     AuthorizationSet sw_set(
         AuthorizationSetBuilder()
             .Authorization(TAG_ACTIVE_DATETIME, 10)
             .Authorization(TAG_CREATION_DATETIME, 10)
             .Authorization(TAG_APPLICATION_ID, fake_app_id, strlen(fake_app_id))
             .Authorization(TAG_APPLICATION_DATA, fake_app_data, strlen(fake_app_data)));

     std::vector<uint8_t> eat;
     AuthorizationSet attest_params(
         AuthorizationSetBuilder()
             .Authorization(TAG_INCLUDE_UNIQUE_ID)
             .Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
             .Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
                            strlen(fake_attest_app_id)));
     ASSERT_EQ(KM_ERROR_OK, build_eat_record(attest_params, sw_set, hw_set, context, &eat));
     EXPECT_GT(eat.size(), 0U);

     std::ofstream output("eat.der",
                          std::ofstream::out | std::ofstream::binary | std::ofstream::trunc);
     if (output) output.write(reinterpret_cast<const char*>(&eat[0]), eat.size() * sizeof(uint8_t));
     output.close();

     AuthorizationSet parsed_hw_set;
     AuthorizationSet parsed_sw_set;
     uint32_t attestation_version;
     uint32_t keymaster_version;
     keymaster_security_level_t attestation_security_level;
     keymaster_security_level_t keymaster_security_level;
     keymaster_blob_t attestation_challenge = {};
     keymaster_blob_t unique_id = {};
     keymaster_blob_t verified_boot_key = {};
     keymaster_verified_boot_t verified_boot_state;
     bool device_locked;
     std::vector<int64_t> unexpected_claims;
     EXPECT_EQ(KM_ERROR_OK,
               parse_eat_record(eat.data(), eat.size(), &attestation_version,
                                &attestation_security_level, &keymaster_version,
                                &keymaster_security_level, &attestation_challenge, &parsed_sw_set,
                                &parsed_hw_set, &unique_id, &verified_boot_key, &verified_boot_state,
                                &device_locked, &unexpected_claims));

     // Check that there were no unexpected claims when parsing.
     EXPECT_EQ(std::vector<int64_t>(), unexpected_claims);

     // Check that the challenge is consistent across build and parse.
     EXPECT_EQ(std::string(fake_challenge),
               std::string(reinterpret_cast<const char*>(attestation_challenge.data),
                           attestation_challenge.data_length));
     delete[] attestation_challenge.data;

     // Check that the unique id was populated as expected.
     EXPECT_EQ(std::string(fake_attest_app_id),
               std::string(reinterpret_cast<const char*>(unique_id.data), unique_id.data_length));
     delete[] unique_id.data;

     // The attestation ID is expected to appear in parsed_sw_set.
     sw_set.push_back(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
                      strlen(fake_attest_app_id));

     // The TAG_INCLUDE_UNIQUE_ID tag is not expected to appear in parsed_hw_set.
     hw_set.erase(hw_set.find(TAG_INCLUDE_UNIQUE_ID));

     // Application data is not expected to appear in parsed_sw_set.
     sw_set.erase(sw_set.find(TAG_APPLICATION_ID));
     sw_set.erase(sw_set.find(TAG_APPLICATION_DATA));

     // Check that the list of tags is consistent across build and parse.
     hw_set.Sort();
     sw_set.Sort();
     parsed_hw_set.Sort();
     parsed_sw_set.Sort();
     EXPECT_EQ(hw_set, parsed_hw_set);
     EXPECT_EQ(sw_set, parsed_sw_set);

     // Check the root of trust values.
     context.VerifyRootOfTrust(verified_boot_key, verified_boot_state, device_locked);
     delete[] verified_boot_key.data;
 }

 TEST(BadImeiTest, Simple) {
     const char* fake_challenge = "fake_challenge";
     const char* fake_attest_app_id = "fake_attest_app_id";
     const char* invalid_imei = "1234567890123456";
     KeymintTestContext context;
     AuthorizationSet hw_set(AuthorizationSetBuilder().Authorization(
         TAG_ATTESTATION_ID_IMEI, invalid_imei, strlen(invalid_imei)));
     AuthorizationSet attest_params(
         AuthorizationSetBuilder()
             .Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
             .Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
                            strlen(fake_attest_app_id)));
     AuthorizationSet sw_set;

     std::vector<uint8_t> eat;
     ASSERT_EQ(KM_ERROR_INVALID_TAG, build_eat_record(attest_params, sw_set, hw_set, context, &eat));
 }

 TEST(MissingAuthChallengeTest, Simple) {
     const char* fake_attest_app_id = "fake_attest_app_id";
     KeymintTestContext context;
     AuthorizationSet hw_set(AuthorizationSetBuilder().Authorization(TAG_OS_PATCHLEVEL, 201512));
     AuthorizationSet attest_params(AuthorizationSetBuilder().Authorization(
         TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id, strlen(fake_attest_app_id)));
     AuthorizationSet sw_set;

     std::vector<uint8_t> eat;
     ASSERT_EQ(KM_ERROR_ATTESTATION_CHALLENGE_MISSING,
               build_eat_record(attest_params, sw_set, hw_set, context, &eat));
 }

 TEST(UnknownTagTest, Simple) {
     const char* fake_challenge = "fake_challenge";
     const char* fake_attest_app_id = "fake_attest_app_id";
     KeymintTestContext context;
     AuthorizationSet unknown_tag_set(
         AuthorizationSetBuilder().Authorization(UNKNOWN_TAG_T, UNKNOWN_TAG_VALUE));

     // Test adding an unknown tag to both sets. The tag should be retained only in the software
     // submod.
     std::vector<uint8_t> eat;
     AuthorizationSet attest_params(
         AuthorizationSetBuilder()
             .Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
             .Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
                            strlen(fake_attest_app_id)));
     ASSERT_EQ(KM_ERROR_OK,
               build_eat_record(attest_params, unknown_tag_set, unknown_tag_set, context, &eat));
     EXPECT_GT(eat.size(), 0U);

     AuthorizationSet parsed_hw_set;
     AuthorizationSet parsed_sw_set;
     uint32_t attestation_version;
     uint32_t keymaster_version;
     keymaster_security_level_t attestation_security_level;
     keymaster_security_level_t keymaster_security_level;
     keymaster_blob_t attestation_challenge = {};
     keymaster_blob_t unique_id = {};
     keymaster_blob_t verified_boot_key = {};
     keymaster_verified_boot_t verified_boot_state;
     bool device_locked;
     std::vector<int64_t> unexpected_claims;
     // Parsing should fail, because the software submod retains the unknown tag.
     EXPECT_EQ(KM_ERROR_INVALID_TAG,
               parse_eat_record(eat.data(), eat.size(), &attestation_version,
                                &attestation_security_level, &keymaster_version,
                                &keymaster_security_level, &attestation_challenge, &parsed_sw_set,
                                &parsed_hw_set, &unique_id, &verified_boot_key, &verified_boot_state,
                                &device_locked, &unexpected_claims));

     // Perform a manual inspection of the EAT token, checking that the tag is retained in the
     // software submod, but not in the hardware submod.
     auto [top_level_item, next_pos, error] = cppbor::parse(eat.data(), eat.size());
     ASSERT_NE(top_level_item, nullptr);
     const cppbor::Map* eat_map = top_level_item->asMap();
     ASSERT_NE(eat_map, nullptr);
     bool found_in_software_submod = false;
     bool found_in_hardware_submod = false;
     for (size_t i = 0; i < eat_map->size(); i++) {
         auto& [eat_key, eat_value] = (*eat_map)[i];
         const cppbor::Int* root_key = eat_key->asInt();
         if ((EatClaim)root_key->value() == EatClaim::SUBMODS) {
             const cppbor::Map* submods_map = eat_value->asMap();
             // Check for each submod whether it contains the expected value.
             for (size_t j = 0; j < submods_map->size(); j++) {
                 auto& [submod_key, submod_value] = (*submods_map)[j];
                 const cppbor::Map* submod_map = submod_value->asMap();
                 bool found_in_submod = false;
                 EatSecurityLevel submod_security_level;
                 for (size_t k = 0; k < submod_map->size(); k++) {
                     auto& [key_item, value_item] = (*submod_map)[k];
                     const cppbor::Int* key_int = key_item->asInt();
                     if (key_int->value() == convert_to_eat_claim(UNKNOWN_TAG_T)) {
                         found_in_submod = true;
                     } else if ((EatClaim)key_int->value() == EatClaim::SECURITY_LEVEL) {
                         submod_security_level = (EatSecurityLevel)value_item->asInt()->value();
                     }
                 }
                 if (submod_security_level == EatSecurityLevel::UNRESTRICTED) {
                     found_in_software_submod = found_in_submod;
                 } else if (submod_security_level == EatSecurityLevel::SECURE_RESTRICTED) {
                     found_in_hardware_submod = found_in_submod;
                 }
             }
         }
     }
     EXPECT_FALSE(found_in_hardware_submod);
     EXPECT_TRUE(found_in_software_submod);
 }

 }  // namespace test
 }  // namespace keymaster
	/*
	* Copyright 2016 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include <fstream>

	#include <cppbor_parse.h>
	#include <gtest/gtest.h>

	#include <keymaster/contexts/soft_attestation_context.h>
	#include <keymaster/keymaster_context.h>
	#include <keymaster/km_openssl/attestation_record.h>

	#include "android_keymaster_test_utils.h"

	// Use TAG_KDF as an 'unknown tag', as it is not deliberately thrown out
	// in attestation_record.cpp, but still among the keymaster tag types.
	#define UNKNOWN_TAG static_cast<keymaster_tag_t>(KM_ULONG_REP \| 50)
	#define UNKNOWN_TAG_VALUE 0

	namespace keymaster {
	namespace test {

	TypedTag<KM_ULONG_REP, UNKNOWN_TAG> UNKNOWN_TAG_T;

	class TestContext : public SoftAttestationContext {
	public:
	TestContext(KmVersion version) : SoftAttestationContext(version) {}

	keymaster_security_level_t GetSecurityLevel() const override {
	return KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT;
	}
	Buffer GenerateUniqueId(uint64_t /* creation_date_time */,
	const keymaster_blob_t& application_id, bool /* reset_since_rotation */,
	keymaster_error_t* error) const override {
	// Use the application ID directly as the unique ID.
	*error = KM_ERROR_OK;
	return {application_id.data, application_id.data_length};
	}
	const VerifiedBootParams* GetVerifiedBootParams(keymaster_error_t* error) const override {
	static VerifiedBootParams params{};
	params.verified_boot_key = {vboot_key_, sizeof(vboot_key_)};
	params.verified_boot_state = KM_VERIFIED_BOOT_VERIFIED;
	params.device_locked = true;
	*error = KM_ERROR_OK;
	return &params;
	}

	void VerifyRootOfTrust(const keymaster_blob_t& verified_boot_key,
	keymaster_verified_boot_t verified_boot_state, bool device_locked) {
	EXPECT_EQ(sizeof(vboot_key_), verified_boot_key.data_length);
	if (sizeof(vboot_key_) == verified_boot_key.data_length) {
	EXPECT_EQ(0, memcmp(verified_boot_key.data, vboot_key_, sizeof(vboot_key_)));
	}
	EXPECT_TRUE(device_locked);
	EXPECT_EQ(KM_VERIFIED_BOOT_VERIFIED, verified_boot_state);
	}

	private:
	uint8_t vboot_key_[32]{"test_vboot_key"};
	};

	class KeymintTestContext : public TestContext {
	public:
	KeymintTestContext() : TestContext(KmVersion::KEYMINT_1) {}
	};

	class KeymasterTestContext : public TestContext {
	public:
	KeymasterTestContext() : TestContext(KmVersion::KEYMASTER_4_1) {} // Last Keymaster version
	};

	TEST(AttestAsn1Test, Simple) {
	const char* fake_app_id = "fake_app_id";
	const char* fake_app_data = "fake_app_data";
	const char* fake_challenge = "fake_challenge";
	const char* fake_attest_app_id = "fake_attest_app_id";
	KeymasterTestContext context;
	AuthorizationSet hw_set(AuthorizationSetBuilder()
	.RsaSigningKey(512, 3)
	.Digest(KM_DIGEST_SHA_2_256)
	.Digest(KM_DIGEST_SHA_2_384)
	.Authorization(TAG_OS_VERSION, 60000)
	.Authorization(TAG_OS_PATCHLEVEL, 201512));
	AuthorizationSet sw_set(
	AuthorizationSetBuilder()
	.Authorization(TAG_ACTIVE_DATETIME, 10)
	.Authorization(TAG_CREATION_DATETIME, 10)
	.Authorization(TAG_APPLICATION_ID, fake_app_id, strlen(fake_app_id))
	.Authorization(TAG_APPLICATION_DATA, fake_app_data, strlen(fake_app_data)));

	UniquePtr<uint8_t[]> asn1;
	size_t asn1_len = 0;
	AuthorizationSet attest_params(
	AuthorizationSetBuilder()
	.Authorization(TAG_INCLUDE_UNIQUE_ID)
	.Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
	.Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
	strlen(fake_attest_app_id)));
	ASSERT_EQ(KM_ERROR_OK,
	build_attestation_record(attest_params, sw_set, hw_set, context, &asn1, &asn1_len));
	EXPECT_GT(asn1_len, 0U);

	std::ofstream output("attest.der",
	std::ofstream::out \| std::ofstream::binary \| std::ofstream::trunc);
	if (output) output.write(reinterpret_cast<const char*>(asn1.get()), asn1_len);
	output.close();

	AuthorizationSet parsed_hw_set;
	AuthorizationSet parsed_sw_set;
	uint32_t attestation_version;
	uint32_t keymaster_version;
	keymaster_security_level_t attestation_security_level;
	keymaster_security_level_t keymaster_security_level;
	keymaster_blob_t attestation_challenge = {};
	keymaster_blob_t unique_id = {};
	EXPECT_EQ(KM_ERROR_OK,
	parse_attestation_record(asn1.get(), asn1_len, &attestation_version,
	&attestation_security_level, &keymaster_version,
	&keymaster_security_level, &attestation_challenge,
	&parsed_sw_set, &parsed_hw_set, &unique_id));

	// Check that the challenge is consistent across build and parse.
	EXPECT_EQ(std::string(fake_challenge),
	std::string(reinterpret_cast<const char*>(attestation_challenge.data),
	attestation_challenge.data_length));
	delete[] attestation_challenge.data;

	// Check that the unique id was populated as expected.
	EXPECT_EQ(std::string(fake_attest_app_id),
	std::string(reinterpret_cast<const char*>(unique_id.data), unique_id.data_length));
	delete[] unique_id.data;

	// The attestation ID is expected to appear in parsed_sw_set.
	sw_set.push_back(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
	strlen(fake_attest_app_id));

	// The TAG_INCLUDE_UNIQUE_ID tag is not expected to appear in parsed_hw_set.
	hw_set.erase(hw_set.find(TAG_INCLUDE_UNIQUE_ID));

	// Application data is not expected to appear in parsed_sw_set.
	sw_set.erase(sw_set.find(TAG_APPLICATION_ID));
	sw_set.erase(sw_set.find(TAG_APPLICATION_DATA));

	// Check that the list of tags is consistent across build and parse.
	hw_set.Sort();
	sw_set.Sort();
	parsed_hw_set.Sort();
	parsed_sw_set.Sort();
	EXPECT_EQ(hw_set, parsed_hw_set);
	EXPECT_EQ(sw_set, parsed_sw_set);

	// Check the root of trust values.
	keymaster_blob_t verified_boot_key;
	keymaster_verified_boot_t verified_boot_state;
	bool device_locked;
	EXPECT_EQ(KM_ERROR_OK, parse_root_of_trust(asn1.get(), asn1_len, &verified_boot_key,
	&verified_boot_state, &device_locked));
	context.VerifyRootOfTrust(verified_boot_key, verified_boot_state, device_locked);
	delete[] verified_boot_key.data;
	}

	TEST(EatTest, Simple) {
	const char* fake_imei = "490154203237518";
	const char* fake_app_id = "fake_app_id";
	const char* fake_app_data = "fake_app_data";
	const char* fake_challenge = "fake_challenge";
	const char* fake_attest_app_id = "fake_attest_app_id";
	KeymintTestContext context;
	AuthorizationSet hw_set(
	AuthorizationSetBuilder()
	.RsaSigningKey(512, 3)
	.Digest(KM_DIGEST_SHA_2_256)
	.Digest(KM_DIGEST_SHA_2_384)
	.Authorization(TAG_OS_VERSION, 60000)
	.Authorization(TAG_OS_PATCHLEVEL, 201512)
	.Authorization(TAG_ATTESTATION_ID_IMEI, fake_imei, strlen(fake_imei)));
	AuthorizationSet sw_set(
	AuthorizationSetBuilder()
	.Authorization(TAG_ACTIVE_DATETIME, 10)
	.Authorization(TAG_CREATION_DATETIME, 10)
	.Authorization(TAG_APPLICATION_ID, fake_app_id, strlen(fake_app_id))
	.Authorization(TAG_APPLICATION_DATA, fake_app_data, strlen(fake_app_data)));

	std::vector<uint8_t> eat;
	AuthorizationSet attest_params(
	AuthorizationSetBuilder()
	.Authorization(TAG_INCLUDE_UNIQUE_ID)
	.Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
	.Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
	strlen(fake_attest_app_id)));
	ASSERT_EQ(KM_ERROR_OK, build_eat_record(attest_params, sw_set, hw_set, context, &eat));
	EXPECT_GT(eat.size(), 0U);

	std::ofstream output("eat.der",
	std::ofstream::out \| std::ofstream::binary \| std::ofstream::trunc);
	if (output) output.write(reinterpret_cast<const char>(&eat[0]), eat.size() sizeof(uint8_t));
	output.close();

	AuthorizationSet parsed_hw_set;
	AuthorizationSet parsed_sw_set;
	uint32_t attestation_version;
	uint32_t keymaster_version;
	keymaster_security_level_t attestation_security_level;
	keymaster_security_level_t keymaster_security_level;
	keymaster_blob_t attestation_challenge = {};
	keymaster_blob_t unique_id = {};
	keymaster_blob_t verified_boot_key = {};
	keymaster_verified_boot_t verified_boot_state;
	bool device_locked;
	std::vector<int64_t> unexpected_claims;
	EXPECT_EQ(KM_ERROR_OK,
	parse_eat_record(eat.data(), eat.size(), &attestation_version,
	&attestation_security_level, &keymaster_version,
	&keymaster_security_level, &attestation_challenge, &parsed_sw_set,
	&parsed_hw_set, &unique_id, &verified_boot_key, &verified_boot_state,
	&device_locked, &unexpected_claims));

	// Check that there were no unexpected claims when parsing.
	EXPECT_EQ(std::vector<int64_t>(), unexpected_claims);

	// Check that the challenge is consistent across build and parse.
	EXPECT_EQ(std::string(fake_challenge),
	std::string(reinterpret_cast<const char*>(attestation_challenge.data),
	attestation_challenge.data_length));
	delete[] attestation_challenge.data;

	// Check that the unique id was populated as expected.
	EXPECT_EQ(std::string(fake_attest_app_id),
	std::string(reinterpret_cast<const char*>(unique_id.data), unique_id.data_length));
	delete[] unique_id.data;

	// The attestation ID is expected to appear in parsed_sw_set.
	sw_set.push_back(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
	strlen(fake_attest_app_id));

	// The TAG_INCLUDE_UNIQUE_ID tag is not expected to appear in parsed_hw_set.
	hw_set.erase(hw_set.find(TAG_INCLUDE_UNIQUE_ID));

	// Application data is not expected to appear in parsed_sw_set.
	sw_set.erase(sw_set.find(TAG_APPLICATION_ID));
	sw_set.erase(sw_set.find(TAG_APPLICATION_DATA));

	// Check that the list of tags is consistent across build and parse.
	hw_set.Sort();
	sw_set.Sort();
	parsed_hw_set.Sort();
	parsed_sw_set.Sort();
	EXPECT_EQ(hw_set, parsed_hw_set);
	EXPECT_EQ(sw_set, parsed_sw_set);

	// Check the root of trust values.
	context.VerifyRootOfTrust(verified_boot_key, verified_boot_state, device_locked);
	delete[] verified_boot_key.data;
	}

	TEST(BadImeiTest, Simple) {
	const char* fake_challenge = "fake_challenge";
	const char* fake_attest_app_id = "fake_attest_app_id";
	const char* invalid_imei = "1234567890123456";
	KeymintTestContext context;
	AuthorizationSet hw_set(AuthorizationSetBuilder().Authorization(
	TAG_ATTESTATION_ID_IMEI, invalid_imei, strlen(invalid_imei)));
	AuthorizationSet attest_params(
	AuthorizationSetBuilder()
	.Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
	.Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
	strlen(fake_attest_app_id)));
	AuthorizationSet sw_set;

	std::vector<uint8_t> eat;
	ASSERT_EQ(KM_ERROR_INVALID_TAG, build_eat_record(attest_params, sw_set, hw_set, context, &eat));
	}

	TEST(MissingAuthChallengeTest, Simple) {
	const char* fake_attest_app_id = "fake_attest_app_id";
	KeymintTestContext context;
	AuthorizationSet hw_set(AuthorizationSetBuilder().Authorization(TAG_OS_PATCHLEVEL, 201512));
	AuthorizationSet attest_params(AuthorizationSetBuilder().Authorization(
	TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id, strlen(fake_attest_app_id)));
	AuthorizationSet sw_set;

	std::vector<uint8_t> eat;
	ASSERT_EQ(KM_ERROR_ATTESTATION_CHALLENGE_MISSING,
	build_eat_record(attest_params, sw_set, hw_set, context, &eat));
	}

	TEST(UnknownTagTest, Simple) {
	const char* fake_challenge = "fake_challenge";
	const char* fake_attest_app_id = "fake_attest_app_id";
	KeymintTestContext context;
	AuthorizationSet unknown_tag_set(
	AuthorizationSetBuilder().Authorization(UNKNOWN_TAG_T, UNKNOWN_TAG_VALUE));

	// Test adding an unknown tag to both sets. The tag should be retained only in the software
	// submod.
	std::vector<uint8_t> eat;
	AuthorizationSet attest_params(
	AuthorizationSetBuilder()
	.Authorization(TAG_ATTESTATION_CHALLENGE, fake_challenge, strlen(fake_challenge))
	.Authorization(TAG_ATTESTATION_APPLICATION_ID, fake_attest_app_id,
	strlen(fake_attest_app_id)));
	ASSERT_EQ(KM_ERROR_OK,
	build_eat_record(attest_params, unknown_tag_set, unknown_tag_set, context, &eat));
	EXPECT_GT(eat.size(), 0U);

	AuthorizationSet parsed_hw_set;
	AuthorizationSet parsed_sw_set;
	uint32_t attestation_version;
	uint32_t keymaster_version;
	keymaster_security_level_t attestation_security_level;
	keymaster_security_level_t keymaster_security_level;
	keymaster_blob_t attestation_challenge = {};
	keymaster_blob_t unique_id = {};
	keymaster_blob_t verified_boot_key = {};
	keymaster_verified_boot_t verified_boot_state;
	bool device_locked;
	std::vector<int64_t> unexpected_claims;
	// Parsing should fail, because the software submod retains the unknown tag.
	EXPECT_EQ(KM_ERROR_INVALID_TAG,
	parse_eat_record(eat.data(), eat.size(), &attestation_version,
	&attestation_security_level, &keymaster_version,
	&keymaster_security_level, &attestation_challenge, &parsed_sw_set,
	&parsed_hw_set, &unique_id, &verified_boot_key, &verified_boot_state,
	&device_locked, &unexpected_claims));

	// Perform a manual inspection of the EAT token, checking that the tag is retained in the
	// software submod, but not in the hardware submod.
	auto [top_level_item, next_pos, error] = cppbor::parse(eat.data(), eat.size());
	ASSERT_NE(top_level_item, nullptr);
	const cppbor::Map* eat_map = top_level_item->asMap();
	ASSERT_NE(eat_map, nullptr);
	bool found_in_software_submod = false;
	bool found_in_hardware_submod = false;
	for (size_t i = 0; i < eat_map->size(); i++) {
	auto& [eat_key, eat_value] = (*eat_map)[i];
	const cppbor::Int* root_key = eat_key->asInt();
	if ((EatClaim)root_key->value() == EatClaim::SUBMODS) {
	const cppbor::Map* submods_map = eat_value->asMap();
	// Check for each submod whether it contains the expected value.
	for (size_t j = 0; j < submods_map->size(); j++) {
	auto& [submod_key, submod_value] = (*submods_map)[j];
	const cppbor::Map* submod_map = submod_value->asMap();
	bool found_in_submod = false;
	EatSecurityLevel submod_security_level;
	for (size_t k = 0; k < submod_map->size(); k++) {
	auto& [key_item, value_item] = (*submod_map)[k];
	const cppbor::Int* key_int = key_item->asInt();
	if (key_int->value() == convert_to_eat_claim(UNKNOWN_TAG_T)) {
	found_in_submod = true;
	} else if ((EatClaim)key_int->value() == EatClaim::SECURITY_LEVEL) {
	submod_security_level = (EatSecurityLevel)value_item->asInt()->value();
	}
	}
	if (submod_security_level == EatSecurityLevel::UNRESTRICTED) {
	found_in_software_submod = found_in_submod;
	} else if (submod_security_level == EatSecurityLevel::SECURE_RESTRICTED) {
	found_in_hardware_submod = found_in_submod;
	}
	}
	}
	}
	EXPECT_FALSE(found_in_hardware_submod);
	EXPECT_TRUE(found_in_software_submod);
	}

	} // namespace test
	} // namespace keymaster