blob: e47b403cfbf0716bfd1ea3d8b2867ec5977f9f0b [file] [log] [blame]
Paul Crowley1ef25582016-01-21 20:26:12 +00001/*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Paul Crowley0323afd2016-03-15 17:04:39 -070017#ifndef ANDROID_VOLD_KEYMASTER_H
18#define ANDROID_VOLD_KEYMASTER_H
Paul Crowley1ef25582016-01-21 20:26:12 +000019
Janis Danisevskis015ec302017-01-31 11:31:08 +000020#ifdef __cplusplus
21
Paul Crowley0323afd2016-03-15 17:04:39 -070022#include <memory>
Paul Crowley1ef25582016-01-21 20:26:12 +000023#include <string>
Paul Crowley0323afd2016-03-15 17:04:39 -070024#include <utility>
Paul Crowley1ef25582016-01-21 20:26:12 +000025
Janis Danisevskis8e537b82016-10-26 14:27:10 +010026#include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
27#include <keystore/authorization_set.h>
Paul Crowley1ef25582016-01-21 20:26:12 +000028
29namespace android {
30namespace vold {
Janis Danisevskis8e537b82016-10-26 14:27:10 +010031using ::android::hardware::keymaster::V3_0::IKeymasterDevice;
32using ::keystore::ErrorCode;
33using ::keystore::KeyPurpose;
34using ::keystore::AuthorizationSet;
Paul Crowley1ef25582016-01-21 20:26:12 +000035
Janis Danisevskis8e537b82016-10-26 14:27:10 +010036// C++ wrappers to the Keymaster hidl interface.
Paul Crowley1ef25582016-01-21 20:26:12 +000037// This is tailored to the needs of KeyStorage, but could be extended to be
38// a more general interface.
39
Janis Danisevskis8e537b82016-10-26 14:27:10 +010040// Wrapper for a Keymaster operation handle representing an
Paul Crowley1ef25582016-01-21 20:26:12 +000041// ongoing Keymaster operation. Aborts the operation
42// in the destructor if it is unfinished. Methods log failures
43// to LOG(ERROR).
44class KeymasterOperation {
Paul Crowleydf528a72016-03-09 09:31:37 -080045 public:
Paul Crowley0323afd2016-03-15 17:04:39 -070046 ~KeymasterOperation();
Paul Crowley1ef25582016-01-21 20:26:12 +000047 // Is this instance valid? This is false if creation fails, and becomes
48 // false on finish or if an update fails.
Janis Danisevskis8e537b82016-10-26 14:27:10 +010049 explicit operator bool() { return mError == ErrorCode::OK; }
Wei Wang4375f1b2017-02-24 17:43:01 -080050 ErrorCode errorCode() { return mError; }
Paul Crowley13ffd8e2016-01-27 14:30:22 +000051 // Call "update" repeatedly until all of the input is consumed, and
Paul Crowley1ef25582016-01-21 20:26:12 +000052 // concatenate the output. Return true on success.
Paul Crowleydf528a72016-03-09 09:31:37 -080053 bool updateCompletely(const std::string& input, std::string* output);
Paul Crowleydff8c722016-05-16 08:14:56 -070054 // Finish and write the output to this string, unless pointer is null.
55 bool finish(std::string* output);
Paul Crowley1ef25582016-01-21 20:26:12 +000056 // Move constructor
57 KeymasterOperation(KeymasterOperation&& rhs) {
Paul Crowley0323afd2016-03-15 17:04:39 -070058 mDevice = std::move(rhs.mDevice);
Paul Crowleydff8c722016-05-16 08:14:56 -070059 mOpHandle = std::move(rhs.mOpHandle);
60 mError = std::move(rhs.mError);
Paul Crowley1ef25582016-01-21 20:26:12 +000061 }
Paul Crowleydff8c722016-05-16 08:14:56 -070062 // Construct an object in an error state for error returns
Janis Danisevskis8e537b82016-10-26 14:27:10 +010063 KeymasterOperation()
Janis Danisevskis015ec302017-01-31 11:31:08 +000064 : mDevice{nullptr}, mOpHandle{0},
Janis Danisevskis8e537b82016-10-26 14:27:10 +010065 mError {ErrorCode::UNKNOWN_ERROR} {}
Janis Danisevskis015ec302017-01-31 11:31:08 +000066 // Move Assignment
67 KeymasterOperation& operator= (KeymasterOperation&& rhs) {
68 mDevice = std::move(rhs.mDevice);
69 mOpHandle = std::move(rhs.mOpHandle);
70 mError = std::move(rhs.mError);
71 rhs.mError = ErrorCode::UNKNOWN_ERROR;
72 rhs.mOpHandle = 0;
73 return *this;
74 }
Paul Crowleydf528a72016-03-09 09:31:37 -080075
76 private:
Janis Danisevskis8e537b82016-10-26 14:27:10 +010077 KeymasterOperation(const sp<IKeymasterDevice>& d, uint64_t h)
78 : mDevice{d}, mOpHandle{h}, mError {ErrorCode::OK} {}
79 KeymasterOperation(ErrorCode error)
80 : mDevice{nullptr}, mOpHandle{0},
Paul Crowleydff8c722016-05-16 08:14:56 -070081 mError {error} {}
Janis Danisevskis8e537b82016-10-26 14:27:10 +010082 sp<IKeymasterDevice> mDevice;
83 uint64_t mOpHandle;
84 ErrorCode mError;
Paul Crowley1ef25582016-01-21 20:26:12 +000085 DISALLOW_COPY_AND_ASSIGN(KeymasterOperation);
86 friend class Keymaster;
87};
88
Paul Crowley0323afd2016-03-15 17:04:39 -070089// Wrapper for a Keymaster device for methods that start a KeymasterOperation or are not
90// part of one.
Paul Crowley1ef25582016-01-21 20:26:12 +000091class Keymaster {
Paul Crowleydf528a72016-03-09 09:31:37 -080092 public:
Paul Crowley1ef25582016-01-21 20:26:12 +000093 Keymaster();
Paul Crowley1ef25582016-01-21 20:26:12 +000094 // false if we failed to open the keymaster device.
Janis Danisevskis8e537b82016-10-26 14:27:10 +010095 explicit operator bool() { return mDevice.get() != nullptr; }
Paul Crowley1ef25582016-01-21 20:26:12 +000096 // Generate a key in the keymaster from the given params.
Paul Crowleydf528a72016-03-09 09:31:37 -080097 bool generateKey(const AuthorizationSet& inParams, std::string* key);
Paul Crowley1ef25582016-01-21 20:26:12 +000098 // If the keymaster supports it, permanently delete a key.
Paul Crowleydf528a72016-03-09 09:31:37 -080099 bool deleteKey(const std::string& key);
Paul Crowleydff8c722016-05-16 08:14:56 -0700100 // Replace stored key blob in response to KM_ERROR_KEY_REQUIRES_UPGRADE.
101 bool upgradeKey(const std::string& oldKey, const AuthorizationSet& inParams,
102 std::string* newKey);
103 // Begin a new cryptographic operation, collecting output parameters if pointer is non-null
Janis Danisevskis8e537b82016-10-26 14:27:10 +0100104 KeymasterOperation begin(KeyPurpose purpose, const std::string& key,
Paul Crowleydf528a72016-03-09 09:31:37 -0800105 const AuthorizationSet& inParams, AuthorizationSet* outParams);
Janis Danisevskis015ec302017-01-31 11:31:08 +0000106 bool isSecure();
Paul Crowleydf528a72016-03-09 09:31:37 -0800107
108 private:
Janis Danisevskis8e537b82016-10-26 14:27:10 +0100109 sp<hardware::keymaster::V3_0::IKeymasterDevice> mDevice;
Paul Crowley1ef25582016-01-21 20:26:12 +0000110 DISALLOW_COPY_AND_ASSIGN(Keymaster);
111};
112
Paul Crowley1ef25582016-01-21 20:26:12 +0000113} // namespace vold
114} // namespace android
115
Janis Danisevskis015ec302017-01-31 11:31:08 +0000116#endif // __cplusplus
117
118
119/*
120 * The following functions provide C bindings to keymaster services
121 * needed by cryptfs scrypt. The compatibility check checks whether
122 * the keymaster implementation is considered secure, i.e., TEE backed.
123 * The create_key function generates an RSA key for signing.
124 * The sign_object function signes an object with the given keymaster
125 * key.
126 */
127__BEGIN_DECLS
128
129int keymaster_compatibility_cryptfs_scrypt();
130int keymaster_create_key_for_cryptfs_scrypt(uint32_t rsa_key_size,
131 uint64_t rsa_exponent,
132 uint32_t ratelimit,
133 uint8_t* key_buffer,
134 uint32_t key_buffer_size,
135 uint32_t* key_out_size);
136
137int keymaster_sign_object_for_cryptfs_scrypt(const uint8_t* key_blob,
138 size_t key_blob_size,
139 uint32_t ratelimit,
140 const uint8_t* object,
141 const size_t object_size,
142 uint8_t** signature_buffer,
143 size_t* signature_buffer_size);
144
145__END_DECLS
146
Paul Crowley1ef25582016-01-21 20:26:12 +0000147#endif