blob: 6186d1966bddc94f92005c048b063d1296708eff [file] [log] [blame]
Paul Crowley1ef25582016-01-21 20:26:12 +00001/*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef ANDROID_VOLD_KEYSTORAGE_H
18#define ANDROID_VOLD_KEYSTORAGE_H
19
20#include <string>
21
22namespace android {
23namespace vold {
24
Paul Crowley05720802016-02-08 15:55:41 +000025// Represents the information needed to decrypt a disk encryption key.
26// If "token" is nonempty, it is passed in as a required Gatekeeper auth token.
Paul Crowley6ab2cab2017-01-04 22:32:40 -080027// If "token" and "secret" are nonempty, "secret" is appended to the application-specific
Paul Crowley05720802016-02-08 15:55:41 +000028// binary needed to unlock.
Paul Crowley6ab2cab2017-01-04 22:32:40 -080029// If only "secret" is nonempty, it is used to decrypt in a non-Keymaster process.
Paul Crowley05720802016-02-08 15:55:41 +000030class KeyAuthentication {
Paul Crowleydf528a72016-03-09 09:31:37 -080031 public:
32 KeyAuthentication(std::string t, std::string s) : token{t}, secret{s} {};
Paul Crowley6ab2cab2017-01-04 22:32:40 -080033
34 bool usesKeymaster() const { return !token.empty() || secret.empty(); };
35
Paul Crowley05720802016-02-08 15:55:41 +000036 const std::string token;
37 const std::string secret;
38};
39
40extern const KeyAuthentication kEmptyAuthentication;
41
Paul Crowleyf71ace32016-06-02 11:01:19 -070042// Checks if path "path" exists.
43bool pathExists(const std::string& path);
44
Paul Crowley1ef25582016-01-21 20:26:12 +000045// Create a directory at the named path, and store "key" in it,
46// in such a way that it can only be retrieved via Keymaster and
47// can be securely deleted.
48// It's safe to move/rename the directory after creation.
Paul Crowleydf528a72016-03-09 09:31:37 -080049bool storeKey(const std::string& dir, const KeyAuthentication& auth, const std::string& key);
Paul Crowley1ef25582016-01-21 20:26:12 +000050
Paul Crowleyf71ace32016-06-02 11:01:19 -070051// Create a directory at the named path, and store "key" in it as storeKey
52// This version creates the key in "tmp_path" then atomically renames "tmp_path"
53// to "key_path" thereby ensuring that the key is either stored entirely or
54// not at all.
55bool storeKeyAtomically(const std::string& key_path, const std::string& tmp_path,
56 const KeyAuthentication& auth, const std::string& key);
57
Paul Crowley1ef25582016-01-21 20:26:12 +000058// Retrieve the key from the named directory.
Paul Crowleydf528a72016-03-09 09:31:37 -080059bool retrieveKey(const std::string& dir, const KeyAuthentication& auth, std::string* key);
Paul Crowley1ef25582016-01-21 20:26:12 +000060
61// Securely destroy the key stored in the named directory and delete the directory.
Paul Crowleydf528a72016-03-09 09:31:37 -080062bool destroyKey(const std::string& dir);
Paul Crowley1ef25582016-01-21 20:26:12 +000063
64} // namespace vold
65} // namespace android
66
67#endif