1 /*
2 * Copyright 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #ifndef SYSTEM_KEYMASTER_ANDROID_KEYMASTER_MESSAGES_H_
18 #define SYSTEM_KEYMASTER_ANDROID_KEYMASTER_MESSAGES_H_
19
20 #include <assert.h>
21 #include <stdint.h>
22 #include <stdlib.h>
23 #include <string.h>
24
25 #include <keymaster/android_keymaster_utils.h>
26 #include <keymaster/authorization_set.h>
27
28 namespace keymaster {
29
30 // Commands
31 enum AndroidKeymasterCommand : uint32_t {
32 GENERATE_KEY = 0,
33 BEGIN_OPERATION = 1,
34 UPDATE_OPERATION = 2,
35 FINISH_OPERATION = 3,
36 ABORT_OPERATION = 4,
37 IMPORT_KEY = 5,
38 EXPORT_KEY = 6,
39 GET_VERSION = 7,
40 ADD_RNG_ENTROPY = 8,
41 GET_SUPPORTED_ALGORITHMS = 9,
42 GET_SUPPORTED_BLOCK_MODES = 10,
43 GET_SUPPORTED_PADDING_MODES = 11,
44 GET_SUPPORTED_DIGESTS = 12,
45 GET_SUPPORTED_IMPORT_FORMATS = 13,
46 GET_SUPPORTED_EXPORT_FORMATS = 14,
47 GET_KEY_CHARACTERISTICS = 15,
48 ATTEST_KEY = 16,
49 UPGRADE_KEY = 17,
50 CONFIGURE = 18,
51 GET_HMAC_SHARING_PARAMETERS = 19,
52 COMPUTE_SHARED_HMAC = 20,
53 VERIFY_AUTHORIZATION = 21,
54 DELETE_KEY = 22,
55 DELETE_ALL_KEYS = 23,
56 DESTROY_ATTESTATION_IDS = 24,
57 IMPORT_WRAPPED_KEY = 25,
58 };
59
60 /**
61 * Keymaster message versions are tied to keymaster versions. We map the keymaster
62 * major.minor.subminor version to a sequential "message version".
63 *
64 * Rather than encoding a version number into each message we rely on the client -- who initiates
65 * all requests -- to check the version of the keymaster implementation with the GET_VERSION command
66 * and to send only requests that the implementation can understand. This means that only the
67 * client side needs to manage version compatibility; the implementation can always expect/produce
68 * messages of its format.
69 *
70 * Because message version selection is purely a client-side issue, all messages default to using
71 * the latest version (MAX_MESSAGE_VERSION). Client code must take care to check versions and pass
72 * correct version values to message constructors. The AndroidKeymaster implementation always uses
73 * the default, latest.
74 *
75 * Note that this approach implies that GetVersionRequest and GetVersionResponse cannot be
76 * versioned.
77 */
78 const int32_t MAX_MESSAGE_VERSION = 3;
MessageVersion(uint8_t major_ver,uint8_t minor_ver,uint8_t)79 inline int32_t MessageVersion(uint8_t major_ver, uint8_t minor_ver, uint8_t /* subminor_ver */) {
80 int32_t message_version = -1;
81 switch (major_ver) {
82 case 0:
83 // For the moment we still support version 0, though in general the plan is not to support
84 // non-matching major versions.
85 message_version = 0;
86 break;
87 case 1:
88 switch (minor_ver) {
89 case 0:
90 message_version = 1;
91 break;
92 case 1:
93 message_version = 2;
94 break;
95 }
96 break;
97 case 2:
98 message_version = 3;
99 break;
100 }
101 return message_version;
102 }
103
104 struct KeymasterMessage : public Serializable {
KeymasterMessageKeymasterMessage105 explicit KeymasterMessage(int32_t ver) : message_version(ver) { assert(ver >= 0); }
106
107 uint32_t message_version;
108 };
109
110 /**
111 * All responses include an error value, and if the error is not KM_ERROR_OK, return no additional
112 * data. This abstract class factors out the common serialization functionality for all of the
113 * responses, so we only have to implement it once. Inheritance for reuse is generally not a great
114 * structure, but in this case it's the cleanest option.
115 */
116 struct KeymasterResponse : public KeymasterMessage {
KeymasterResponseKeymasterResponse117 explicit KeymasterResponse(int32_t ver)
118 : KeymasterMessage(ver), error(KM_ERROR_UNKNOWN_ERROR) {}
119
120 size_t SerializedSize() const override;
121 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
122 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
123
124 virtual size_t NonErrorSerializedSize() const = 0;
125 virtual uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const = 0;
126 virtual bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) = 0;
127
128 keymaster_error_t error;
129 };
130
131 struct SupportedAlgorithmsRequest : public KeymasterMessage {
132 explicit SupportedAlgorithmsRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageSupportedAlgorithmsRequest133 : KeymasterMessage(ver) {}
134
SerializedSizeSupportedAlgorithmsRequest135 size_t SerializedSize() const override { return 0; };
SerializeSupportedAlgorithmsRequest136 uint8_t* Serialize(uint8_t* buf, const uint8_t* /* end */) const override { return buf; }
DeserializeSupportedAlgorithmsRequest137 bool Deserialize(const uint8_t** /* buf_ptr */, const uint8_t* /* end */) override {
138 return true;
139 }
140 };
141
142 struct SupportedByAlgorithmRequest : public KeymasterMessage {
SupportedByAlgorithmRequestSupportedByAlgorithmRequest143 explicit SupportedByAlgorithmRequest(int32_t ver) : KeymasterMessage(ver) {}
144
SerializedSizeSupportedByAlgorithmRequest145 size_t SerializedSize() const override { return sizeof(uint32_t); };
SerializeSupportedByAlgorithmRequest146 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
147 return append_uint32_to_buf(buf, end, algorithm);
148 }
DeserializeSupportedByAlgorithmRequest149 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
150 return copy_uint32_from_buf(buf_ptr, end, &algorithm);
151 }
152
153 keymaster_algorithm_t algorithm;
154 };
155
156 struct SupportedImportFormatsRequest : public SupportedByAlgorithmRequest {
157 explicit SupportedImportFormatsRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmRequestSupportedImportFormatsRequest158 : SupportedByAlgorithmRequest(ver) {}
159 };
160
161 struct SupportedExportFormatsRequest : public SupportedByAlgorithmRequest {
162 explicit SupportedExportFormatsRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmRequestSupportedExportFormatsRequest163 : SupportedByAlgorithmRequest(ver) {}
164 };
165
166 struct SupportedByAlgorithmAndPurposeRequest : public KeymasterMessage {
167 explicit SupportedByAlgorithmAndPurposeRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageSupportedByAlgorithmAndPurposeRequest168 : KeymasterMessage(ver) {}
169
SerializedSizeSupportedByAlgorithmAndPurposeRequest170 size_t SerializedSize() const override { return sizeof(uint32_t) * 2; };
SerializeSupportedByAlgorithmAndPurposeRequest171 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
172 buf = append_uint32_to_buf(buf, end, algorithm);
173 return append_uint32_to_buf(buf, end, purpose);
174 }
DeserializeSupportedByAlgorithmAndPurposeRequest175 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
176 return copy_uint32_from_buf(buf_ptr, end, &algorithm) &&
177 copy_uint32_from_buf(buf_ptr, end, &purpose);
178 }
179
180 keymaster_algorithm_t algorithm;
181 keymaster_purpose_t purpose;
182 };
183
184 struct SupportedBlockModesRequest : public SupportedByAlgorithmAndPurposeRequest {
185 explicit SupportedBlockModesRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmAndPurposeRequestSupportedBlockModesRequest186 : SupportedByAlgorithmAndPurposeRequest(ver) {}
187 };
188
189 struct SupportedPaddingModesRequest : public SupportedByAlgorithmAndPurposeRequest {
190 explicit SupportedPaddingModesRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmAndPurposeRequestSupportedPaddingModesRequest191 : SupportedByAlgorithmAndPurposeRequest(ver) {}
192 };
193
194 struct SupportedDigestsRequest : public SupportedByAlgorithmAndPurposeRequest {
195 explicit SupportedDigestsRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmAndPurposeRequestSupportedDigestsRequest196 : SupportedByAlgorithmAndPurposeRequest(ver) {}
197 };
198
199 template <typename T> struct SupportedResponse : public KeymasterResponse {
SupportedResponseSupportedResponse200 explicit SupportedResponse(int32_t ver)
201 : KeymasterResponse(ver), results(nullptr), results_length(0) {}
~SupportedResponseSupportedResponse202 ~SupportedResponse() { delete[] results; }
203
SetResultsSupportedResponse204 template <size_t N> void SetResults(const T (&arr)[N]) { SetResults(arr, N); }
205
SetResultsSupportedResponse206 void SetResults(const T* arr, size_t n) {
207 delete[] results;
208 results_length = 0;
209 results = dup_array(arr, n);
210 if (results == nullptr) {
211 error = KM_ERROR_MEMORY_ALLOCATION_FAILED;
212 } else {
213 results_length = n;
214 error = KM_ERROR_OK;
215 }
216 }
217
NonErrorSerializedSizeSupportedResponse218 size_t NonErrorSerializedSize() const override {
219 return sizeof(uint32_t) + results_length * sizeof(uint32_t);
220 }
NonErrorSerializeSupportedResponse221 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override {
222 return append_uint32_array_to_buf(buf, end, results, results_length);
223 }
NonErrorDeserializeSupportedResponse224 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
225 delete[] results;
226 results = nullptr;
227 UniquePtr<T[]> tmp;
228 if (!copy_uint32_array_from_buf(buf_ptr, end, &tmp, &results_length)) return false;
229 results = tmp.release();
230 return true;
231 }
232
233 T* results;
234 size_t results_length;
235 };
236
237 struct SupportedAlgorithmsResponse : public SupportedResponse<keymaster_algorithm_t> {
238 explicit SupportedAlgorithmsResponse(int32_t ver = MAX_MESSAGE_VERSION)
239 : SupportedResponse<keymaster_algorithm_t>(ver) {}
240 };
241
242 struct SupportedBlockModesResponse : public SupportedResponse<keymaster_block_mode_t> {
243 explicit SupportedBlockModesResponse(int32_t ver = MAX_MESSAGE_VERSION)
244 : SupportedResponse<keymaster_block_mode_t>(ver) {}
245 };
246
247 struct SupportedPaddingModesResponse : public SupportedResponse<keymaster_padding_t> {
248 explicit SupportedPaddingModesResponse(int32_t ver = MAX_MESSAGE_VERSION)
249 : SupportedResponse<keymaster_padding_t>(ver) {}
250 };
251
252 struct SupportedDigestsResponse : public SupportedResponse<keymaster_digest_t> {
253 explicit SupportedDigestsResponse(int32_t ver = MAX_MESSAGE_VERSION)
254 : SupportedResponse<keymaster_digest_t>(ver) {}
255 };
256
257 struct SupportedImportFormatsResponse : public SupportedResponse<keymaster_key_format_t> {
258 explicit SupportedImportFormatsResponse(int32_t ver = MAX_MESSAGE_VERSION)
259 : SupportedResponse<keymaster_key_format_t>(ver) {}
260 };
261
262 struct SupportedExportFormatsResponse : public SupportedResponse<keymaster_key_format_t> {
263 explicit SupportedExportFormatsResponse(int32_t ver = MAX_MESSAGE_VERSION)
264 : SupportedResponse<keymaster_key_format_t>(ver) {}
265 };
266
267 struct GenerateKeyRequest : public KeymasterMessage {
KeymasterMessageGenerateKeyRequest268 explicit GenerateKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
269
SerializedSizeGenerateKeyRequest270 size_t SerializedSize() const override { return key_description.SerializedSize(); }
SerializeGenerateKeyRequest271 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
272 return key_description.Serialize(buf, end);
273 }
DeserializeGenerateKeyRequest274 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
275 return key_description.Deserialize(buf_ptr, end);
276 }
277
278 AuthorizationSet key_description;
279 };
280
281 struct GenerateKeyResponse : public KeymasterResponse {
KeymasterResponseGenerateKeyResponse282 explicit GenerateKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
283 key_blob.key_material = nullptr;
284 key_blob.key_material_size = 0;
285 }
286 ~GenerateKeyResponse();
287
288 size_t NonErrorSerializedSize() const override;
289 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
290 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
291
292 keymaster_key_blob_t key_blob;
293 AuthorizationSet enforced;
294 AuthorizationSet unenforced;
295 };
296
297 struct GetKeyCharacteristicsRequest : public KeymasterMessage {
298 explicit GetKeyCharacteristicsRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageGetKeyCharacteristicsRequest299 : KeymasterMessage(ver) {
300 key_blob.key_material = nullptr;
301 key_blob.key_material_size = 0;
302 }
303 ~GetKeyCharacteristicsRequest();
304
305 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialGetKeyCharacteristicsRequest306 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
307 SetKeyMaterial(blob.key_material, blob.key_material_size);
308 }
309
310 size_t SerializedSize() const override;
311 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
312 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
313
314 keymaster_key_blob_t key_blob;
315 AuthorizationSet additional_params;
316 };
317
318 struct GetKeyCharacteristicsResponse : public KeymasterResponse {
319 explicit GetKeyCharacteristicsResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseGetKeyCharacteristicsResponse320 : KeymasterResponse(ver) {}
321 size_t NonErrorSerializedSize() const override;
322 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
323 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
324
325 AuthorizationSet enforced;
326 AuthorizationSet unenforced;
327 };
328
329 struct BeginOperationRequest : public KeymasterMessage {
KeymasterMessageBeginOperationRequest330 explicit BeginOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
331 key_blob.key_material = nullptr;
332 key_blob.key_material_size = 0;
333 }
~BeginOperationRequestBeginOperationRequest334 ~BeginOperationRequest() { delete[] key_blob.key_material; }
335
336 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialBeginOperationRequest337 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
338 SetKeyMaterial(blob.key_material, blob.key_material_size);
339 }
340
341 size_t SerializedSize() const override;
342 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
343 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
344
345 keymaster_purpose_t purpose;
346 keymaster_key_blob_t key_blob;
347 AuthorizationSet additional_params;
348 };
349
350 struct BeginOperationResponse : public KeymasterResponse {
KeymasterResponseBeginOperationResponse351 explicit BeginOperationResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
352
353 size_t NonErrorSerializedSize() const override;
354 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
355 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
356
357 keymaster_operation_handle_t op_handle;
358 AuthorizationSet output_params;
359 };
360
361 struct UpdateOperationRequest : public KeymasterMessage {
KeymasterMessageUpdateOperationRequest362 explicit UpdateOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
363
364 size_t SerializedSize() const override;
365 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
366 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
367
368 keymaster_operation_handle_t op_handle;
369 Buffer input;
370 AuthorizationSet additional_params;
371 };
372
373 struct UpdateOperationResponse : public KeymasterResponse {
374 explicit UpdateOperationResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseUpdateOperationResponse375 : KeymasterResponse(ver), input_consumed(0) {}
376
377 size_t NonErrorSerializedSize() const override;
378 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
379 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
380
381 Buffer output;
382 size_t input_consumed;
383 AuthorizationSet output_params;
384 };
385
386 struct FinishOperationRequest : public KeymasterMessage {
KeymasterMessageFinishOperationRequest387 explicit FinishOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
388
389 size_t SerializedSize() const override;
390 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
391 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
392
393 keymaster_operation_handle_t op_handle;
394 Buffer input;
395 Buffer signature;
396 AuthorizationSet additional_params;
397 };
398
399 struct FinishOperationResponse : public KeymasterResponse {
KeymasterResponseFinishOperationResponse400 explicit FinishOperationResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
401
402 size_t NonErrorSerializedSize() const override;
403 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
404 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
405
406 Buffer output;
407 AuthorizationSet output_params;
408 };
409
410 struct AbortOperationRequest : public KeymasterMessage {
KeymasterMessageAbortOperationRequest411 explicit AbortOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
412
SerializedSizeAbortOperationRequest413 size_t SerializedSize() const override { return sizeof(uint64_t); }
SerializeAbortOperationRequest414 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
415 return append_uint64_to_buf(buf, end, op_handle);
416 }
DeserializeAbortOperationRequest417 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
418 return copy_uint64_from_buf(buf_ptr, end, &op_handle);
419 }
420
421 keymaster_operation_handle_t op_handle;
422 };
423
424 struct AbortOperationResponse : public KeymasterResponse {
KeymasterResponseAbortOperationResponse425 explicit AbortOperationResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
426
NonErrorSerializedSizeAbortOperationResponse427 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeAbortOperationResponse428 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeAbortOperationResponse429 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
430 };
431
432 struct AddEntropyRequest : public KeymasterMessage {
KeymasterMessageAddEntropyRequest433 explicit AddEntropyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
434
435 size_t SerializedSize() const override;
436 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
437 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
438
439 Buffer random_data;
440 };
441
442 struct AddEntropyResponse : public KeymasterResponse {
KeymasterResponseAddEntropyResponse443 explicit AddEntropyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
444
NonErrorSerializedSizeAddEntropyResponse445 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeAddEntropyResponse446 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* /* end */) const override {
447 return buf;
448 }
NonErrorDeserializeAddEntropyResponse449 bool NonErrorDeserialize(const uint8_t** /* buf_ptr */, const uint8_t* /* end */) override {
450 return true;
451 }
452 };
453
454 struct ImportKeyRequest : public KeymasterMessage {
455 explicit ImportKeyRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageImportKeyRequest456 : KeymasterMessage(ver), key_data(nullptr) {}
~ImportKeyRequestImportKeyRequest457 ~ImportKeyRequest() { delete[] key_data; }
458
459 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialImportKeyRequest460 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
461 SetKeyMaterial(blob.key_material, blob.key_material_size);
462 }
463
464 size_t SerializedSize() const override;
465 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
466 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
467
468 AuthorizationSet key_description;
469 keymaster_key_format_t key_format;
470 uint8_t* key_data;
471 size_t key_data_length;
472 };
473
474 struct ImportKeyResponse : public KeymasterResponse {
KeymasterResponseImportKeyResponse475 explicit ImportKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
476 key_blob.key_material = nullptr;
477 key_blob.key_material_size = 0;
478 }
~ImportKeyResponseImportKeyResponse479 ~ImportKeyResponse() { delete[] key_blob.key_material; }
480
481 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialImportKeyResponse482 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
483 SetKeyMaterial(blob.key_material, blob.key_material_size);
484 }
485
486 size_t NonErrorSerializedSize() const override;
487 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
488 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
489
490 keymaster_key_blob_t key_blob;
491 AuthorizationSet enforced;
492 AuthorizationSet unenforced;
493 };
494
495 struct ExportKeyRequest : public KeymasterMessage {
KeymasterMessageExportKeyRequest496 explicit ExportKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
497 key_blob.key_material = nullptr;
498 key_blob.key_material_size = 0;
499 }
~ExportKeyRequestExportKeyRequest500 ~ExportKeyRequest() { delete[] key_blob.key_material; }
501
502 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialExportKeyRequest503 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
504 SetKeyMaterial(blob.key_material, blob.key_material_size);
505 }
506
507 size_t SerializedSize() const override;
508 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
509 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
510
511 AuthorizationSet additional_params;
512 keymaster_key_format_t key_format;
513 keymaster_key_blob_t key_blob;
514 };
515
516 struct ExportKeyResponse : public KeymasterResponse {
517 explicit ExportKeyResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseExportKeyResponse518 : KeymasterResponse(ver), key_data(nullptr) {}
~ExportKeyResponseExportKeyResponse519 ~ExportKeyResponse() { delete[] key_data; }
520
521 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialExportKeyResponse522 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
523 SetKeyMaterial(blob.key_material, blob.key_material_size);
524 }
525
526 size_t NonErrorSerializedSize() const override;
527 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
528 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
529
530 uint8_t* key_data;
531 size_t key_data_length;
532 };
533
534 struct DeleteKeyRequest : public KeymasterMessage {
KeymasterMessageDeleteKeyRequest535 explicit DeleteKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
536 key_blob.key_material = nullptr;
537 key_blob.key_material_size = 0;
538 }
~DeleteKeyRequestDeleteKeyRequest539 ~DeleteKeyRequest() { delete[] key_blob.key_material; }
540
541 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialDeleteKeyRequest542 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
543 SetKeyMaterial(blob.key_material, blob.key_material_size);
544 }
545
546 size_t SerializedSize() const override;
547 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
548 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
549
550 keymaster_key_blob_t key_blob;
551 };
552
553 struct DeleteKeyResponse : public KeymasterResponse {
KeymasterResponseDeleteKeyResponse554 explicit DeleteKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
555
NonErrorSerializedSizeDeleteKeyResponse556 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeDeleteKeyResponse557 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeDeleteKeyResponse558 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
559 };
560
561 struct DeleteAllKeysRequest : public KeymasterMessage {
KeymasterMessageDeleteAllKeysRequest562 explicit DeleteAllKeysRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
563
SerializedSizeDeleteAllKeysRequest564 size_t SerializedSize() const override { return 0; }
SerializeDeleteAllKeysRequest565 uint8_t* Serialize(uint8_t* buf, const uint8_t*) const override { return buf; }
DeserializeDeleteAllKeysRequest566 bool Deserialize(const uint8_t**, const uint8_t*) override { return true; };
567 };
568
569 struct DeleteAllKeysResponse : public KeymasterResponse {
KeymasterResponseDeleteAllKeysResponse570 explicit DeleteAllKeysResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
571
NonErrorSerializedSizeDeleteAllKeysResponse572 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeDeleteAllKeysResponse573 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeDeleteAllKeysResponse574 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
575 };
576
577 struct GetVersionRequest : public KeymasterMessage {
GetVersionRequestGetVersionRequest578 GetVersionRequest() : KeymasterMessage(0 /* not versionable */) {}
579
SerializedSizeGetVersionRequest580 size_t SerializedSize() const override { return 0; }
SerializeGetVersionRequest581 uint8_t* Serialize(uint8_t* buf, const uint8_t*) const override { return buf; }
DeserializeGetVersionRequest582 bool Deserialize(const uint8_t**, const uint8_t*) override { return true; };
583 };
584
585 struct GetVersionResponse : public KeymasterResponse {
GetVersionResponseGetVersionResponse586 GetVersionResponse()
587 : KeymasterResponse(0 /* not versionable */), major_ver(0), minor_ver(0), subminor_ver(0) {}
588
589 size_t NonErrorSerializedSize() const override;
590 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
591 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
592
593 uint8_t major_ver;
594 uint8_t minor_ver;
595 uint8_t subminor_ver;
596 };
597
598 struct AttestKeyRequest : public KeymasterMessage {
KeymasterMessageAttestKeyRequest599 explicit AttestKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
600 key_blob.key_material = nullptr;
601 key_blob.key_material_size = 0;
602 }
603 ~AttestKeyRequest();
604
605 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialAttestKeyRequest606 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
607 SetKeyMaterial(blob.key_material, blob.key_material_size);
608 }
609
610 size_t SerializedSize() const override;
611 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
612 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
613
614 keymaster_key_blob_t key_blob;
615 AuthorizationSet attest_params;
616 };
617
618 struct AttestKeyResponse : public KeymasterResponse {
KeymasterResponseAttestKeyResponse619 explicit AttestKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
620 certificate_chain.entry_count = 0;
621 certificate_chain.entries = nullptr;
622 }
623 ~AttestKeyResponse();
624
625 bool AllocateChain(size_t entry_count);
626
627 size_t NonErrorSerializedSize() const override;
628 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
629 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
630
631 keymaster_cert_chain_t certificate_chain;
632 };
633
634 struct UpgradeKeyRequest : public KeymasterMessage {
KeymasterMessageUpgradeKeyRequest635 explicit UpgradeKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
636 key_blob = {nullptr, 0};
637 }
638 ~UpgradeKeyRequest();
639
640 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialUpgradeKeyRequest641 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
642 SetKeyMaterial(blob.key_material, blob.key_material_size);
643 }
644
645 size_t SerializedSize() const override;
646 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
647 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
648
649 keymaster_key_blob_t key_blob;
650 AuthorizationSet upgrade_params;
651 };
652
653 struct UpgradeKeyResponse : public KeymasterResponse {
KeymasterResponseUpgradeKeyResponse654 explicit UpgradeKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
655 upgraded_key = {nullptr, 0};
656 }
657 ~UpgradeKeyResponse();
658
659 size_t NonErrorSerializedSize() const override;
660 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
661 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
662
663 keymaster_key_blob_t upgraded_key;
664 };
665
666 struct ConfigureRequest : public KeymasterMessage {
KeymasterMessageConfigureRequest667 explicit ConfigureRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
668
SerializedSizeConfigureRequest669 size_t SerializedSize() const override { return sizeof(os_version) + sizeof(os_patchlevel); }
SerializeConfigureRequest670 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
671 buf = append_uint32_to_buf(buf, end, os_version);
672 return append_uint32_to_buf(buf, end, os_patchlevel);
673 }
DeserializeConfigureRequest674 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
675 return copy_uint32_from_buf(buf_ptr, end, &os_version) &&
676 copy_uint32_from_buf(buf_ptr, end, &os_patchlevel);
677 }
678
679 uint32_t os_version;
680 uint32_t os_patchlevel;
681 };
682
683 struct ConfigureResponse : public KeymasterResponse {
KeymasterResponseConfigureResponse684 explicit ConfigureResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
685
NonErrorSerializedSizeConfigureResponse686 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeConfigureResponse687 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeConfigureResponse688 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
689 };
690
691 struct HmacSharingParameters : public Serializable {
HmacSharingParametersHmacSharingParameters692 HmacSharingParameters() : seed({}) { memset(nonce, 0, sizeof(nonce)); }
HmacSharingParametersHmacSharingParameters693 HmacSharingParameters(HmacSharingParameters&& other) {
694 seed = move(other.seed);
695 memcpy(nonce, other.nonce, sizeof(nonce));
696 }
697
SetSeedHmacSharingParameters698 void SetSeed(KeymasterBlob&& value) { seed = move(value); }
699
700 size_t SerializedSize() const override;
701 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
702 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
703
704 KeymasterBlob seed{};
705 uint8_t nonce[32];
706 };
707
708 struct HmacSharingParametersArray : public Serializable {
HmacSharingParametersArrayHmacSharingParametersArray709 HmacSharingParametersArray() : params_array(nullptr), num_params(0) {}
HmacSharingParametersArrayHmacSharingParametersArray710 HmacSharingParametersArray(HmacSharingParametersArray&& other) {
711 delete[] params_array;
712 params_array = other.params_array;
713 num_params = other.num_params;
714 other.params_array = nullptr;
715 other.num_params = 0;
716 }
~HmacSharingParametersArrayHmacSharingParametersArray717 ~HmacSharingParametersArray() override { delete[] params_array; }
718
719 size_t SerializedSize() const override;
720 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
721 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
722
723 HmacSharingParameters* params_array;
724 size_t num_params;
725 };
726
727 struct GetHmacSharingParametersResponse : public KeymasterResponse {
728 explicit GetHmacSharingParametersResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseGetHmacSharingParametersResponse729 : KeymasterResponse(ver) {}
GetHmacSharingParametersResponseGetHmacSharingParametersResponse730 GetHmacSharingParametersResponse(GetHmacSharingParametersResponse&& other)
731 : KeymasterResponse(other.message_version), params(move(other.params)) {}
732
SetSeedGetHmacSharingParametersResponse733 void SetSeed(KeymasterBlob&& seed_data) { params.SetSeed(move(seed_data)); }
734
NonErrorSerializedSizeGetHmacSharingParametersResponse735 size_t NonErrorSerializedSize() const override { return params.SerializedSize(); }
NonErrorSerializeGetHmacSharingParametersResponse736 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override {
737 return params.Serialize(buf, end);
738 }
NonErrorDeserializeGetHmacSharingParametersResponse739 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
740 return params.Deserialize(buf_ptr, end);
741 }
742
743 HmacSharingParameters params;
744 };
745
746 struct ComputeSharedHmacRequest : public KeymasterMessage {
KeymasterMessageComputeSharedHmacRequest747 explicit ComputeSharedHmacRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
748
SerializedSizeComputeSharedHmacRequest749 size_t SerializedSize() const override { return params_array.SerializedSize(); }
SerializeComputeSharedHmacRequest750 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
751 return params_array.Serialize(buf, end);
752 }
DeserializeComputeSharedHmacRequest753 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
754 return params_array.Deserialize(buf_ptr, end);
755 }
756
757 HmacSharingParametersArray params_array;
758 };
759
760 struct ComputeSharedHmacResponse : public KeymasterResponse {
761 explicit ComputeSharedHmacResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseComputeSharedHmacResponse762 : KeymasterResponse(ver) {}
ComputeSharedHmacResponseComputeSharedHmacResponse763 ComputeSharedHmacResponse(ComputeSharedHmacResponse&& other) : KeymasterResponse(move(other)) {
764 sharing_check = move(other.sharing_check);
765 }
766
767 size_t NonErrorSerializedSize() const override;
768 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
769 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
770
771 KeymasterBlob sharing_check;
772 };
773
774 struct ImportWrappedKeyRequest : public KeymasterMessage {
KeymasterMessageImportWrappedKeyRequest775 explicit ImportWrappedKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
776
777 void SetWrappedMaterial(const void* key_material, size_t length);
778 void SetWrappingMaterial(const void* key_material, size_t length);
779 void SetMaskingKeyMaterial(const void* key_material, size_t length);
780
SetKeyMaterialImportWrappedKeyRequest781 void SetKeyMaterial(const keymaster_key_blob_t& wrapped, const keymaster_key_blob_t& wrapping) {
782 SetWrappedMaterial(wrapped.key_material, wrapped.key_material_size);
783 SetWrappingMaterial(wrapping.key_material, wrapping.key_material_size);
784 }
785
786 size_t SerializedSize() const override;
787 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
788 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
789
790 KeymasterKeyBlob wrapped_key;
791 KeymasterKeyBlob wrapping_key;
792 KeymasterKeyBlob masking_key;
793 AuthorizationSet additional_params;
794 uint64_t password_sid;
795 uint64_t biometric_sid;
796 };
797
798 struct ImportWrappedKeyResponse : public KeymasterResponse {
KeymasterResponseImportWrappedKeyResponse799 explicit ImportWrappedKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
800
801 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialImportWrappedKeyResponse802 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
803 SetKeyMaterial(blob.key_material, blob.key_material_size);
804 }
805
806 size_t NonErrorSerializedSize() const override;
807 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
808 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
809
810 KeymasterKeyBlob key_blob;
811 AuthorizationSet enforced;
812 AuthorizationSet unenforced;
813 };
814
815 struct HardwareAuthToken : public Serializable {
816 HardwareAuthToken() = default;
HardwareAuthTokenHardwareAuthToken817 HardwareAuthToken(HardwareAuthToken&& other) {
818 challenge = other.challenge;
819 user_id = other.user_id;
820 authenticator_id = other.authenticator_id;
821 authenticator_type = other.authenticator_type;
822 timestamp = other.timestamp;
823 mac = move(other.mac);
824 }
825
826 size_t SerializedSize() const override;
827 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
828 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
829
830 uint64_t challenge{};
831 uint64_t user_id{};
832 uint64_t authenticator_id{};
833 hw_authenticator_type_t authenticator_type{};
834 uint64_t timestamp{};
835 KeymasterBlob mac;
836 };
837
838 struct VerificationToken : public Serializable {
839 VerificationToken() = default;
VerificationTokenVerificationToken840 VerificationToken(VerificationToken&& other) {
841 challenge = other.challenge;
842 timestamp = other.timestamp;
843 parameters_verified = move(other.parameters_verified);
844 security_level = other.security_level;
845 mac = move(other.mac);
846 }
847
848 size_t SerializedSize() const override;
849 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
850 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
851
852 uint64_t challenge{};
853 uint64_t timestamp{};
854 AuthorizationSet parameters_verified{};
855 keymaster_security_level_t security_level{};
856 KeymasterBlob mac{};
857 };
858
859 struct VerifyAuthorizationRequest : public KeymasterMessage {
860 explicit VerifyAuthorizationRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageVerifyAuthorizationRequest861 : KeymasterMessage(ver) {}
862 VerifyAuthorizationRequest(VerifyAuthorizationRequest&& other) = default;
863
SerializedSizeVerifyAuthorizationRequest864 size_t SerializedSize() const override {
865 return sizeof(challenge) + parameters_to_verify.SerializedSize() +
866 auth_token.SerializedSize();
867 }
868
SerializeVerifyAuthorizationRequest869 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
870 buf = append_uint64_to_buf(buf, end, challenge);
871 buf = parameters_to_verify.Serialize(buf, end);
872 return auth_token.Serialize(buf, end);
873 }
874
DeserializeVerifyAuthorizationRequest875 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
876 return (copy_uint64_from_buf(buf_ptr, end, &challenge) &&
877 parameters_to_verify.Deserialize(buf_ptr, end) &&
878 auth_token.Deserialize(buf_ptr, end));
879 }
880
881 uint64_t challenge{};
882 AuthorizationSet parameters_to_verify;
883 HardwareAuthToken auth_token;
884 };
885
886 struct VerifyAuthorizationResponse : public KeymasterResponse {
887 explicit VerifyAuthorizationResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseVerifyAuthorizationResponse888 : KeymasterResponse(ver) {}
889 VerifyAuthorizationResponse(VerifyAuthorizationResponse&& other) = default;
890
NonErrorSerializedSizeVerifyAuthorizationResponse891 size_t NonErrorSerializedSize() const override {
892 return sizeof(error) + token.SerializedSize();
893 }
NonErrorSerializeVerifyAuthorizationResponse894 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override {
895 buf = append_uint32_to_buf(buf, end, error);
896 return token.Serialize(buf, end);
897 }
NonErrorDeserializeVerifyAuthorizationResponse898 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
899 return copy_uint32_from_buf(buf_ptr, end, &error) && token.Deserialize(buf_ptr, end);
900 }
901
902 keymaster_error_t error{KM_ERROR_UNKNOWN_ERROR};
903 VerificationToken token;
904 };
905
906 } // namespace keymaster
907
908 #endif // SYSTEM_KEYMASTER_ANDROID_KEYMASTER_MESSAGES_H_
909