1 /* 2 * Copyright 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef SYSTEM_KEYMASTER_OPERATION_H_ 18 #define SYSTEM_KEYMASTER_OPERATION_H_ 19 20 #include <assert.h> 21 #include <stdint.h> 22 #include <stdlib.h> 23 24 #include <hardware/keymaster_defs.h> 25 #include <keymaster/android_keymaster_utils.h> 26 #include <keymaster/authorization_set.h> 27 #include <keymaster/logger.h> 28 29 namespace keymaster { 30 31 class AuthorizationSet; 32 class Key; 33 class Operation; 34 using OperationPtr = UniquePtr<Operation>; 35 36 class OperationFactory { 37 public: ~OperationFactory()38 virtual ~OperationFactory() {} 39 40 // Required for registry 41 struct KeyType { KeyTypeKeyType42 KeyType(keymaster_algorithm_t alg, keymaster_purpose_t purp) 43 : algorithm(alg), purpose(purp) {} 44 45 keymaster_algorithm_t algorithm; 46 keymaster_purpose_t purpose; 47 48 bool operator==(const KeyType& rhs) const { 49 return algorithm == rhs.algorithm && purpose == rhs.purpose; 50 } 51 }; 52 virtual KeyType registry_key() const = 0; 53 54 // Factory methods 55 virtual OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params, 56 keymaster_error_t* error) const = 0; 57 58 // Informational methods. The returned arrays reference static memory and must not be 59 // deallocated or modified. SupportedPaddingModes(size_t * padding_count)60 virtual const keymaster_padding_t* SupportedPaddingModes(size_t* padding_count) const { 61 *padding_count = 0; 62 return nullptr; 63 } SupportedBlockModes(size_t * block_mode_count)64 virtual const keymaster_block_mode_t* SupportedBlockModes(size_t* block_mode_count) const { 65 *block_mode_count = 0; 66 return nullptr; 67 } SupportedDigests(size_t * digest_count)68 virtual const keymaster_digest_t* SupportedDigests(size_t* digest_count) const { 69 *digest_count = 0; 70 return nullptr; 71 } 72 73 // Convenience methods 74 bool supported(keymaster_padding_t padding) const; 75 bool supported(keymaster_block_mode_t padding) const; 76 bool supported(keymaster_digest_t padding) const; 77 78 bool is_public_key_operation() const; 79 80 bool GetAndValidatePadding(const AuthorizationSet& begin_params, const Key& key, 81 keymaster_padding_t* padding, keymaster_error_t* error) const; 82 bool GetAndValidateDigest(const AuthorizationSet& begin_params, const Key& key, 83 keymaster_digest_t* digest, keymaster_error_t* error) const; 84 }; 85 86 /** 87 * Abstract base for all cryptographic operations. 88 */ 89 class Operation { 90 public: Operation(keymaster_purpose_t purpose,AuthorizationSet && hw_enforced,AuthorizationSet && sw_enforced)91 explicit Operation(keymaster_purpose_t purpose, AuthorizationSet&& hw_enforced, 92 AuthorizationSet&& sw_enforced) 93 : purpose_(purpose), hw_enforced_(move(hw_enforced)), sw_enforced_(move(sw_enforced)) {} ~Operation()94 virtual ~Operation() {} 95 96 Operation(const Operation&) = delete; 97 void operator=(const Operation&) = delete; 98 purpose()99 keymaster_purpose_t purpose() const { return purpose_; } 100 set_key_id(uint64_t key_id)101 void set_key_id(uint64_t key_id) { key_id_ = key_id; } key_id()102 uint64_t key_id() const { return key_id_; } operation_handle()103 virtual keymaster_operation_handle_t operation_handle() const { return operation_handle_; } 104 authorizations()105 AuthProxy authorizations() const { return AuthProxy(hw_enforced_, sw_enforced_); } 106 107 virtual keymaster_error_t Begin(const AuthorizationSet& input_params, 108 AuthorizationSet* output_params) = 0; 109 virtual keymaster_error_t Update(const AuthorizationSet& input_params, const Buffer& input, 110 AuthorizationSet* output_params, Buffer* output, 111 size_t* input_consumed) = 0; 112 virtual keymaster_error_t Finish(const AuthorizationSet& input_params, const Buffer& input, 113 const Buffer& signature, AuthorizationSet* output_params, 114 Buffer* output) = 0; 115 virtual keymaster_error_t Abort() = 0; 116 117 protected: 118 // Helper function for implementing Finish() methods that need to call Update() to process 119 // input, but don't expect any output. 120 keymaster_error_t UpdateForFinish(const AuthorizationSet& input_params, const Buffer& input); 121 keymaster_operation_handle_t operation_handle_; 122 123 private: 124 const keymaster_purpose_t purpose_; 125 AuthorizationSet hw_enforced_; 126 AuthorizationSet sw_enforced_; 127 uint64_t key_id_; 128 }; 129 130 } // namespace keymaster 131 132 #endif // SYSTEM_KEYMASTER_OPERATION_H_ 133