1 /* 2 * Copyright 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef SYSTEM_KEYMASTER_SOFT_KEYMASTER_CONTEXT_H_ 18 #define SYSTEM_KEYMASTER_SOFT_KEYMASTER_CONTEXT_H_ 19 20 #include <memory> 21 #include <string> 22 23 #include <openssl/evp.h> 24 25 #include <hardware/keymaster0.h> 26 #include <hardware/keymaster1.h> 27 28 #include <keymaster/attestation_record.h> 29 #include <keymaster/keymaster_context.h> 30 #include <keymaster/km_openssl/software_random_source.h> 31 #include <keymaster/soft_key_factory.h> 32 #include <keymaster/random_source.h> 33 34 namespace keymaster { 35 36 class SoftKeymasterKeyRegistrations; 37 class Keymaster0Engine; 38 class Keymaster1Engine; 39 class Key; 40 41 /** 42 * SoftKeymasterContext provides the context for a non-secure implementation of AndroidKeymaster. 43 */ 44 class SoftKeymasterContext: public KeymasterContext, SoftwareKeyBlobMaker, SoftwareRandomSource, 45 AttestationRecordContext { 46 public: 47 explicit SoftKeymasterContext(const std::string& root_of_trust = "SW"); 48 ~SoftKeymasterContext() override; 49 50 /** 51 * Use the specified HW keymaster0 device for the operations it supports. Takes ownership of 52 * the specified device (will call keymaster0_device->common.close()); 53 */ 54 keymaster_error_t SetHardwareDevice(keymaster0_device_t* keymaster0_device); 55 56 /** 57 * Use the specified HW keymaster1 device for performing undigested RSA and EC operations after 58 * digesting has been done in software. Takes ownership of the specified device (will call 59 * keymaster1_device->common.close()); 60 */ 61 keymaster_error_t SetHardwareDevice(keymaster1_device_t* keymaster1_device); 62 63 /********************************************************************************************* 64 * Implement KeymasterContext 65 */ 66 keymaster_error_t SetSystemVersion(uint32_t os_version, uint32_t os_patchlevel) override; 67 void GetSystemVersion(uint32_t* os_version, uint32_t* os_patchlevel) const override; 68 69 KeyFactory* GetKeyFactory(keymaster_algorithm_t algorithm) const override; 70 OperationFactory* GetOperationFactory(keymaster_algorithm_t algorithm, 71 keymaster_purpose_t purpose) const override; 72 keymaster_algorithm_t* GetSupportedAlgorithms(size_t* algorithms_count) const override; 73 keymaster_error_t UpgradeKeyBlob(const KeymasterKeyBlob& key_to_upgrade, 74 const AuthorizationSet& upgrade_params, 75 KeymasterKeyBlob* upgraded_key) const override; 76 keymaster_error_t ParseKeyBlob(const KeymasterKeyBlob& blob, 77 const AuthorizationSet& additional_params, 78 UniquePtr<Key>* key) const override; 79 keymaster_error_t DeleteKey(const KeymasterKeyBlob& blob) const override; 80 keymaster_error_t DeleteAllKeys() const override; 81 keymaster_error_t AddRngEntropy(const uint8_t* buf, size_t length) const override; 82 83 keymaster_error_t GenerateAttestation(const Key& key, 84 const AuthorizationSet& attest_params, 85 CertChainPtr* cert_chain) const override; 86 87 keymaster_error_t 88 UnwrapKey(const KeymasterKeyBlob& wrapped_key_blob, const KeymasterKeyBlob& wrapping_key_blob, 89 const AuthorizationSet& wrapping_key_params, const KeymasterKeyBlob& masking_key, 90 AuthorizationSet* wrapped_key_params, keymaster_key_format_t* wrapped_key_format, 91 KeymasterKeyBlob* wrapped_key_material) const override; 92 enforcement_policy()93 KeymasterEnforcement* enforcement_policy() override { 94 // SoftKeymaster does no enforcement; it's all done by Keystore. 95 return nullptr; 96 } 97 98 /********************************************************************************************* 99 * Implement SoftwareKeyBlobMaker 100 */ 101 keymaster_error_t CreateKeyBlob(const AuthorizationSet& auths, keymaster_key_origin_t origin, 102 const KeymasterKeyBlob& key_material, KeymasterKeyBlob* blob, 103 AuthorizationSet* hw_enforced, 104 AuthorizationSet* sw_enforced) const override; 105 /*********************************************************************************************/ 106 107 private: 108 keymaster_error_t ParseKeymaster1HwBlob(const KeymasterKeyBlob& blob, 109 const AuthorizationSet& additional_params, 110 KeymasterKeyBlob* key_material, 111 AuthorizationSet* hw_enforced, 112 AuthorizationSet* sw_enforced) const; 113 keymaster_error_t ParseKeymaster0HwBlob(const KeymasterKeyBlob& blob, 114 KeymasterKeyBlob* key_material, 115 AuthorizationSet* hw_enforced, 116 AuthorizationSet* sw_enforced) const; 117 118 std::unique_ptr<Keymaster0Engine> km0_engine_; 119 std::unique_ptr<Keymaster1Engine> km1_engine_; 120 std::unique_ptr<KeyFactory> rsa_factory_; 121 std::unique_ptr<KeyFactory> ec_factory_; 122 std::unique_ptr<KeyFactory> aes_factory_; 123 std::unique_ptr<KeyFactory> tdes_factory_; 124 std::unique_ptr<KeyFactory> hmac_factory_; 125 keymaster1_device* km1_dev_; 126 const KeymasterBlob root_of_trust_; 127 uint32_t os_version_; 128 uint32_t os_patchlevel_; 129 }; 130 131 } // namespace keymaster 132 133 #endif // SYSTEM_KEYMASTER_SOFT_KEYMASTER_CONTEXT_H_ 134