1 /*
2 * Copyright 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #ifndef SYSTEM_KEYMASTER_ANDROID_KEYMASTER_MESSAGES_H_
18 #define SYSTEM_KEYMASTER_ANDROID_KEYMASTER_MESSAGES_H_
19
20 #include <assert.h>
21 #include <stdint.h>
22 #include <stdlib.h>
23 #include <string.h>
24
25 #include <keymaster/android_keymaster_utils.h>
26 #include <keymaster/authorization_set.h>
27
28 namespace keymaster {
29
30 // Commands
31 enum AndroidKeymasterCommand : uint32_t {
32 GENERATE_KEY = 0,
33 BEGIN_OPERATION = 1,
34 UPDATE_OPERATION = 2,
35 FINISH_OPERATION = 3,
36 ABORT_OPERATION = 4,
37 IMPORT_KEY = 5,
38 EXPORT_KEY = 6,
39 GET_VERSION = 7,
40 ADD_RNG_ENTROPY = 8,
41 GET_SUPPORTED_ALGORITHMS = 9,
42 GET_SUPPORTED_BLOCK_MODES = 10,
43 GET_SUPPORTED_PADDING_MODES = 11,
44 GET_SUPPORTED_DIGESTS = 12,
45 GET_SUPPORTED_IMPORT_FORMATS = 13,
46 GET_SUPPORTED_EXPORT_FORMATS = 14,
47 GET_KEY_CHARACTERISTICS = 15,
48 ATTEST_KEY = 16,
49 UPGRADE_KEY = 17,
50 CONFIGURE = 18,
51 GET_HMAC_SHARING_PARAMETERS = 19,
52 COMPUTE_SHARED_HMAC = 20,
53 VERIFY_AUTHORIZATION = 21,
54 DELETE_KEY = 22,
55 DELETE_ALL_KEYS = 23,
56 DESTROY_ATTESTATION_IDS = 24,
57 IMPORT_WRAPPED_KEY = 25,
58 EARLY_BOOT_ENDED = 26,
59 };
60
61 /**
62 * Keymaster message versions are tied to keymaster versions. We map the keymaster
63 * major.minor.subminor version to a sequential "message version".
64 *
65 * Rather than encoding a version number into each message we rely on the client -- who initiates
66 * all requests -- to check the version of the keymaster implementation with the GET_VERSION command
67 * and to send only requests that the implementation can understand. This means that only the
68 * client side needs to manage version compatibility; the implementation can always expect/produce
69 * messages of its format.
70 *
71 * Because message version selection is purely a client-side issue, all messages default to using
72 * the latest version (MAX_MESSAGE_VERSION). Client code must take care to check versions and pass
73 * correct version values to message constructors. The AndroidKeymaster implementation always uses
74 * the default, latest.
75 *
76 * Note that this approach implies that GetVersionRequest and GetVersionResponse cannot be
77 * versioned.
78 */
79 const int32_t MAX_MESSAGE_VERSION = 3;
MessageVersion(uint8_t major_ver,uint8_t minor_ver,uint8_t)80 inline int32_t MessageVersion(uint8_t major_ver, uint8_t minor_ver, uint8_t /* subminor_ver */) {
81 int32_t message_version = -1;
82 switch (major_ver) {
83 case 0:
84 // For the moment we still support version 0, though in general the plan is not to support
85 // non-matching major versions.
86 message_version = 0;
87 break;
88 case 1:
89 switch (minor_ver) {
90 case 0:
91 message_version = 1;
92 break;
93 case 1:
94 message_version = 2;
95 break;
96 }
97 break;
98 case 2:
99 message_version = 3;
100 break;
101 }
102 return message_version;
103 }
104
105 struct KeymasterMessage : public Serializable {
KeymasterMessageKeymasterMessage106 explicit KeymasterMessage(int32_t ver) : message_version(ver) { assert(ver >= 0); }
107
108 uint32_t message_version;
109 };
110
111 /**
112 * All responses include an error value, and if the error is not KM_ERROR_OK, return no additional
113 * data. This abstract class factors out the common serialization functionality for all of the
114 * responses, so we only have to implement it once. Inheritance for reuse is generally not a great
115 * structure, but in this case it's the cleanest option.
116 */
117 struct KeymasterResponse : public KeymasterMessage {
KeymasterResponseKeymasterResponse118 explicit KeymasterResponse(int32_t ver)
119 : KeymasterMessage(ver), error(KM_ERROR_UNKNOWN_ERROR) {}
120
121 size_t SerializedSize() const override;
122 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
123 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
124
125 virtual size_t NonErrorSerializedSize() const = 0;
126 virtual uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const = 0;
127 virtual bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) = 0;
128
129 keymaster_error_t error;
130 };
131
132 struct SupportedAlgorithmsRequest : public KeymasterMessage {
133 explicit SupportedAlgorithmsRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageSupportedAlgorithmsRequest134 : KeymasterMessage(ver) {}
135
SerializedSizeSupportedAlgorithmsRequest136 size_t SerializedSize() const override { return 0; };
SerializeSupportedAlgorithmsRequest137 uint8_t* Serialize(uint8_t* buf, const uint8_t* /* end */) const override { return buf; }
DeserializeSupportedAlgorithmsRequest138 bool Deserialize(const uint8_t** /* buf_ptr */, const uint8_t* /* end */) override {
139 return true;
140 }
141 };
142
143 struct SupportedByAlgorithmRequest : public KeymasterMessage {
SupportedByAlgorithmRequestSupportedByAlgorithmRequest144 explicit SupportedByAlgorithmRequest(int32_t ver) : KeymasterMessage(ver) {}
145
SerializedSizeSupportedByAlgorithmRequest146 size_t SerializedSize() const override { return sizeof(uint32_t); };
SerializeSupportedByAlgorithmRequest147 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
148 return append_uint32_to_buf(buf, end, algorithm);
149 }
DeserializeSupportedByAlgorithmRequest150 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
151 return copy_uint32_from_buf(buf_ptr, end, &algorithm);
152 }
153
154 keymaster_algorithm_t algorithm;
155 };
156
157 struct SupportedImportFormatsRequest : public SupportedByAlgorithmRequest {
158 explicit SupportedImportFormatsRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmRequestSupportedImportFormatsRequest159 : SupportedByAlgorithmRequest(ver) {}
160 };
161
162 struct SupportedExportFormatsRequest : public SupportedByAlgorithmRequest {
163 explicit SupportedExportFormatsRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmRequestSupportedExportFormatsRequest164 : SupportedByAlgorithmRequest(ver) {}
165 };
166
167 struct SupportedByAlgorithmAndPurposeRequest : public KeymasterMessage {
168 explicit SupportedByAlgorithmAndPurposeRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageSupportedByAlgorithmAndPurposeRequest169 : KeymasterMessage(ver) {}
170
SerializedSizeSupportedByAlgorithmAndPurposeRequest171 size_t SerializedSize() const override { return sizeof(uint32_t) * 2; };
SerializeSupportedByAlgorithmAndPurposeRequest172 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
173 buf = append_uint32_to_buf(buf, end, algorithm);
174 return append_uint32_to_buf(buf, end, purpose);
175 }
DeserializeSupportedByAlgorithmAndPurposeRequest176 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
177 return copy_uint32_from_buf(buf_ptr, end, &algorithm) &&
178 copy_uint32_from_buf(buf_ptr, end, &purpose);
179 }
180
181 keymaster_algorithm_t algorithm;
182 keymaster_purpose_t purpose;
183 };
184
185 struct SupportedBlockModesRequest : public SupportedByAlgorithmAndPurposeRequest {
186 explicit SupportedBlockModesRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmAndPurposeRequestSupportedBlockModesRequest187 : SupportedByAlgorithmAndPurposeRequest(ver) {}
188 };
189
190 struct SupportedPaddingModesRequest : public SupportedByAlgorithmAndPurposeRequest {
191 explicit SupportedPaddingModesRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmAndPurposeRequestSupportedPaddingModesRequest192 : SupportedByAlgorithmAndPurposeRequest(ver) {}
193 };
194
195 struct SupportedDigestsRequest : public SupportedByAlgorithmAndPurposeRequest {
196 explicit SupportedDigestsRequest(int32_t ver = MAX_MESSAGE_VERSION)
SupportedByAlgorithmAndPurposeRequestSupportedDigestsRequest197 : SupportedByAlgorithmAndPurposeRequest(ver) {}
198 };
199
200 template <typename T> struct SupportedResponse : public KeymasterResponse {
SupportedResponseSupportedResponse201 explicit SupportedResponse(int32_t ver)
202 : KeymasterResponse(ver), results(nullptr), results_length(0) {}
~SupportedResponseSupportedResponse203 ~SupportedResponse() { delete[] results; }
204
SetResultsSupportedResponse205 template <size_t N> void SetResults(const T (&arr)[N]) { SetResults(arr, N); }
206
SetResultsSupportedResponse207 void SetResults(const T* arr, size_t n) {
208 delete[] results;
209 results_length = 0;
210 results = dup_array(arr, n);
211 if (results == nullptr) {
212 error = KM_ERROR_MEMORY_ALLOCATION_FAILED;
213 } else {
214 results_length = n;
215 error = KM_ERROR_OK;
216 }
217 }
218
NonErrorSerializedSizeSupportedResponse219 size_t NonErrorSerializedSize() const override {
220 return sizeof(uint32_t) + results_length * sizeof(uint32_t);
221 }
NonErrorSerializeSupportedResponse222 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override {
223 return append_uint32_array_to_buf(buf, end, results, results_length);
224 }
NonErrorDeserializeSupportedResponse225 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
226 delete[] results;
227 results = nullptr;
228 UniquePtr<T[]> tmp;
229 if (!copy_uint32_array_from_buf(buf_ptr, end, &tmp, &results_length)) return false;
230 results = tmp.release();
231 return true;
232 }
233
234 T* results;
235 size_t results_length;
236 };
237
238 struct SupportedAlgorithmsResponse : public SupportedResponse<keymaster_algorithm_t> {
239 explicit SupportedAlgorithmsResponse(int32_t ver = MAX_MESSAGE_VERSION)
240 : SupportedResponse<keymaster_algorithm_t>(ver) {}
241 };
242
243 struct SupportedBlockModesResponse : public SupportedResponse<keymaster_block_mode_t> {
244 explicit SupportedBlockModesResponse(int32_t ver = MAX_MESSAGE_VERSION)
245 : SupportedResponse<keymaster_block_mode_t>(ver) {}
246 };
247
248 struct SupportedPaddingModesResponse : public SupportedResponse<keymaster_padding_t> {
249 explicit SupportedPaddingModesResponse(int32_t ver = MAX_MESSAGE_VERSION)
250 : SupportedResponse<keymaster_padding_t>(ver) {}
251 };
252
253 struct SupportedDigestsResponse : public SupportedResponse<keymaster_digest_t> {
254 explicit SupportedDigestsResponse(int32_t ver = MAX_MESSAGE_VERSION)
255 : SupportedResponse<keymaster_digest_t>(ver) {}
256 };
257
258 struct SupportedImportFormatsResponse : public SupportedResponse<keymaster_key_format_t> {
259 explicit SupportedImportFormatsResponse(int32_t ver = MAX_MESSAGE_VERSION)
260 : SupportedResponse<keymaster_key_format_t>(ver) {}
261 };
262
263 struct SupportedExportFormatsResponse : public SupportedResponse<keymaster_key_format_t> {
264 explicit SupportedExportFormatsResponse(int32_t ver = MAX_MESSAGE_VERSION)
265 : SupportedResponse<keymaster_key_format_t>(ver) {}
266 };
267
268 struct GenerateKeyRequest : public KeymasterMessage {
KeymasterMessageGenerateKeyRequest269 explicit GenerateKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
270
SerializedSizeGenerateKeyRequest271 size_t SerializedSize() const override { return key_description.SerializedSize(); }
SerializeGenerateKeyRequest272 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
273 return key_description.Serialize(buf, end);
274 }
DeserializeGenerateKeyRequest275 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
276 return key_description.Deserialize(buf_ptr, end);
277 }
278
279 AuthorizationSet key_description;
280 };
281
282 struct GenerateKeyResponse : public KeymasterResponse {
KeymasterResponseGenerateKeyResponse283 explicit GenerateKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
284 key_blob.key_material = nullptr;
285 key_blob.key_material_size = 0;
286 }
287 ~GenerateKeyResponse();
288
289 size_t NonErrorSerializedSize() const override;
290 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
291 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
292
293 keymaster_key_blob_t key_blob;
294 AuthorizationSet enforced;
295 AuthorizationSet unenforced;
296 };
297
298 struct GetKeyCharacteristicsRequest : public KeymasterMessage {
299 explicit GetKeyCharacteristicsRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageGetKeyCharacteristicsRequest300 : KeymasterMessage(ver) {
301 key_blob.key_material = nullptr;
302 key_blob.key_material_size = 0;
303 }
304 ~GetKeyCharacteristicsRequest();
305
306 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialGetKeyCharacteristicsRequest307 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
308 SetKeyMaterial(blob.key_material, blob.key_material_size);
309 }
310
311 size_t SerializedSize() const override;
312 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
313 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
314
315 keymaster_key_blob_t key_blob;
316 AuthorizationSet additional_params;
317 };
318
319 struct GetKeyCharacteristicsResponse : public KeymasterResponse {
320 explicit GetKeyCharacteristicsResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseGetKeyCharacteristicsResponse321 : KeymasterResponse(ver) {}
322 size_t NonErrorSerializedSize() const override;
323 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
324 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
325
326 AuthorizationSet enforced;
327 AuthorizationSet unenforced;
328 };
329
330 struct BeginOperationRequest : public KeymasterMessage {
KeymasterMessageBeginOperationRequest331 explicit BeginOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
332 key_blob.key_material = nullptr;
333 key_blob.key_material_size = 0;
334 }
~BeginOperationRequestBeginOperationRequest335 ~BeginOperationRequest() { delete[] key_blob.key_material; }
336
337 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialBeginOperationRequest338 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
339 SetKeyMaterial(blob.key_material, blob.key_material_size);
340 }
341
342 size_t SerializedSize() const override;
343 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
344 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
345
346 keymaster_purpose_t purpose;
347 keymaster_key_blob_t key_blob;
348 AuthorizationSet additional_params;
349 };
350
351 struct BeginOperationResponse : public KeymasterResponse {
KeymasterResponseBeginOperationResponse352 explicit BeginOperationResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
353
354 size_t NonErrorSerializedSize() const override;
355 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
356 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
357
358 keymaster_operation_handle_t op_handle;
359 AuthorizationSet output_params;
360 };
361
362 struct UpdateOperationRequest : public KeymasterMessage {
KeymasterMessageUpdateOperationRequest363 explicit UpdateOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
364
365 size_t SerializedSize() const override;
366 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
367 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
368
369 keymaster_operation_handle_t op_handle;
370 Buffer input;
371 AuthorizationSet additional_params;
372 };
373
374 struct UpdateOperationResponse : public KeymasterResponse {
375 explicit UpdateOperationResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseUpdateOperationResponse376 : KeymasterResponse(ver), input_consumed(0) {}
377
378 size_t NonErrorSerializedSize() const override;
379 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
380 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
381
382 Buffer output;
383 size_t input_consumed;
384 AuthorizationSet output_params;
385 };
386
387 struct FinishOperationRequest : public KeymasterMessage {
KeymasterMessageFinishOperationRequest388 explicit FinishOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
389
390 size_t SerializedSize() const override;
391 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
392 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
393
394 keymaster_operation_handle_t op_handle;
395 Buffer input;
396 Buffer signature;
397 AuthorizationSet additional_params;
398 };
399
400 struct FinishOperationResponse : public KeymasterResponse {
KeymasterResponseFinishOperationResponse401 explicit FinishOperationResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
402
403 size_t NonErrorSerializedSize() const override;
404 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
405 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
406
407 Buffer output;
408 AuthorizationSet output_params;
409 };
410
411 struct AbortOperationRequest : public KeymasterMessage {
KeymasterMessageAbortOperationRequest412 explicit AbortOperationRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
413
SerializedSizeAbortOperationRequest414 size_t SerializedSize() const override { return sizeof(uint64_t); }
SerializeAbortOperationRequest415 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
416 return append_uint64_to_buf(buf, end, op_handle);
417 }
DeserializeAbortOperationRequest418 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
419 return copy_uint64_from_buf(buf_ptr, end, &op_handle);
420 }
421
422 keymaster_operation_handle_t op_handle;
423 };
424
425 struct AbortOperationResponse : public KeymasterResponse {
KeymasterResponseAbortOperationResponse426 explicit AbortOperationResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
427 explicit AbortOperationResponse(keymaster_error_t error_, int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseAbortOperationResponse428 : KeymasterResponse(ver) {
429 error = error_;
430 }
431
NonErrorSerializedSizeAbortOperationResponse432 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeAbortOperationResponse433 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeAbortOperationResponse434 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
435 };
436
437 struct AddEntropyRequest : public KeymasterMessage {
KeymasterMessageAddEntropyRequest438 explicit AddEntropyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
439
440 size_t SerializedSize() const override;
441 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
442 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
443
444 Buffer random_data;
445 };
446
447 struct AddEntropyResponse : public KeymasterResponse {
KeymasterResponseAddEntropyResponse448 explicit AddEntropyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
449
NonErrorSerializedSizeAddEntropyResponse450 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeAddEntropyResponse451 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* /* end */) const override {
452 return buf;
453 }
NonErrorDeserializeAddEntropyResponse454 bool NonErrorDeserialize(const uint8_t** /* buf_ptr */, const uint8_t* /* end */) override {
455 return true;
456 }
457 };
458
459 struct ImportKeyRequest : public KeymasterMessage {
460 explicit ImportKeyRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageImportKeyRequest461 : KeymasterMessage(ver), key_data(nullptr) {}
~ImportKeyRequestImportKeyRequest462 ~ImportKeyRequest() { delete[] key_data; }
463
464 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialImportKeyRequest465 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
466 SetKeyMaterial(blob.key_material, blob.key_material_size);
467 }
468
469 size_t SerializedSize() const override;
470 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
471 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
472
473 AuthorizationSet key_description;
474 keymaster_key_format_t key_format;
475 uint8_t* key_data;
476 size_t key_data_length;
477 };
478
479 struct ImportKeyResponse : public KeymasterResponse {
KeymasterResponseImportKeyResponse480 explicit ImportKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
481 key_blob.key_material = nullptr;
482 key_blob.key_material_size = 0;
483 }
~ImportKeyResponseImportKeyResponse484 ~ImportKeyResponse() { delete[] key_blob.key_material; }
485
486 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialImportKeyResponse487 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
488 SetKeyMaterial(blob.key_material, blob.key_material_size);
489 }
490
491 size_t NonErrorSerializedSize() const override;
492 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
493 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
494
495 keymaster_key_blob_t key_blob;
496 AuthorizationSet enforced;
497 AuthorizationSet unenforced;
498 };
499
500 struct ExportKeyRequest : public KeymasterMessage {
KeymasterMessageExportKeyRequest501 explicit ExportKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
502 key_blob.key_material = nullptr;
503 key_blob.key_material_size = 0;
504 }
~ExportKeyRequestExportKeyRequest505 ~ExportKeyRequest() { delete[] key_blob.key_material; }
506
507 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialExportKeyRequest508 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
509 SetKeyMaterial(blob.key_material, blob.key_material_size);
510 }
511
512 size_t SerializedSize() const override;
513 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
514 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
515
516 AuthorizationSet additional_params;
517 keymaster_key_format_t key_format;
518 keymaster_key_blob_t key_blob;
519 };
520
521 struct ExportKeyResponse : public KeymasterResponse {
522 explicit ExportKeyResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseExportKeyResponse523 : KeymasterResponse(ver), key_data(nullptr) {}
~ExportKeyResponseExportKeyResponse524 ~ExportKeyResponse() { delete[] key_data; }
525
526 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialExportKeyResponse527 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
528 SetKeyMaterial(blob.key_material, blob.key_material_size);
529 }
530
531 size_t NonErrorSerializedSize() const override;
532 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
533 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
534
535 uint8_t* key_data;
536 size_t key_data_length;
537 };
538
539 struct DeleteKeyRequest : public KeymasterMessage {
KeymasterMessageDeleteKeyRequest540 explicit DeleteKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
541 key_blob.key_material = nullptr;
542 key_blob.key_material_size = 0;
543 }
~DeleteKeyRequestDeleteKeyRequest544 ~DeleteKeyRequest() { delete[] key_blob.key_material; }
545
546 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialDeleteKeyRequest547 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
548 SetKeyMaterial(blob.key_material, blob.key_material_size);
549 }
550
551 size_t SerializedSize() const override;
552 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
553 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
554
555 keymaster_key_blob_t key_blob;
556 };
557
558 struct DeleteKeyResponse : public KeymasterResponse {
KeymasterResponseDeleteKeyResponse559 explicit DeleteKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
560
NonErrorSerializedSizeDeleteKeyResponse561 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeDeleteKeyResponse562 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeDeleteKeyResponse563 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
564 };
565
566 struct DeleteAllKeysRequest : public KeymasterMessage {
KeymasterMessageDeleteAllKeysRequest567 explicit DeleteAllKeysRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
568
SerializedSizeDeleteAllKeysRequest569 size_t SerializedSize() const override { return 0; }
SerializeDeleteAllKeysRequest570 uint8_t* Serialize(uint8_t* buf, const uint8_t*) const override { return buf; }
DeserializeDeleteAllKeysRequest571 bool Deserialize(const uint8_t**, const uint8_t*) override { return true; };
572 };
573
574 struct DeleteAllKeysResponse : public KeymasterResponse {
KeymasterResponseDeleteAllKeysResponse575 explicit DeleteAllKeysResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
576
NonErrorSerializedSizeDeleteAllKeysResponse577 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeDeleteAllKeysResponse578 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeDeleteAllKeysResponse579 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
580 };
581
582 struct GetVersionRequest : public KeymasterMessage {
GetVersionRequestGetVersionRequest583 GetVersionRequest() : KeymasterMessage(0 /* not versionable */) {}
584
SerializedSizeGetVersionRequest585 size_t SerializedSize() const override { return 0; }
SerializeGetVersionRequest586 uint8_t* Serialize(uint8_t* buf, const uint8_t*) const override { return buf; }
DeserializeGetVersionRequest587 bool Deserialize(const uint8_t**, const uint8_t*) override { return true; };
588 };
589
590 struct GetVersionResponse : public KeymasterResponse {
GetVersionResponseGetVersionResponse591 GetVersionResponse()
592 : KeymasterResponse(0 /* not versionable */), major_ver(0), minor_ver(0), subminor_ver(0) {}
593
594 size_t NonErrorSerializedSize() const override;
595 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
596 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
597
598 uint8_t major_ver;
599 uint8_t minor_ver;
600 uint8_t subminor_ver;
601 };
602
603 struct AttestKeyRequest : public KeymasterMessage {
KeymasterMessageAttestKeyRequest604 explicit AttestKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
605 key_blob.key_material = nullptr;
606 key_blob.key_material_size = 0;
607 }
608 ~AttestKeyRequest();
609
610 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialAttestKeyRequest611 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
612 SetKeyMaterial(blob.key_material, blob.key_material_size);
613 }
614
615 size_t SerializedSize() const override;
616 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
617 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
618
619 keymaster_key_blob_t key_blob;
620 AuthorizationSet attest_params;
621 };
622
623 struct AttestKeyResponse : public KeymasterResponse {
KeymasterResponseAttestKeyResponse624 explicit AttestKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
625 certificate_chain.entry_count = 0;
626 certificate_chain.entries = nullptr;
627 }
628 ~AttestKeyResponse();
629
630 bool AllocateChain(size_t entry_count);
631
632 size_t NonErrorSerializedSize() const override;
633 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
634 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
635
636 keymaster_cert_chain_t certificate_chain;
637 };
638
639 struct UpgradeKeyRequest : public KeymasterMessage {
KeymasterMessageUpgradeKeyRequest640 explicit UpgradeKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {
641 key_blob = {nullptr, 0};
642 }
643 ~UpgradeKeyRequest();
644
645 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialUpgradeKeyRequest646 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
647 SetKeyMaterial(blob.key_material, blob.key_material_size);
648 }
649
650 size_t SerializedSize() const override;
651 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
652 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
653
654 keymaster_key_blob_t key_blob;
655 AuthorizationSet upgrade_params;
656 };
657
658 struct UpgradeKeyResponse : public KeymasterResponse {
KeymasterResponseUpgradeKeyResponse659 explicit UpgradeKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {
660 upgraded_key = {nullptr, 0};
661 }
662 ~UpgradeKeyResponse();
663
664 size_t NonErrorSerializedSize() const override;
665 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
666 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
667
668 keymaster_key_blob_t upgraded_key;
669 };
670
671 struct ConfigureRequest : public KeymasterMessage {
KeymasterMessageConfigureRequest672 explicit ConfigureRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
673
SerializedSizeConfigureRequest674 size_t SerializedSize() const override { return sizeof(os_version) + sizeof(os_patchlevel); }
SerializeConfigureRequest675 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
676 buf = append_uint32_to_buf(buf, end, os_version);
677 return append_uint32_to_buf(buf, end, os_patchlevel);
678 }
DeserializeConfigureRequest679 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
680 return copy_uint32_from_buf(buf_ptr, end, &os_version) &&
681 copy_uint32_from_buf(buf_ptr, end, &os_patchlevel);
682 }
683
684 uint32_t os_version;
685 uint32_t os_patchlevel;
686 };
687
688 struct ConfigureResponse : public KeymasterResponse {
KeymasterResponseConfigureResponse689 explicit ConfigureResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
690
NonErrorSerializedSizeConfigureResponse691 size_t NonErrorSerializedSize() const override { return 0; }
NonErrorSerializeConfigureResponse692 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t*) const override { return buf; }
NonErrorDeserializeConfigureResponse693 bool NonErrorDeserialize(const uint8_t**, const uint8_t*) override { return true; }
694 };
695
696 struct HmacSharingParameters : public Serializable {
HmacSharingParametersHmacSharingParameters697 HmacSharingParameters() : seed({}) { memset(nonce, 0, sizeof(nonce)); }
HmacSharingParametersHmacSharingParameters698 HmacSharingParameters(HmacSharingParameters&& other) {
699 seed = move(other.seed);
700 memcpy(nonce, other.nonce, sizeof(nonce));
701 }
702
SetSeedHmacSharingParameters703 void SetSeed(KeymasterBlob&& value) { seed = move(value); }
704
705 size_t SerializedSize() const override;
706 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
707 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
708
709 KeymasterBlob seed{};
710 uint8_t nonce[32];
711 };
712
713 struct HmacSharingParametersArray : public Serializable {
HmacSharingParametersArrayHmacSharingParametersArray714 HmacSharingParametersArray() : params_array(nullptr), num_params(0) {}
HmacSharingParametersArrayHmacSharingParametersArray715 HmacSharingParametersArray(HmacSharingParametersArray&& other) {
716 delete[] params_array;
717 params_array = other.params_array;
718 num_params = other.num_params;
719 other.params_array = nullptr;
720 other.num_params = 0;
721 }
~HmacSharingParametersArrayHmacSharingParametersArray722 ~HmacSharingParametersArray() override { delete[] params_array; }
723
724 size_t SerializedSize() const override;
725 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
726 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
727
728 HmacSharingParameters* params_array;
729 size_t num_params;
730 };
731
732 struct GetHmacSharingParametersResponse : public KeymasterResponse {
733 explicit GetHmacSharingParametersResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseGetHmacSharingParametersResponse734 : KeymasterResponse(ver) {}
GetHmacSharingParametersResponseGetHmacSharingParametersResponse735 GetHmacSharingParametersResponse(GetHmacSharingParametersResponse&& other)
736 : KeymasterResponse(other.message_version), params(move(other.params)) {}
737
SetSeedGetHmacSharingParametersResponse738 void SetSeed(KeymasterBlob&& seed_data) { params.SetSeed(move(seed_data)); }
739
NonErrorSerializedSizeGetHmacSharingParametersResponse740 size_t NonErrorSerializedSize() const override { return params.SerializedSize(); }
NonErrorSerializeGetHmacSharingParametersResponse741 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override {
742 return params.Serialize(buf, end);
743 }
NonErrorDeserializeGetHmacSharingParametersResponse744 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
745 return params.Deserialize(buf_ptr, end);
746 }
747
748 HmacSharingParameters params;
749 };
750
751 struct ComputeSharedHmacRequest : public KeymasterMessage {
KeymasterMessageComputeSharedHmacRequest752 explicit ComputeSharedHmacRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
753
SerializedSizeComputeSharedHmacRequest754 size_t SerializedSize() const override { return params_array.SerializedSize(); }
SerializeComputeSharedHmacRequest755 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
756 return params_array.Serialize(buf, end);
757 }
DeserializeComputeSharedHmacRequest758 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
759 return params_array.Deserialize(buf_ptr, end);
760 }
761
762 HmacSharingParametersArray params_array;
763 };
764
765 struct ComputeSharedHmacResponse : public KeymasterResponse {
766 explicit ComputeSharedHmacResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseComputeSharedHmacResponse767 : KeymasterResponse(ver) {}
ComputeSharedHmacResponseComputeSharedHmacResponse768 ComputeSharedHmacResponse(ComputeSharedHmacResponse&& other) : KeymasterResponse(move(other)) {
769 sharing_check = move(other.sharing_check);
770 }
771
772 size_t NonErrorSerializedSize() const override;
773 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
774 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
775
776 KeymasterBlob sharing_check;
777 };
778
779 struct ImportWrappedKeyRequest : public KeymasterMessage {
KeymasterMessageImportWrappedKeyRequest780 explicit ImportWrappedKeyRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
781
782 void SetWrappedMaterial(const void* key_material, size_t length);
783 void SetWrappingMaterial(const void* key_material, size_t length);
784 void SetMaskingKeyMaterial(const void* key_material, size_t length);
785
SetKeyMaterialImportWrappedKeyRequest786 void SetKeyMaterial(const keymaster_key_blob_t& wrapped, const keymaster_key_blob_t& wrapping) {
787 SetWrappedMaterial(wrapped.key_material, wrapped.key_material_size);
788 SetWrappingMaterial(wrapping.key_material, wrapping.key_material_size);
789 }
790
791 size_t SerializedSize() const override;
792 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
793 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
794
795 KeymasterKeyBlob wrapped_key;
796 KeymasterKeyBlob wrapping_key;
797 KeymasterKeyBlob masking_key;
798 AuthorizationSet additional_params;
799 uint64_t password_sid;
800 uint64_t biometric_sid;
801 };
802
803 struct ImportWrappedKeyResponse : public KeymasterResponse {
KeymasterResponseImportWrappedKeyResponse804 explicit ImportWrappedKeyResponse(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterResponse(ver) {}
805
806 void SetKeyMaterial(const void* key_material, size_t length);
SetKeyMaterialImportWrappedKeyResponse807 void SetKeyMaterial(const keymaster_key_blob_t& blob) {
808 SetKeyMaterial(blob.key_material, blob.key_material_size);
809 }
810
811 size_t NonErrorSerializedSize() const override;
812 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override;
813 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
814
815 KeymasterKeyBlob key_blob;
816 AuthorizationSet enforced;
817 AuthorizationSet unenforced;
818 };
819
820 struct HardwareAuthToken : public Serializable {
821 HardwareAuthToken() = default;
HardwareAuthTokenHardwareAuthToken822 HardwareAuthToken(HardwareAuthToken&& other) {
823 challenge = other.challenge;
824 user_id = other.user_id;
825 authenticator_id = other.authenticator_id;
826 authenticator_type = other.authenticator_type;
827 timestamp = other.timestamp;
828 mac = move(other.mac);
829 }
830
831 size_t SerializedSize() const override;
832 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
833 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
834
835 uint64_t challenge{};
836 uint64_t user_id{};
837 uint64_t authenticator_id{};
838 hw_authenticator_type_t authenticator_type{};
839 uint64_t timestamp{};
840 KeymasterBlob mac;
841 };
842
843 struct VerificationToken : public Serializable {
844 VerificationToken() = default;
VerificationTokenVerificationToken845 VerificationToken(VerificationToken&& other) {
846 challenge = other.challenge;
847 timestamp = other.timestamp;
848 parameters_verified = move(other.parameters_verified);
849 security_level = other.security_level;
850 mac = move(other.mac);
851 }
852
853 size_t SerializedSize() const override;
854 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override;
855 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override;
856
857 uint64_t challenge{};
858 uint64_t timestamp{};
859 AuthorizationSet parameters_verified{};
860 keymaster_security_level_t security_level{};
861 KeymasterBlob mac{};
862 };
863
864 struct VerifyAuthorizationRequest : public KeymasterMessage {
865 explicit VerifyAuthorizationRequest(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageVerifyAuthorizationRequest866 : KeymasterMessage(ver) {}
867 VerifyAuthorizationRequest(VerifyAuthorizationRequest&& other) = default;
868
SerializedSizeVerifyAuthorizationRequest869 size_t SerializedSize() const override {
870 return sizeof(challenge) + parameters_to_verify.SerializedSize() +
871 auth_token.SerializedSize();
872 }
873
SerializeVerifyAuthorizationRequest874 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
875 buf = append_uint64_to_buf(buf, end, challenge);
876 buf = parameters_to_verify.Serialize(buf, end);
877 return auth_token.Serialize(buf, end);
878 }
879
DeserializeVerifyAuthorizationRequest880 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
881 return (copy_uint64_from_buf(buf_ptr, end, &challenge) &&
882 parameters_to_verify.Deserialize(buf_ptr, end) &&
883 auth_token.Deserialize(buf_ptr, end));
884 }
885
886 uint64_t challenge{};
887 AuthorizationSet parameters_to_verify;
888 HardwareAuthToken auth_token;
889 };
890
891 struct VerifyAuthorizationResponse : public KeymasterResponse {
892 explicit VerifyAuthorizationResponse(int32_t ver = MAX_MESSAGE_VERSION)
KeymasterResponseVerifyAuthorizationResponse893 : KeymasterResponse(ver) {}
894 VerifyAuthorizationResponse(VerifyAuthorizationResponse&& other) = default;
895
NonErrorSerializedSizeVerifyAuthorizationResponse896 size_t NonErrorSerializedSize() const override {
897 return sizeof(error) + token.SerializedSize();
898 }
NonErrorSerializeVerifyAuthorizationResponse899 uint8_t* NonErrorSerialize(uint8_t* buf, const uint8_t* end) const override {
900 buf = append_uint32_to_buf(buf, end, error);
901 return token.Serialize(buf, end);
902 }
NonErrorDeserializeVerifyAuthorizationResponse903 bool NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
904 return copy_uint32_from_buf(buf_ptr, end, &error) && token.Deserialize(buf_ptr, end);
905 }
906
907 VerificationToken token;
908 };
909
910 // These return nothing but an error code, like AbortOperationResponse so might as well use that.
911 using EarlyBootEndedResponse = AbortOperationResponse;
912 using DeviceLockedResponse = AbortOperationResponse;
913
914 struct DeviceLockedRequest : public KeymasterMessage {
KeymasterMessageDeviceLockedRequest915 explicit DeviceLockedRequest(int32_t ver = MAX_MESSAGE_VERSION) : KeymasterMessage(ver) {}
916 explicit DeviceLockedRequest(bool passwordOnly_, VerificationToken&& token_,
917 int32_t ver = MAX_MESSAGE_VERSION)
KeymasterMessageDeviceLockedRequest918 : KeymasterMessage(ver), passwordOnly(passwordOnly_), token(move(token_)) {}
919
SerializedSizeDeviceLockedRequest920 size_t SerializedSize() const override { return 1; }
SerializeDeviceLockedRequest921 uint8_t* Serialize(uint8_t* buf, const uint8_t* end) const override {
922 if (buf < end) *buf++ = passwordOnly ? 1 : 0;
923 return token.Serialize(buf, end);
924 }
DeserializeDeviceLockedRequest925 bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end) override {
926 if (*buf_ptr >= end) return false;
927 passwordOnly = !!*(*buf_ptr)++;
928 return token.Deserialize(buf_ptr, end);
929 }
930
931 bool passwordOnly;
932 VerificationToken token;
933 };
934
935 } // namespace keymaster
936
937 #endif // SYSTEM_KEYMASTER_ANDROID_KEYMASTER_MESSAGES_H_
938