1 /*
2 * Copyright 2019, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "Util"
18
19 #include "Util.h"
20
21 #include <android/hardware/identity/support/IdentityCredentialSupport.h>
22
23 #include <string.h>
24
25 #include <android-base/logging.h>
26
27 #include <cppbor.h>
28 #include <cppbor_parse.h>
29
30 namespace aidl::android::hardware::identity {
31
32 using namespace ::android::hardware::identity;
33
34 // This is not a very random HBK but that's OK because this is the SW
35 // implementation where it can't be kept secret.
36 vector<uint8_t> hardwareBoundKey = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
37
getHardwareBoundKey()38 const vector<uint8_t>& getHardwareBoundKey() {
39 return hardwareBoundKey;
40 }
41
byteStringToUnsigned(const vector<int8_t> & value)42 vector<uint8_t> byteStringToUnsigned(const vector<int8_t>& value) {
43 return vector<uint8_t>(value.begin(), value.end());
44 }
45
byteStringToSigned(const vector<uint8_t> & value)46 vector<int8_t> byteStringToSigned(const vector<uint8_t>& value) {
47 return vector<int8_t>(value.begin(), value.end());
48 }
49
secureAccessControlProfileEncodeCbor(const SecureAccessControlProfile & profile)50 vector<uint8_t> secureAccessControlProfileEncodeCbor(const SecureAccessControlProfile& profile) {
51 cppbor::Map map;
52 map.add("id", profile.id);
53
54 if (profile.readerCertificate.encodedCertificate.size() > 0) {
55 map.add("readerCertificate",
56 cppbor::Bstr(byteStringToUnsigned(profile.readerCertificate.encodedCertificate)));
57 }
58
59 if (profile.userAuthenticationRequired) {
60 map.add("userAuthenticationRequired", profile.userAuthenticationRequired);
61 map.add("timeoutMillis", profile.timeoutMillis);
62 map.add("secureUserId", profile.secureUserId);
63 }
64
65 return map.encode();
66 }
67
secureAccessControlProfileCalcMac(const SecureAccessControlProfile & profile,const vector<uint8_t> & storageKey)68 optional<vector<uint8_t>> secureAccessControlProfileCalcMac(
69 const SecureAccessControlProfile& profile, const vector<uint8_t>& storageKey) {
70 vector<uint8_t> cborData = secureAccessControlProfileEncodeCbor(profile);
71
72 optional<vector<uint8_t>> nonce = support::getRandom(12);
73 if (!nonce) {
74 return {};
75 }
76 optional<vector<uint8_t>> macO =
77 support::encryptAes128Gcm(storageKey, nonce.value(), {}, cborData);
78 if (!macO) {
79 return {};
80 }
81 return macO.value();
82 }
83
secureAccessControlProfileCheckMac(const SecureAccessControlProfile & profile,const vector<uint8_t> & storageKey)84 bool secureAccessControlProfileCheckMac(const SecureAccessControlProfile& profile,
85 const vector<uint8_t>& storageKey) {
86 vector<uint8_t> cborData = secureAccessControlProfileEncodeCbor(profile);
87
88 if (profile.mac.size() < support::kAesGcmIvSize) {
89 return false;
90 }
91 vector<uint8_t> nonce =
92 vector<uint8_t>(profile.mac.begin(), profile.mac.begin() + support::kAesGcmIvSize);
93 optional<vector<uint8_t>> mac = support::encryptAes128Gcm(storageKey, nonce, {}, cborData);
94 if (!mac) {
95 return false;
96 }
97 if (mac.value() != byteStringToUnsigned(profile.mac)) {
98 return false;
99 }
100 return true;
101 }
102
entryCreateAdditionalData(const string & nameSpace,const string & name,const vector<int32_t> accessControlProfileIds)103 vector<uint8_t> entryCreateAdditionalData(const string& nameSpace, const string& name,
104 const vector<int32_t> accessControlProfileIds) {
105 cppbor::Map map;
106 map.add("Namespace", nameSpace);
107 map.add("Name", name);
108
109 cppbor::Array acpIds;
110 for (auto id : accessControlProfileIds) {
111 acpIds.add(id);
112 }
113 map.add("AccessControlProfileIds", std::move(acpIds));
114 return map.encode();
115 }
116
117 } // namespace aidl::android::hardware::identity
118