1/* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17syntax = "proto3"; 18 19package nugget.app.keymaster; 20 21/* 22 * Minimal type definitions required for building protos. Sourced from: 23 * ::android::hardware::keymaster::V3_0 24 */ 25enum TagType { 26 TAG_TYPE_INVALID = 0x0; /* 0 << 16 */ 27 ENUM = 0x10000; /* 1 << 16 */ 28 ENUM_REP = 0x20000; /* 2 << 16 */ 29 UINT = 0x30000; /* 3 << 16 */ 30 UINT_REP = 0x40000; /* 4 << 16 */ 31 ULONG = 0x50000; /* 5 << 16 */ 32 DATE = 0x60000; /* 6 << 16 */ 33 BOOL = 0x70000; /* 7 << 16 */ 34 BIGNUM_ = 0x80000; /* 8 << 16 */ 35 BYTES = 0x90000; /* 9 << 16 */ 36 ULONG_REP = 0xA0000; /* 10 << 16 */ 37}; 38 39enum Tag { 40 TAG_INVALID = 0; // (TagType:INVALID | 0) 41 PURPOSE = 0x20001; // (TagType:ENUM_REP | 1) 42 ALGORITHM = 0x10002; // (TagType:ENUM | 2) 43 KEY_SIZE = 0x30003; // (TagType:UINT | 3) 44 BLOCK_MODE = 0x20004; // (TagType:ENUM_REP | 4) 45 DIGEST = 0x20005; // (TagType:ENUM_REP | 5) 46 PADDING = 0x20006; // (TagType:ENUM_REP | 6) 47 CALLER_NONCE = 0x70007; // (TagType:BOOL | 7) 48 MIN_MAC_LENGTH = 0x30008; // (TagType:UINT | 8) 49 /* RESERVED: KDF = 0x20009; // (TagType:ENUM_REP | 9) */ 50 EC_CURVE = 0x1000a; // (TagType:ENUM | 10) 51 RSA_PUBLIC_EXPONENT = 0x500c8; // (TagType:ULONG | 200) 52 /* RESERVED: ECIES_SINGLE_HASH_MODE = 0x700c9; // (TagType:BOOL | 201) */ 53 INCLUDE_UNIQUE_ID = 0x700ca; // (TagType:BOOL | 202) 54 RSA_OAEP_MGF_DIGEST = 0x200cb; // (TagType:ENUM_REP | 203) 55 BLOB_USAGE_REQUIREMENTS = 0x1012d; // (TagType:ENUM | 301) 56 BOOTLOADER_ONLY = 0x7012e; // (TagType:BOOL | 302) 57 ROLLBACK_RESISTANCE = 0x7012f; // (TagType:BOOL | 303) 58 HARDWARE_TYPE = 0x10130; // TagType:ENUM | 304, 59 EARLY_BOOT_ONLY = 0x70131; // TagType:BOOL | 305, 60 ACTIVE_DATETIME = 0x60190; // (TagType:DATE | 400) 61 ORIGINATION_EXPIRE_DATETIME = 0x60191; // (TagType:DATE | 401) 62 USAGE_EXPIRE_DATETIME = 0x60192; // (TagType:DATE | 402) 63 MIN_SECONDS_BETWEEN_OPS = 0x30193; // (TagType:UINT | 403) 64 MAX_USES_PER_BOOT = 0x30194; // (TagType:UINT | 404) 65 USAGE_COUNT_LIMIT = 0x30195; // (TagType:UINT | 405) 66 /* RESERVED: ALL_USERS = 0x701f4; // (TagType:BOOL | 500) */ 67 USER_ID = 0x301f5; // (TagType:UINT | 501) 68 USER_SECURE_ID = 0xa01f6; // (TagType:ULONG_REP | 502) 69 NO_AUTH_REQUIRED = 0x701f7; // (TagType:BOOL | 503) 70 USER_AUTH_TYPE = 0x101f8; // (TagType:ENUM | 504) 71 AUTH_TIMEOUT = 0x301f9; // (TagType:UINT | 505) 72 ALLOW_WHILE_ON_BODY = 0x701fa; // (TagType:BOOL | 506) 73 TRUSTED_USER_PRESENCE_REQUIRED = 0x701fb; // (TagType:BOOL | 507) 74 TRUSTED_CONFIRMATION_REQUIRED = 0x701fc; // (TagType:BOOL | 508) 75 UNLOCKED_DEVICE_REQUIRED = 0x701fd; // (TagType:BOOL | 509) 76 /* RESERVED: ALL_APPLICATIONS = 0x70258; // (TagType:BOOL | 600) */ 77 APPLICATION_ID = 0x90259; // (TagType:BYTES | 601) 78 /* RESERVED: EXPORTABLE = 0x7025a; // (TagType:BOOL | 602) */ 79 APPLICATION_DATA = 0x902bc; // (TagType:BYTES | 700) 80 CREATION_DATETIME = 0x602bd; // (TagType:DATE | 701) 81 ORIGIN = 0x102be; // (TagType:ENUM | 702) 82 /* RESERVED: ROLLBACK_RESISTANT = 0x702bf; // (TagType:BOOL | 703) */ 83 ROOT_OF_TRUST = 0x902c0; // (TagType:BYTES | 704) 84 OS_VERSION = 0x302c1; // (TagType:UINT | 705) 85 OS_PATCHLEVEL = 0x302c2; // (TagType:UINT | 706) 86 UNIQUE_ID = 0x902c3; // (TagType:BYTES | 707) 87 ATTESTATION_CHALLENGE = 0x902c4; // (TagType:BYTES | 708) 88 ATTESTATION_APPLICATION_ID = 0x902c5; // (TagType:BYTES | 709) 89 ATTESTATION_ID_BRAND = 0x902c6; // (TagType:BYTES | 710) 90 ATTESTATION_ID_DEVICE = 0x902c7; // (TagType:BYTES | 711) 91 ATTESTATION_ID_PRODUCT = 0x902c8; // (TagType:BYTES | 712) 92 ATTESTATION_ID_SERIAL = 0x902c9; // (TagType:BYTES | 713) 93 ATTESTATION_ID_IMEI = 0x902ca; // (TagType:BYTES | 714) 94 ATTESTATION_ID_MEID = 0x902cb; // (TagType:BYTES | 715) 95 ATTESTATION_ID_MANUFACTURER = 0x902cc; // (TagType:BYTES | 716) 96 ATTESTATION_ID_MODEL = 0x902cd; // (TagType:BYTES | 717) 97 VENDOR_PATCHLEVEL = 0x302ce; // (TagType:UINT | 718) 98 BOOT_PATCHLEVEL = 0x302cf; // (TagType:UINT | 719) 99 DEVICE_UNIQUE_ATTESTATION = 0x702d0; // (TagType:BOOL | 720) 100 IDENTITY_CREDENTIAL_KEY = 0x702d1; // (TagType:BOOL | 721) 101 STORAGE_KEY = 0x702d2; // (TagType:BOOL | 722) 102 ASSOCIATED_DATA = 0x903e8; // (TagType:BYTES | 1000) 103 NONCE = 0x903e9; // (TagType:BYTES | 1001) 104 /* RESERVED: AUTH_TOKEN = 0x903ea; // (TagType:BYTES | 1002) */ 105 MAC_LENGTH = 0x303eb; // (TagType:UINT | 1003) 106 RESET_SINCE_ID_ROTATION = 0x703ec; // (TagType:BOOL | 1004) 107 CONFIRMATION_TOKEN = 0x903ed; // (TagType:BYTES | 1005) 108 CERTIFICATE_SERIAL = 0x803ee; // (TagType:BIGNUM | 1006) 109 CERTIFICATE_SUBJECT = 0x903ef; // (TagType:BYTES | 1007) 110}; 111 112enum Algorithm { 113 RSA = 0; 114 EC = 1; 115 AES = 2; 116 DES = 3; 117 HMAC = 4; 118 ALGORITHM_MAX = 5; 119}; 120 121enum BlockMode { 122 ECB = 0; 123 CBC = 1; 124 CTR = 2; 125 GCM = 3; 126 BLOCK_MODE_MAX = 4; 127}; 128 129enum PaddingMode { 130 PADDING_NONE = 0; 131 PADDING_RSA_OAEP = 1; 132 PADDING_RSA_PSS = 2; 133 PADDING_RSA_PKCS1_1_5_ENCRYPT = 3; 134 PADDING_RSA_PKCS1_1_5_SIGN = 4; 135 PADDING_PKCS7 = 5; 136 PADDING_MODE_MAX = 6; 137}; 138 139enum Digest { 140 DIGEST_NONE = 0; 141 DIGEST_MD5 = 1; 142 DIGEST_SHA1 = 2; 143 DIGEST_SHA_2_224 = 3; 144 DIGEST_SHA_2_256 = 4; 145 DIGEST_SHA_2_384 = 5; 146 DIGEST_SHA_2_512 = 6; 147 DIGEST_MAX = 7; 148}; 149 150enum EcCurve { 151 P_224 = 0; 152 P_256 = 1; 153 P_384 = 2; 154 P_521 = 3; 155 EC_CURVE_MAX = 4; 156}; 157 158enum KeyOrigin { 159 GENERATED = 0; 160 DERIVED = 1; 161 IMPORTED = 2; 162 UNKNOWN = 3; 163 SECURELY_IMPORTED = 4; 164 KEY_ORIGIN_MAX = 5; 165}; 166 167enum KeyBlobUsageRequirements { 168 STANDALONE = 0; 169 REQUIRES_FILE_SYSTEM = 1; 170 KEY_USAGE_MAX = 2; 171}; 172 173enum KeyPurpose { 174 ENCRYPT = 0; 175 DECRYPT = 1; 176 SIGN = 2; 177 VERIFY = 3; 178 /* RESERVED: DERIVE_KEY = 4; */ 179 WRAP_KEY = 5; 180 AGREE_KEY = 6; 181 ATTEST_KEY = 7; 182 PURPOSE_MAX = 8; 183}; 184 185enum ErrorCode { 186 OK = 0; 187 ROOT_OF_TRUST_ALREADY_SET = 1; 188 UNSUPPORTED_PURPOSE = 2; 189 INCOMPATIBLE_PURPOSE = 3; 190 UNSUPPORTED_ALGORITHM = 4; 191 INCOMPATIBLE_ALGORITHM = 5; 192 UNSUPPORTED_KEY_SIZE = 6; 193 UNSUPPORTED_BLOCK_MODE = 7; 194 INCOMPATIBLE_BLOCK_MODE = 8; 195 UNSUPPORTED_MAC_LENGTH = 9; 196 UNSUPPORTED_PADDING_MODE = 10; 197 INCOMPATIBLE_PADDING_MODE = 11; 198 UNSUPPORTED_DIGEST = 12; 199 INCOMPATIBLE_DIGEST = 13; 200 INVALID_EXPIRATION_TIME = 14; 201 INVALID_USER_ID = 15; 202 INVALID_AUTHORIZATION_TIMEOUT = 16; 203 UNSUPPORTED_KEY_FORMAT = 17; 204 INCOMPATIBLE_KEY_FORMAT = 18; 205 UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = 19; 206 UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = 20; 207 INVALID_INPUT_LENGTH = 21; 208 KEY_EXPORT_OPTIONS_INVALID = 22; 209 DELEGATION_NOT_ALLOWED = 23; 210 KEY_NOT_YET_VALID = 24; 211 KEY_EXPIRED = 25; 212 KEY_USER_NOT_AUTHENTICATED = 26; 213 OUTPUT_PARAMETER_NULL = 27; 214 INVALID_OPERATION_HANDLE = 28; 215 INSUFFICIENT_BUFFER_SPACE = 29; 216 VERIFICATION_FAILED = 30; 217 TOO_MANY_OPERATIONS = 31; 218 UNEXPECTED_NULL_POINTER = 32; 219 INVALID_KEY_BLOB = 33; 220 IMPORTED_KEY_NOT_ENCRYPTED = 34; 221 IMPORTED_KEY_DECRYPTION_FAILED = 35; 222 IMPORTED_KEY_NOT_SIGNED = 36; 223 IMPORTED_KEY_VERIFICATION_FAILED = 37; 224 INVALID_ARGUMENT = 38; 225 UNSUPPORTED_TAG = 39; 226 INVALID_TAG = 40; 227 MEMORY_ALLOCATION_FAILED = 41; 228 IMPORT_PARAMETER_MISMATCH = 42; 229 SECURE_HW_ACCESS_DENIED = 43; 230 OPERATION_CANCELLED = 44; 231 CONCURRENT_ACCESS_CONFLICT = 45; 232 SECURE_HW_BUSY = 46; 233 SECURE_HW_COMMUNICATION_FAILED = 47; 234 UNSUPPORTED_EC_FIELD = 48; 235 MISSING_NONCE = 49; 236 INVALID_NONCE = 50; 237 MISSING_MAC_LENGTH = 51; 238 KEY_RATE_LIMIT_EXCEEDED = 52; 239 CALLER_NONCE_PROHIBITED = 53; 240 KEY_MAX_OPS_EXCEEDED = 54; 241 INVALID_MAC_LENGTH = 55; 242 MISSING_MIN_MAC_LENGTH = 56; 243 UNSUPPORTED_MIN_MAC_LENGTH = 57; 244 UNSUPPORTED_KDF = 58; 245 UNSUPPORTED_EC_CURVE = 59; 246 KEY_REQUIRES_UPGRADE = 60; 247 ATTESTATION_CHALLENGE_MISSING = 61; 248 KEYMASTER_NOT_CONFIGURED = 62; 249 ATTESTATION_APPLICATION_ID_MISSING = 63; 250 CANNOT_ATTEST_IDS = 64; 251 UNIMPLEMENTED = 65; 252 VERSION_MISMATCH = 66; 253 ROLLBACK_RESISTANCE_UNAVAILABLE = 67; 254 HARDWARE_TYPE_UNAVAILABLE = 68; 255 PROOF_OF_PRESENCE_REQUIRED = 69; 256 CONCURRENT_PROOF_OF_PRESENCE_REQUESTED = 70; 257 UNKNOWN_ERROR = 71; 258 INVALID_DEVICE_IDS = 72; // Vendor specific. 259 PRODUCTION_MODE_PROVISIONING = 73; // Vendor specific. 260 NO_USER_CONFIRMATION = 74; 261 KEY_UPGRADE_NOT_REQUIRED = 75; // Vendor specific. 262 DEVICE_LOCKED = 76; 263 EARLY_BOOT_ENDED = 77; 264 ATTESTATION_KEYS_NOT_PROVISIONED = 78; 265 ATTESTATION_IDS_NOT_PROVISIONED = 79; 266 INVALID_OPERATION = 80; 267 STORAGE_KEY_UNSUPPORTED = 81; 268 INCOMPATIBLE_MGF_DIGEST = 82; 269 UNSUPPORTED_MGF_DIGEST = 83; 270}; 271 272enum SecurityLevel { 273 SOFTWARE = 0; 274 TRUSTED_ENVIRONMENT = 1; 275 STRONGBOX = 2; 276}; 277 278// NOTE: these enum values must be kept in sync with the HAL, 279// as they are used in an HMAC calculation. 280enum HardwareAuthenticatorType { 281 HW_AUTH_NONE = 0; 282 HW_AUTH_PASSWORD = 1; 283 HW_AUTH_FINGERPRINT = 2; 284 // Additional entries must be powers of 2. 285}; 286 287enum KeyFormat { 288 X509 = 0; /* for public key export */ 289 PKCS8 = 1; /* for asymmetric key pair import */ 290 RAW = 3; /* for symmetric key import and export*/ 291} 292 293enum DTupError { 294 DTUP_OK = 0; 295 DTUP_NO_EVENT = 1; 296} 297 298/* matches Linux event device codes */ 299enum DTupKeyEvent { 300 DTUP_RESERVED = 0; 301 DTUP_VOL_DOWN = 114; 302 DTUP_VOL_UP = 115; 303 DTUP_PWR = 116; 304} 305 306enum BootColor { 307 BOOT_VERIFIED_GREEN = 0; 308 BOOT_SELFSIGNED_YELLOW = 1; 309 BOOT_UNVERIFIED_ORANGE = 2; 310 BOOT_VERIFY_FAILED_RED = 3; 311} 312 313enum ChipFusing { 314 FUSING_PROTO = 0; 315 FUSING_DVT = 1; 316 FUSING_PVT = 2; // Strongbox gen v0 certs. 317 FUSING_PVT_1 = 3; // Strongbox gen v1 certs. 318 FUSING_D_PVT = 4; // Dauntless gen v0 certs. 319 FUSING_D_PVT_1 = 5; // Dauntless gen v1 certs. 320} 321 322enum CertificateStatus { 323 CERT_PREVIOUSLY_PROVISIONED = 0; 324 CERT_MISSING = 1; 325 CERT_CHECKSUM = 2; 326 CERT_UNKNOWN_ERROR = 3; 327 CERT_WRONG_PACKET = 4; 328} 329