1 /* Copyright 2019, The Android Open Source Project, Inc. 2 * 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 16 package com.google.android.attestation; 17 18 /** Key Attestation constants */ 19 public class Constants { 20 21 // The Google root certificate that must have been used to sign the root 22 // certificate in a real attestation certificate chain from a compliant 23 // device. 24 // (Note, the sample chain used here is not signed with this certificate.) 25 public static final String GOOGLE_ROOT_CERTIFICATE = 26 "-----BEGIN CERTIFICATE-----\n" 27 + "MIIFYDCCA0igAwIBAgIJAOj6GWMU0voYMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV" 28 + "BAUTEGY5MjAwOWU4NTNiNmIwNDUwHhcNMTYwNTI2MTYyODUyWhcNMjYwNTI0MTYy" 29 + "ODUyWjAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MIICIjANBgkqhkiG9w0B" 30 + "AQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdS" 31 + "Sxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7" 32 + "tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggj" 33 + "nar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGq" 34 + "C4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQ" 35 + "oVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+O" 36 + "JtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/Eg" 37 + "sTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRi" 38 + "igHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+M" 39 + "RPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9E" 40 + "aDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5Um" 41 + "AGMCAwEAAaOBpjCBozAdBgNVHQ4EFgQUNmHhAHyIBQlRi0RsR/8aTMnqTxIwHwYD" 42 + "VR0jBBgwFoAUNmHhAHyIBQlRi0RsR/8aTMnqTxIwDwYDVR0TAQH/BAUwAwEB/zAO" 43 + "BgNVHQ8BAf8EBAMCAYYwQAYDVR0fBDkwNzA1oDOgMYYvaHR0cHM6Ly9hbmRyb2lk" 44 + "Lmdvb2dsZWFwaXMuY29tL2F0dGVzdGF0aW9uL2NybC8wDQYJKoZIhvcNAQELBQAD" 45 + "ggIBACDIw41L3KlXG0aMiS//cqrG+EShHUGo8HNsw30W1kJtjn6UBwRM6jnmiwfB" 46 + "Pb8VA91chb2vssAtX2zbTvqBJ9+LBPGCdw/E53Rbf86qhxKaiAHOjpvAy5Y3m00m" 47 + "qC0w/Zwvju1twb4vhLaJ5NkUJYsUS7rmJKHHBnETLi8GFqiEsqTWpG/6ibYCv7rY" 48 + "DBJDcR9W62BW9jfIoBQcxUCUJouMPH25lLNcDc1ssqvC2v7iUgI9LeoM1sNovqPm" 49 + "QUiG9rHli1vXxzCyaMTjwftkJLkf6724DFhuKug2jITV0QkXvaJWF4nUaHOTNA4u" 50 + "JU9WDvZLI1j83A+/xnAJUucIv/zGJ1AMH2boHqF8CY16LpsYgBt6tKxxWH00XcyD" 51 + "CdW2KlBCeqbQPcsFmWyWugxdcekhYsAWyoSf818NUsZdBWBaR/OukXrNLfkQ79Iy" 52 + "ZohZbvabO/X+MVT3rriAoKc8oE2Uws6DF+60PV7/WIPjNvXySdqspImSN78mflxD" 53 + "qwLqRBYkA3I75qppLGG9rp7UCdRjxMl8ZDBld+7yvHVgt1cVzJx9xnyGCC23Uaic" 54 + "MDSXYrB4I4WHXPGjxhZuCuPBLTdOLU8YRvMYdEvYebWHMpvwGCF6bAx3JBpIeOQ1" 55 + "wDB5y0USicV3YgYGmi+NZfhA4URSh77Yd6uuJOJENRaNVTzk\n" 56 + "-----END CERTIFICATE-----"; 57 static final String KEY_DESCRIPTION_OID = "1.3.6.1.4.1.11129.2.1.17"; 58 static final int ATTESTATION_VERSION_INDEX = 0; 59 static final int ATTESTATION_SECURITY_LEVEL_INDEX = 1; 60 static final int KEYMASTER_VERSION_INDEX = 2; 61 static final int KEYMASTER_SECURITY_LEVEL_INDEX = 3; 62 static final int ATTESTATION_CHALLENGE_INDEX = 4; 63 static final int UNIQUE_ID_INDEX = 5; 64 static final int SW_ENFORCED_INDEX = 6; 65 static final int TEE_ENFORCED_INDEX = 7; 66 // Authorization list tags. The list is in this AOSP file: 67 // hardware/libhardware/include/hardware/keymaster_defs.h 68 static final int KM_TAG_PURPOSE = 1; 69 static final int KM_TAG_ALGORITHM = 2; 70 static final int KM_TAG_KEY_SIZE = 3; 71 static final int KM_TAG_DIGEST = 5; 72 static final int KM_TAG_PADDING = 6; 73 static final int KM_TAG_EC_CURVE = 10; 74 static final int KM_TAG_RSA_PUBLIC_EXPONENT = 200; 75 static final int KM_TAG_ROLLBACK_RESISTANCE = 303; 76 static final int KM_TAG_ACTIVE_DATE_TIME = 400; 77 static final int KM_TAG_ORIGINATION_EXPIRE_DATE_TIME = 401; 78 static final int KM_TAG_USAGE_EXPIRE_DATE_TIME = 402; 79 static final int KM_TAG_NO_AUTH_REQUIRED = 503; 80 static final int KM_TAG_USER_AUTH_TYPE = 504; 81 static final int KM_TAG_AUTH_TIMEOUT = 505; 82 static final int KM_TAG_ALLOW_WHILE_ON_BODY = 506; 83 static final int KM_TAG_TRUSTED_USER_PRESENCE_REQUIRED = 507; 84 static final int KM_TAG_TRUSTED_CONFIRMATION_REQUIRED = 508; 85 static final int KM_TAG_UNLOCKED_DEVICE_REQUIRED = 509; 86 static final int KM_TAG_ALL_APPLICATIONS = 600; 87 static final int KM_TAG_APPLICATION_ID = 601; 88 static final int KM_TAG_CREATION_DATE_TIME = 701; 89 static final int KM_TAG_ORIGIN = 702; 90 static final int KM_TAG_ROLLBACK_RESISTANT = 703; 91 static final int KM_TAG_ROOT_OF_TRUST = 704; 92 static final int KM_TAG_OS_VERSION = 705; 93 static final int KM_TAG_OS_PATCH_LEVEL = 706; 94 static final int KM_TAG_ATTESTATION_APPLICATION_ID = 709; 95 static final int KM_TAG_ATTESTATION_ID_BRAND = 710; 96 static final int KM_TAG_ATTESTATION_ID_DEVICE = 711; 97 static final int KM_TAG_ATTESTATION_ID_PRODUCT = 712; 98 static final int KM_TAG_ATTESTATION_ID_SERIAL = 713; 99 static final int KM_TAG_ATTESTATION_ID_IMEI = 714; 100 static final int KM_TAG_ATTESTATION_ID_MEID = 715; 101 static final int KM_TAG_ATTESTATION_ID_MANUFACTURER = 716; 102 static final int KM_TAG_ATTESTATION_ID_MODEL = 717; 103 static final int KM_TAG_VENDOR_PATCH_LEVEL = 718; 104 static final int KM_TAG_BOOT_PATCH_LEVEL = 719; 105 static final int KM_TAG_DEVICE_UNIQUE_ATTESTATION = 720; 106 static final int ROOT_OF_TRUST_VERIFIED_BOOT_KEY_INDEX = 0; 107 static final int ROOT_OF_TRUST_DEVICE_LOCKED_INDEX = 1; 108 static final int ROOT_OF_TRUST_VERIFIED_BOOT_STATE_INDEX = 2; 109 static final int ROOT_OF_TRUST_VERIFIED_BOOT_HASH_INDEX = 3; 110 static final int ATTESTATION_APPLICATION_ID_PACKAGE_INFOS_INDEX = 0; 111 static final int ATTESTATION_APPLICATION_ID_SIGNATURE_DIGESTS_INDEX = 1; 112 static final int ATTESTATION_PACKAGE_INFO_PACKAGE_NAME_INDEX = 0; 113 static final int ATTESTATION_PACKAGE_INFO_VERSION_INDEX = 1; 114 // Some security values. The complete list is in this AOSP file: 115 // hardware/libhardware/include/hardware/keymaster_defs.h 116 static final int KM_SECURITY_LEVEL_SOFTWARE = 0; 117 static final int KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT = 1; 118 static final int KM_SECURITY_LEVEL_STRONG_BOX = 2; 119 static final int KM_VERIFIED_BOOT_STATE_VERIFIED = 0; 120 static final int KM_VERIFIED_BOOT_STATE_SELF_SIGNED = 1; 121 static final int KM_VERIFIED_BOOT_STATE_UNVERIFIED = 2; 122 static final int KM_VERIFIED_BOOT_STATE_FAILED = 3; 123 // Unsigned max value of 32-bit integer, 2^32 - 1 124 static final long UINT32_MAX = (((long) Integer.MAX_VALUE) << 1) + 1; 125 } 126