1 /*
2 * Copyright 2020, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <iostream>
18 #include <utility>
19
20 #include <openssl/asn1.h>
21 #include <openssl/evp.h>
22 #include <openssl/x509v3.h>
23
24 #include <hardware/keymaster_defs.h>
25 #include <keymaster/android_keymaster_utils.h>
26 #include <keymaster/authorization_set.h>
27 #include <keymaster/km_openssl/asymmetric_key.h>
28 #include <keymaster/km_openssl/certificate_utils.h>
29 #include <keymaster/km_openssl/openssl_err.h>
30 #include <keymaster/logger.h>
31
32 namespace keymaster {
33
34 namespace {
35
36 constexpr const char kDefaultSubject[] = "Android Keystore Key";
37 constexpr int kDataEnciphermentKeyUsageBit = 3;
38 constexpr int kDigitalSignatureKeyUsageBit = 0;
39 constexpr int kKeyEnciphermentKeyUsageBit = 2;
40 constexpr int kKeyAgreementKeyUsageBit = 4;
41 constexpr int kMaxKeyUsageBit = 8;
42
min(T && a,T && b)43 template <typename T> T&& min(T&& a, T&& b) {
44 return (a < b) ? std::forward<T>(a) : std::forward<T>(b);
45 }
46
fake_sign_cert(X509 * cert)47 keymaster_error_t fake_sign_cert(X509* cert) {
48 X509_ALGOR_Ptr algor(X509_ALGOR_new());
49 if (!algor.get()) {
50 return TranslateLastOpenSslError();
51 }
52 X509_ALGOR_set0(algor.get(), OBJ_nid2obj(NID_sha256WithRSAEncryption), V_ASN1_NULL, nullptr);
53
54 // Set signature to a bit string containing a single byte, value 0.
55 uint8_t fake_sig = 0;
56 if (!X509_set1_signature_algo(cert, algor.get()) ||
57 !X509_set1_signature_value(cert, &fake_sig, sizeof(fake_sig))) {
58 return TranslateLastOpenSslError();
59 }
60
61 return KM_ERROR_OK;
62 }
63
64 } // namespace
65
make_name_from_str(const char name[],X509_NAME_Ptr * name_out)66 keymaster_error_t make_name_from_str(const char name[], X509_NAME_Ptr* name_out) {
67 if (name_out == nullptr) return KM_ERROR_UNEXPECTED_NULL_POINTER;
68 X509_NAME_Ptr x509_name(X509_NAME_new());
69 if (!x509_name.get()) {
70 return TranslateLastOpenSslError();
71 }
72 if (!X509_NAME_add_entry_by_txt(x509_name.get(), //
73 "CN", //
74 MBSTRING_ASC, reinterpret_cast<const uint8_t*>(&name[0]),
75 -1, // len
76 -1, // loc
77 0 /* set */)) {
78 return TranslateLastOpenSslError();
79 }
80 *name_out = std::move(x509_name);
81 return KM_ERROR_OK;
82 }
83
make_name_from_der(const keymaster_blob_t & name,X509_NAME_Ptr * name_out)84 keymaster_error_t make_name_from_der(const keymaster_blob_t& name, X509_NAME_Ptr* name_out) {
85 if (!name_out || !name.data) return KM_ERROR_UNEXPECTED_NULL_POINTER;
86
87 const uint8_t* p = name.data;
88 X509_NAME_Ptr x509_name(d2i_X509_NAME(nullptr, &p, name.data_length));
89 if (!x509_name.get()) {
90 return TranslateLastOpenSslError();
91 }
92
93 *name_out = std::move(x509_name);
94 return KM_ERROR_OK;
95 }
96
get_common_name(X509_NAME * name,UniquePtr<const char[]> * name_out)97 keymaster_error_t get_common_name(X509_NAME* name, UniquePtr<const char[]>* name_out) {
98 if (name == nullptr || name_out == nullptr) return KM_ERROR_UNEXPECTED_NULL_POINTER;
99 int len = X509_NAME_get_text_by_NID(name, NID_commonName, nullptr, 0);
100 UniquePtr<char[]> name_ptr(new (std::nothrow) char[len]);
101 if (!name_ptr) {
102 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
103 }
104 X509_NAME_get_text_by_NID(name, NID_commonName, name_ptr.get(), len);
105 *name_out = UniquePtr<const char[]>{name_ptr.release()};
106 return KM_ERROR_OK;
107 }
108
get_certificate_params(const AuthorizationSet & caller_params,CertificateCallerParams * cert_params,KmVersion kmVersion)109 keymaster_error_t get_certificate_params(const AuthorizationSet& caller_params,
110 CertificateCallerParams* cert_params,
111 KmVersion kmVersion) {
112 if (!cert_params) return KM_ERROR_UNEXPECTED_NULL_POINTER;
113
114 BIGNUM_Ptr serial(BN_new());
115 if (!serial) {
116 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
117 }
118
119 keymaster_blob_t serial_blob{.data = nullptr, .data_length = 0};
120 if (caller_params.GetTagValue(TAG_CERTIFICATE_SERIAL, &serial_blob)) {
121 if (BN_bin2bn(serial_blob.data, serial_blob.data_length, serial.get()) == nullptr) {
122 return TranslateLastOpenSslError();
123 }
124 } else {
125 // Default serial is one.
126 BN_one(serial.get());
127 }
128 cert_params->serial = std::move(serial);
129
130 cert_params->active_date_time = 0;
131 cert_params->expire_date_time = kUndefinedExpirationDateTime;
132
133 uint64_t tmp;
134 if (kmVersion < KmVersion::KEYMINT_1) {
135 if (caller_params.GetTagValue(TAG_ACTIVE_DATETIME, &tmp)) {
136 LOG_D("Using TAG_ACTIVE_DATETIME: %lu", tmp);
137 cert_params->active_date_time = static_cast<int64_t>(tmp);
138 }
139 if (caller_params.GetTagValue(TAG_ORIGINATION_EXPIRE_DATETIME, &tmp)) {
140 LOG_D("Using TAG_ORIGINATION_EXPIRE_DATETIME: %lu", tmp);
141 cert_params->expire_date_time = static_cast<int64_t>(tmp);
142 }
143 } else {
144 if (!caller_params.GetTagValue(TAG_CERTIFICATE_NOT_BEFORE, &tmp)) {
145 return KM_ERROR_MISSING_NOT_BEFORE;
146 }
147 LOG_D("Using TAG_CERTIFICATE_NOT_BEFORE: %lu", tmp);
148 cert_params->active_date_time = static_cast<int64_t>(tmp);
149
150 if (!caller_params.GetTagValue(TAG_CERTIFICATE_NOT_AFTER, &tmp)) {
151 return KM_ERROR_MISSING_NOT_AFTER;
152 }
153 LOG_D("Using TAG_CERTIFICATE_NOT_AFTER: %lu", tmp);
154 cert_params->expire_date_time = static_cast<int64_t>(tmp);
155 }
156
157 LOG_D("Got certificate date params: NotBefore = %ld, NotAfter = %ld",
158 cert_params->active_date_time, cert_params->expire_date_time);
159
160 keymaster_blob_t subject{};
161 if (caller_params.GetTagValue(TAG_CERTIFICATE_SUBJECT, &subject) && subject.data_length) {
162 return make_name_from_der(subject, &cert_params->subject_name);
163 }
164
165 return make_name_from_str(kDefaultSubject, &cert_params->subject_name);
166 }
167
make_key_usage_extension(bool is_signing_key,bool is_encryption_key,bool is_key_agreement_key,X509_EXTENSION_Ptr * usage_extension_out)168 keymaster_error_t make_key_usage_extension(bool is_signing_key, bool is_encryption_key,
169 bool is_key_agreement_key,
170 X509_EXTENSION_Ptr* usage_extension_out) {
171 if (usage_extension_out == nullptr) return KM_ERROR_UNEXPECTED_NULL_POINTER;
172
173 // Build BIT_STRING with correct contents.
174 ASN1_BIT_STRING_Ptr key_usage(ASN1_BIT_STRING_new());
175 if (!key_usage) return KM_ERROR_MEMORY_ALLOCATION_FAILED;
176
177 for (size_t i = 0; i <= kMaxKeyUsageBit; ++i) {
178 if (!ASN1_BIT_STRING_set_bit(key_usage.get(), i, 0)) {
179 return TranslateLastOpenSslError();
180 }
181 }
182
183 if (is_signing_key) {
184 if (!ASN1_BIT_STRING_set_bit(key_usage.get(), kDigitalSignatureKeyUsageBit, 1)) {
185 return TranslateLastOpenSslError();
186 }
187 }
188
189 if (is_encryption_key) {
190 if (!ASN1_BIT_STRING_set_bit(key_usage.get(), kKeyEnciphermentKeyUsageBit, 1) ||
191 !ASN1_BIT_STRING_set_bit(key_usage.get(), kDataEnciphermentKeyUsageBit, 1)) {
192 return TranslateLastOpenSslError();
193 }
194 }
195
196 if (is_key_agreement_key) {
197 if (!ASN1_BIT_STRING_set_bit(key_usage.get(), kKeyAgreementKeyUsageBit, 1)) {
198 return TranslateLastOpenSslError();
199 }
200 }
201
202 // Convert to octets
203 int len = i2d_ASN1_BIT_STRING(key_usage.get(), nullptr);
204 if (len < 0) {
205 return TranslateLastOpenSslError();
206 }
207 UniquePtr<uint8_t[]> asn1_key_usage(new (std::nothrow) uint8_t[len]);
208 if (!asn1_key_usage.get()) {
209 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
210 }
211 uint8_t* p = asn1_key_usage.get();
212 len = i2d_ASN1_BIT_STRING(key_usage.get(), &p);
213 if (len < 0) {
214 return TranslateLastOpenSslError();
215 }
216
217 // Build OCTET_STRING
218 ASN1_OCTET_STRING_Ptr key_usage_str(ASN1_OCTET_STRING_new());
219 if (!key_usage_str.get() ||
220 !ASN1_OCTET_STRING_set(key_usage_str.get(), asn1_key_usage.get(), len)) {
221 return TranslateLastOpenSslError();
222 }
223
224 X509_EXTENSION_Ptr key_usage_extension(X509_EXTENSION_create_by_NID(nullptr, //
225 NID_key_usage, //
226 true /* critical */,
227 key_usage_str.get()));
228 if (!key_usage_extension.get()) {
229 return TranslateLastOpenSslError();
230 }
231
232 *usage_extension_out = std::move(key_usage_extension);
233
234 return KM_ERROR_OK;
235 }
236
237 // Creates a rump certificate structure with serial, subject and issuer names, as well as
238 // activation and expiry date.
239 // Callers should pass an empty X509_Ptr and check the return value for KM_ERROR_OK (0) before
240 // accessing the result.
make_cert_rump(const X509_NAME * issuer,const CertificateCallerParams & cert_params,X509_Ptr * cert_out)241 keymaster_error_t make_cert_rump(const X509_NAME* issuer,
242 const CertificateCallerParams& cert_params, X509_Ptr* cert_out) {
243 if (!cert_out || !issuer) return KM_ERROR_UNEXPECTED_NULL_POINTER;
244
245 // Create certificate structure.
246 X509_Ptr certificate(X509_new());
247 if (!certificate.get()) return TranslateLastOpenSslError();
248
249 // Set the X509 version.
250 if (!X509_set_version(certificate.get(), 2 /* version 3 */)) return TranslateLastOpenSslError();
251
252 // Set the certificate serialNumber
253 ASN1_INTEGER_Ptr serial_number(ASN1_INTEGER_new());
254 if (!serial_number.get() || //
255 !BN_to_ASN1_INTEGER(cert_params.serial.get(), serial_number.get()) ||
256 !X509_set_serialNumber(certificate.get(),
257 serial_number.get() /* Don't release; copied */)) {
258 return TranslateLastOpenSslError();
259 }
260
261 if (!X509_set_subject_name(certificate.get(),
262 const_cast<X509_NAME*>(cert_params.subject_name.get()))) {
263 return TranslateLastOpenSslError();
264 }
265
266 if (!X509_set_issuer_name(certificate.get(), const_cast<X509_NAME*>(issuer))) {
267 return TranslateLastOpenSslError();
268 }
269
270 // Set activation date.
271 ASN1_TIME_Ptr notBefore(ASN1_TIME_new());
272 LOG_D("Setting notBefore to %ld: ", cert_params.active_date_time / 1000);
273 time_t notBeforeTime = static_cast<time_t>(cert_params.active_date_time / 1000);
274 if (!notBefore.get() || !ASN1_TIME_set(notBefore.get(), notBeforeTime) ||
275 !X509_set_notBefore(certificate.get(), notBefore.get() /* Don't release; copied */)) {
276 return TranslateLastOpenSslError();
277 }
278
279 // Set expiration date.
280 ASN1_TIME_Ptr notAfter(ASN1_TIME_new());
281 LOG_D("Setting notAfter to %ld: ", cert_params.expire_date_time / 1000);
282 time_t notAfterTime = static_cast<time_t>(cert_params.expire_date_time / 1000);
283
284 if (!notAfter.get() || !ASN1_TIME_set(notAfter.get(), notAfterTime) ||
285 !X509_set_notAfter(certificate.get(), notAfter.get() /* Don't release; copied */)) {
286 return TranslateLastOpenSslError();
287 }
288
289 *cert_out = std::move(certificate);
290 return KM_ERROR_OK;
291 }
292
make_cert(const EVP_PKEY * evp_pkey,const X509_NAME * issuer,const CertificateCallerParams & cert_params,X509_Ptr * cert_out)293 keymaster_error_t make_cert(const EVP_PKEY* evp_pkey, const X509_NAME* issuer,
294 const CertificateCallerParams& cert_params, X509_Ptr* cert_out) {
295
296 // Make the rump certificate with serial, subject, not before and not after dates.
297 X509_Ptr certificate;
298 if (keymaster_error_t error = make_cert_rump(issuer, cert_params, &certificate)) {
299 return error;
300 }
301
302 // Set the public key.
303 if (!X509_set_pubkey(certificate.get(), (EVP_PKEY*)evp_pkey)) {
304 return TranslateLastOpenSslError();
305 }
306
307 // Make and add the key usage extension.
308 X509_EXTENSION_Ptr key_usage_extension;
309 if (auto error =
310 make_key_usage_extension(cert_params.is_signing_key, cert_params.is_encryption_key,
311 cert_params.is_agreement_key, &key_usage_extension)) {
312 return error;
313 }
314 if (!X509_add_ext(certificate.get(), key_usage_extension.get() /* Don't release; copied */,
315 -1 /* insert at end */)) {
316 return TranslateLastOpenSslError();
317 }
318
319 *cert_out = std::move(certificate);
320 return KM_ERROR_OK;
321 }
322
sign_cert(X509 * certificate,const EVP_PKEY * signing_key)323 keymaster_error_t sign_cert(X509* certificate, const EVP_PKEY* signing_key) {
324 if (!certificate || !signing_key) return KM_ERROR_UNEXPECTED_NULL_POINTER;
325
326 // X509_sign takes the key as non-const, but per the BoringSSL dev team, that's a legacy
327 // mistake that hasn't yet been corrected.
328 auto sk = const_cast<EVP_PKEY*>(signing_key);
329
330 // Ed25519 has an internal digest so needs to have no digest fed into X509_sign.
331 const EVP_MD* digest = (EVP_PKEY_id(signing_key) == EVP_PKEY_ED25519) ? nullptr : EVP_sha256();
332
333 if (!X509_sign(certificate, sk, digest)) {
334 return TranslateLastOpenSslError();
335 }
336 return KM_ERROR_OK;
337 }
338
generate_self_signed_cert(const AsymmetricKey & key,const AuthorizationSet & params,bool fake_signature,keymaster_error_t * error)339 CertificateChain generate_self_signed_cert(const AsymmetricKey& key, const AuthorizationSet& params,
340 bool fake_signature, keymaster_error_t* error) {
341 keymaster_error_t err;
342 if (!error) error = &err;
343
344 EVP_PKEY_Ptr pkey(key.InternalToEvp());
345 if (pkey.get() == nullptr) {
346 *error = TranslateLastOpenSslError();
347 return {};
348 }
349
350 CertificateCallerParams cert_params{};
351 // Self signed certificates are only generated since Keymint 1.0. To keep the API stable for
352 // now, we pass KEYMINT_1 to get_certificate_params, which has the intended effect. If
353 // get_certificate_params ever has to distinguish between versions of KeyMint this needs to be
354 // changed.
355 *error = get_certificate_params(params, &cert_params, KmVersion::KEYMINT_1);
356 if (*error != KM_ERROR_OK) return {};
357
358 cert_params.is_signing_key =
359 (key.authorizations().Contains(TAG_PURPOSE, KM_PURPOSE_SIGN) ||
360 key.authorizations().Contains(TAG_PURPOSE, KM_PURPOSE_ATTEST_KEY));
361 cert_params.is_encryption_key = key.authorizations().Contains(TAG_PURPOSE, KM_PURPOSE_DECRYPT);
362 cert_params.is_agreement_key = key.authorizations().Contains(TAG_PURPOSE, KM_PURPOSE_AGREE_KEY);
363
364 X509_Ptr cert;
365 *error = make_cert(pkey.get(), cert_params.subject_name.get() /* issuer */, cert_params, &cert);
366 if (*error != KM_ERROR_OK) return {};
367
368 if (fake_signature) {
369 *error = fake_sign_cert(cert.get());
370 } else {
371 *error = sign_cert(cert.get(), pkey.get());
372 }
373 if (*error != KM_ERROR_OK) return {};
374
375 CertificateChain result(1);
376 if (!result) {
377 *error = KM_ERROR_MEMORY_ALLOCATION_FAILED;
378 return {};
379 }
380
381 *error = encode_certificate(cert.get(), &result.entries[0]);
382 if (*error != KM_ERROR_OK) return {};
383
384 return result;
385 }
386
encode_certificate(X509 * certificate,keymaster_blob_t * blob)387 keymaster_error_t encode_certificate(X509* certificate, keymaster_blob_t* blob) {
388 int len = i2d_X509(certificate, nullptr /* ppout */);
389 if (len < 0) return TranslateLastOpenSslError();
390
391 blob->data = new (std::nothrow) uint8_t[len];
392 if (!blob->data) return KM_ERROR_MEMORY_ALLOCATION_FAILED;
393
394 uint8_t* p = const_cast<uint8_t*>(blob->data);
395 blob->data_length = i2d_X509(certificate, &p);
396 return KM_ERROR_OK;
397 }
398
399 } // namespace keymaster
400