1 /* Copyright 2019, The Android Open Source Project, Inc. 2 * 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 16 package com.google.android.attestation; 17 18 /** Key Attestation constants */ 19 public class Constants { 20 21 // The Google root public key corresponding to the private key that must 22 // have been used to self-sign the root of a real attestation certificate 23 // chain from a compliant device. 24 // (Note, the sample chain used here is not signed with the Google root CA.) 25 public static final String GOOGLE_ROOT_CA_PUB_KEY = 26 "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xU" 27 + "FmOr75gvMsd/dTEDDJdSSxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5j" 28 + "lRfdnJLmN0pTy/4lj4/7tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y" 29 + "//0rb+T+W8a9nsNL/ggjnar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73X" 30 + "pXyTqRxB/M0n1n/W9nGqC4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYI" 31 + "mQQcHtGl/m00QLVWutHQoVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB" 32 + "+TxywElgS70vE0XmLD+OJtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7q" 33 + "uvmag8jfPioyKvxnK/EgsTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgp" 34 + "Zrt3i5MIlCaY504LzSRiigHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7" 35 + "gLiMm0jhO2B6tUXHI/+MRPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82" 36 + "ixPvZtXQpUpuL12ab+9EaDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+" 37 + "NpUFgNPN9PvQi8WEg5UmAGMCAwEAAQ=="; 38 static final String KEY_DESCRIPTION_OID = "1.3.6.1.4.1.11129.2.1.17"; 39 static final int ATTESTATION_VERSION_INDEX = 0; 40 static final int ATTESTATION_SECURITY_LEVEL_INDEX = 1; 41 static final int KEYMASTER_VERSION_INDEX = 2; 42 static final int KEYMASTER_SECURITY_LEVEL_INDEX = 3; 43 static final int ATTESTATION_CHALLENGE_INDEX = 4; 44 static final int UNIQUE_ID_INDEX = 5; 45 static final int SW_ENFORCED_INDEX = 6; 46 static final int TEE_ENFORCED_INDEX = 7; 47 // Authorization list tags. The list is in this AOSP file: 48 // hardware/libhardware/include/hardware/keymaster_defs.h 49 static final int KM_TAG_PURPOSE = 1; 50 static final int KM_TAG_ALGORITHM = 2; 51 static final int KM_TAG_KEY_SIZE = 3; 52 static final int KM_TAG_DIGEST = 5; 53 static final int KM_TAG_PADDING = 6; 54 static final int KM_TAG_EC_CURVE = 10; 55 static final int KM_TAG_RSA_PUBLIC_EXPONENT = 200; 56 static final int KM_TAG_ROLLBACK_RESISTANCE = 303; 57 static final int KM_TAG_ACTIVE_DATE_TIME = 400; 58 static final int KM_TAG_ORIGINATION_EXPIRE_DATE_TIME = 401; 59 static final int KM_TAG_USAGE_EXPIRE_DATE_TIME = 402; 60 static final int KM_TAG_NO_AUTH_REQUIRED = 503; 61 static final int KM_TAG_USER_AUTH_TYPE = 504; 62 static final int KM_TAG_AUTH_TIMEOUT = 505; 63 static final int KM_TAG_ALLOW_WHILE_ON_BODY = 506; 64 static final int KM_TAG_TRUSTED_USER_PRESENCE_REQUIRED = 507; 65 static final int KM_TAG_TRUSTED_CONFIRMATION_REQUIRED = 508; 66 static final int KM_TAG_UNLOCKED_DEVICE_REQUIRED = 509; 67 static final int KM_TAG_ALL_APPLICATIONS = 600; 68 static final int KM_TAG_APPLICATION_ID = 601; 69 static final int KM_TAG_CREATION_DATE_TIME = 701; 70 static final int KM_TAG_ORIGIN = 702; 71 static final int KM_TAG_ROLLBACK_RESISTANT = 703; 72 static final int KM_TAG_ROOT_OF_TRUST = 704; 73 static final int KM_TAG_OS_VERSION = 705; 74 static final int KM_TAG_OS_PATCH_LEVEL = 706; 75 static final int KM_TAG_ATTESTATION_APPLICATION_ID = 709; 76 static final int KM_TAG_ATTESTATION_ID_BRAND = 710; 77 static final int KM_TAG_ATTESTATION_ID_DEVICE = 711; 78 static final int KM_TAG_ATTESTATION_ID_PRODUCT = 712; 79 static final int KM_TAG_ATTESTATION_ID_SERIAL = 713; 80 static final int KM_TAG_ATTESTATION_ID_IMEI = 714; 81 static final int KM_TAG_ATTESTATION_ID_MEID = 715; 82 static final int KM_TAG_ATTESTATION_ID_MANUFACTURER = 716; 83 static final int KM_TAG_ATTESTATION_ID_MODEL = 717; 84 static final int KM_TAG_VENDOR_PATCH_LEVEL = 718; 85 static final int KM_TAG_BOOT_PATCH_LEVEL = 719; 86 static final int KM_TAG_DEVICE_UNIQUE_ATTESTATION = 720; 87 static final int KM_TAG_IDENTITY_CREDENTIAL_KEY = 721; 88 static final int KM_TAG_ATTESTATION_ID_SECOND_IMEI = 723; 89 static final int ROOT_OF_TRUST_VERIFIED_BOOT_KEY_INDEX = 0; 90 static final int ROOT_OF_TRUST_DEVICE_LOCKED_INDEX = 1; 91 static final int ROOT_OF_TRUST_VERIFIED_BOOT_STATE_INDEX = 2; 92 static final int ROOT_OF_TRUST_VERIFIED_BOOT_HASH_INDEX = 3; 93 static final int ATTESTATION_APPLICATION_ID_PACKAGE_INFOS_INDEX = 0; 94 static final int ATTESTATION_APPLICATION_ID_SIGNATURE_DIGESTS_INDEX = 1; 95 static final int ATTESTATION_PACKAGE_INFO_PACKAGE_NAME_INDEX = 0; 96 static final int ATTESTATION_PACKAGE_INFO_VERSION_INDEX = 1; 97 // Some security values. The complete list is in this AOSP file: 98 // hardware/libhardware/include/hardware/keymaster_defs.h 99 static final int KM_SECURITY_LEVEL_SOFTWARE = 0; 100 static final int KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT = 1; 101 static final int KM_SECURITY_LEVEL_STRONG_BOX = 2; 102 static final int KM_VERIFIED_BOOT_STATE_VERIFIED = 0; 103 static final int KM_VERIFIED_BOOT_STATE_SELF_SIGNED = 1; 104 static final int KM_VERIFIED_BOOT_STATE_UNVERIFIED = 2; 105 static final int KM_VERIFIED_BOOT_STATE_FAILED = 3; 106 // Unsigned max value of 32-bit integer, 2^32 - 1 107 static final long UINT32_MAX = (((long) Integer.MAX_VALUE) << 1) + 1; 108 } 109