1 /* 2 * Copyright 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef SYSTEM_KEYMASTER_KEYMASTER1_ENGINE_H_ 18 #define SYSTEM_KEYMASTER_KEYMASTER1_ENGINE_H_ 19 20 #include <memory> 21 22 #include <openssl/ec.h> 23 #include <openssl/engine.h> 24 #include <openssl/ex_data.h> 25 #include <openssl/rsa.h> 26 27 #include <hardware/keymaster1.h> 28 #include <hardware/keymaster_defs.h> 29 30 #include <keymaster/android_keymaster_utils.h> 31 #include <keymaster/authorization_set.h> 32 33 #include "openssl_utils.h" 34 35 namespace keymaster { 36 37 class Keymaster1Engine { 38 public: 39 /** 40 * Create a Keymaster1Engine, wrapping the provided keymaster1_device. The engine takes 41 * ownership of the device, and will close it during destruction. 42 */ 43 Keymaster1Engine(const keymaster1_device_t* keymaster1_device); 44 ~Keymaster1Engine(); 45 46 keymaster_error_t GenerateKey(const AuthorizationSet& key_description, 47 KeymasterKeyBlob* key_material, AuthorizationSet* hw_enforced, 48 AuthorizationSet* sw_enforced) const; 49 50 keymaster_error_t ImportKey(const AuthorizationSet& key_description, 51 keymaster_key_format_t input_key_material_format, 52 const KeymasterKeyBlob& input_key_material, 53 KeymasterKeyBlob* output_key_blob, AuthorizationSet* hw_enforced, 54 AuthorizationSet* sw_enforced) const; 55 keymaster_error_t DeleteKey(const KeymasterKeyBlob& blob) const; 56 keymaster_error_t DeleteAllKeys() const; 57 58 struct KeyData { KeyDataKeyData59 KeyData(const KeymasterKeyBlob& blob, const AuthorizationSet& params) 60 : op_handle(0), begin_params(params), key_material(blob), error(KM_ERROR_OK), 61 expected_openssl_padding(-1) {} 62 63 keymaster_operation_handle_t op_handle; 64 AuthorizationSet begin_params; 65 AuthorizationSet finish_params; 66 KeymasterKeyBlob key_material; 67 keymaster_error_t error; 68 int expected_openssl_padding; 69 }; 70 71 RSA* BuildRsaKey(const KeymasterKeyBlob& blob, const AuthorizationSet& additional_params, 72 keymaster_error_t* error) const; 73 EC_KEY* BuildEcKey(const KeymasterKeyBlob& blob, const AuthorizationSet& additional_params, 74 keymaster_error_t* error) const; 75 76 KeyData* GetData(EVP_PKEY* key) const; 77 KeyData* GetData(const RSA* rsa) const; 78 KeyData* GetData(const EC_KEY* rsa) const; 79 device()80 const keymaster1_device_t* device() const { return keymaster1_device_; } 81 82 EVP_PKEY* GetKeymaster1PublicKey(const KeymasterKeyBlob& blob, 83 const AuthorizationSet& additional_params, 84 keymaster_error_t* error) const; 85 86 private: 87 Keymaster1Engine(const Keymaster1Engine&); // Uncopyable 88 void operator=(const Keymaster1Engine&); // Unassignable 89 90 RSA_METHOD BuildRsaMethod(); 91 ECDSA_METHOD BuildEcdsaMethod(); 92 void ConfigureEngineForRsa(); 93 void ConfigureEngineForEcdsa(); 94 95 keymaster_error_t Keymaster1Finish(const KeyData* key_data, const keymaster_blob_t& input, 96 keymaster_blob_t* output); 97 98 static int duplicate_key_data(CRYPTO_EX_DATA* to, const CRYPTO_EX_DATA* from, void** from_d, 99 int index, long argl, void* argp); 100 static void free_key_data(void* parent, void* ptr, CRYPTO_EX_DATA* data, int index, long argl, 101 void* argp); 102 103 static int rsa_sign_raw(RSA* rsa, size_t* out_len, uint8_t* out, size_t max_out, 104 const uint8_t* in, size_t in_len, int padding); 105 static int rsa_decrypt(RSA* rsa, size_t* out_len, uint8_t* out, size_t max_out, 106 const uint8_t* in, size_t in_len, int padding); 107 static int ecdsa_sign(const uint8_t* digest, size_t digest_len, uint8_t* sig, 108 unsigned int* sig_len, EC_KEY* ec_key); 109 110 const keymaster1_device_t* const keymaster1_device_; 111 const std::unique_ptr<ENGINE, ENGINE_Delete> engine_; 112 const int rsa_index_; 113 const int ec_key_index_; 114 115 const RSA_METHOD rsa_method_; 116 const ECDSA_METHOD ecdsa_method_; 117 118 static Keymaster1Engine* instance_; 119 }; 120 121 } // namespace keymaster 122 123 #endif // SYSTEM_KEYMASTER_KEYMASTER1_ENGINE_H_ 124