1 /* 2 * Copyright (c) 2021-2024 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 #ifndef STORAGE_DAEMON_CRYPTO_BASEKEY_H 16 #define STORAGE_DAEMON_CRYPTO_BASEKEY_H 17 18 #include <string> 19 20 #include "key_blob.h" 21 #include "openssl_crypto.h" 22 23 namespace OHOS { 24 namespace StorageDaemon { 25 const uint8_t RETRIEVE_KEY = 0x0; 26 const uint8_t FIRST_CREATE_KEY = 0x6c; 27 const uint8_t USER_LOGOUT = 0x0; 28 const uint8_t USER_DESTROY = 0x1; 29 const uint32_t USER_UNLOCK = 0x2; 30 const uint32_t USER_ADD_AUTH = 0x0; 31 const uint32_t USER_CHANGE_AUTH = 0x1; 32 const std::string SUFFIX_NEED_UPDATE = "/need_update"; 33 const std::vector<uint8_t> NULL_SECRET = { '!' }; 34 class BaseKey : public std::enable_shared_from_this<BaseKey> { 35 public: 36 BaseKey() = delete; 37 BaseKey(const std::string &dir, uint8_t keyLen = CRYPTO_AES_256_XTS_KEY_SIZE); 38 ~BaseKey() = default; 39 40 /* key operations */ 41 bool InitKey(bool needGenerateKey); 42 #ifdef USER_CRYPTO_MIGRATE_KEY 43 bool StoreKey(const UserAuth &auth, bool needGenerateShield = true); 44 #else 45 bool StoreKey(const UserAuth &auth); 46 #endif 47 bool UpdateKey(const std::string &keypath = ""); 48 bool RestoreKey(const UserAuth &auth); 49 virtual bool ActiveKey(uint32_t flag, const std::string &mnt = MNT_DATA) = 0; 50 virtual bool InactiveKey(uint32_t flag, const std::string &mnt = MNT_DATA) = 0; 51 virtual bool LockUserScreen(uint32_t flag, uint32_t sdpClass, const std::string &mnt = MNT_DATA) = 0; 52 virtual bool UnlockUserScreen(uint32_t flag, uint32_t sdpClass, const std::string &mnt = MNT_DATA) = 0; 53 virtual bool GenerateAppkey(uint32_t userId, uint32_t hashId, std::string &keyId) = 0; 54 virtual bool DeleteAppkey(const std::string keyId) = 0; 55 virtual bool AddClassE(bool &isNeedEncryptClassE, bool &isSupport, uint32_t status) = 0; 56 virtual bool DeleteClassEPinCode(uint32_t userId) = 0; 57 virtual bool DecryptClassE(const UserAuth &auth, bool &isSupport, bool &eBufferStatue, uint32_t user, 58 uint32_t status) = 0; 59 virtual bool EncryptClassE(const UserAuth &auth, bool &isSupport, uint32_t user, uint32_t status) = 0; 60 virtual bool ChangePinCodeClassE(bool &isFbeSupport, uint32_t userId) = 0; 61 virtual bool LockUece(bool &isFbeSupport) = 0; 62 bool DoRestoreKeyEx(const UserAuth &auth, const std::string &keypath); 63 bool EncryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey, KeyBlob &encryptedKey); 64 bool DecryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey, KeyBlob &decryptedKey); 65 bool RenameKeyPath(const std::string &keyPath); 66 bool ClearKey(const std::string &mnt = MNT_DATA); 67 void ClearMemoryKeyCtx(); 68 void WipingActionDir(std::string &path); 69 bool UpgradeKeys(); 70 bool KeyDesclsEmpty(); 71 KeyInfo keyInfo_; GetDir()72 std::string GetDir() const 73 { 74 return dir_; 75 } 76 enum class KeyEncryptType { 77 KEY_CRYPT_HUKS, 78 KEY_CRYPT_OPENSSL, 79 KEY_CRYPT_HUKS_OPENSSL 80 }; 81 82 protected: 83 static bool SaveKeyBlob(const KeyBlob &blob, const std::string &path); 84 std::string dir_ {}; 85 86 private: 87 #ifdef USER_CRYPTO_MIGRATE_KEY 88 bool DoStoreKey(const UserAuth &auth, bool needGenerateShield = true); 89 #else 90 bool DoStoreKey(const UserAuth &auth); 91 #endif 92 bool LoadAndSaveShield(const UserAuth &auth, const std::string &pathShield, bool needGenerateShield, 93 KeyContext &keyCtx); 94 bool SaveAndCleanKeyBuff(const std::string &keyPath, KeyContext &keyCtx); 95 bool DoRestoreKey(const UserAuth &auth, const std::string &keypath); 96 bool DoRestoreKeyCeEceSece(const UserAuth &auth, const std::string &path, const uint32_t keyType); 97 bool DoRestoreKeyDe(const UserAuth &auth, const std::string &path); 98 bool DoRestoreKeyOld(const UserAuth &auth, const std::string &keypath); 99 bool DoUpdateRestore(const UserAuth &auth, const std::string &keyPath); 100 static bool GenerateAndSaveKeyBlob(KeyBlob &blob, const std::string &path, const uint32_t size); 101 static bool GenerateKeyBlob(KeyBlob &blob, const uint32_t size); 102 static bool LoadKeyBlob(KeyBlob &blob, const std::string &path, const uint32_t size); 103 bool EncryptDe(const UserAuth &auth, const std::string &path); 104 bool EncryptEceSece(const UserAuth &auth, const uint32_t keyType, KeyContext &keyCtx); 105 bool Decrypt(const UserAuth &auth); 106 bool DecryptReal(const UserAuth &auth, const uint32_t keyType, KeyContext &keyCtx); 107 bool CheckAndUpdateVersion(); 108 bool CombKeyCtx(const KeyBlob &nonce, const KeyBlob &rndEnc, const KeyBlob &aad, KeyBlob &keyOut); 109 bool SplitKeyCtx(const KeyBlob &keyIn, KeyBlob &nonce, KeyBlob &rndEnc, KeyBlob &aad); 110 void CombKeyBlob(const KeyBlob &encAad, const KeyBlob &end, KeyBlob &keyOut); 111 void SplitKeyBlob(const KeyBlob &keyIn, KeyBlob &encAad, KeyBlob &nonce, uint32_t start); 112 void ClearKeyContext(KeyContext &keyCtx); 113 bool InitKeyContext(const UserAuth &auth, const std::string &keyPath, KeyContext &keyCtx); 114 int GetCandidateVersion() const; 115 std::string GetCandidateDir() const; 116 std::string GetNextCandidateDir() const; 117 void SyncKeyDir() const; 118 uint32_t GetTypeFromDir(); 119 uint32_t GetIdFromDir(); 120 121 KeyContext keyContext_ {}; 122 uint8_t keyLen_ {}; 123 KeyEncryptType keyEncryptType_; 124 std::string KeyEncryptTypeToString(KeyEncryptType keyEncryptType_) const; 125 }; 126 } // namespace StorageDaemon 127 } // namespace OHOS 128 129 #endif // STORAGE_DAEMON_CRYPTO_BASEKEY_H 130