Merge "Require DeleteAllKeys to work regardless of rollback resistance tag" into main am: 2abea78294 am: 53c72989f4
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/3394581
Change-Id: I7a56f8cc4c3831b800a84a103357e7bb1e6a9176
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
index e8eed71..b57dd8a 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
@@ -548,10 +548,8 @@
void deleteKey(in byte[] keyBlob);
/**
- * Deletes all keys in the hardware keystore. Used when keystore is reset completely. After
- * this function is called all keys with Tag::ROLLBACK_RESISTANCE in their hardware-enforced
- * authorization lists must be rendered permanently unusable. Keys without
- * Tag::ROLLBACK_RESISTANCE may or may not be rendered unusable.
+ * Deletes all keys in the hardware keystore. Used when keystore is reset completely. After
+ * this function is called all keys created previously must be rendered permanently unusable.
*/
void deleteAllKeys();
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 067db78..416e6c0 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -8305,21 +8305,15 @@
GTEST_SKIP() << "Option --arm_deleteAllKeys not set";
return;
}
+ // This test was introduced in API level 36, but is not version guarded because it requires a
+ // manual opt-in anyway. This makes it easier to run on older devices.
auto error = GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537)
.Digest(Digest::NONE)
.Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED)
- .Authorization(TAG_ROLLBACK_RESISTANCE)
.SetDefaultValidity());
- if (error == ErrorCode::ROLLBACK_RESISTANCE_UNAVAILABLE) {
- GTEST_SKIP() << "Rollback resistance not supported";
- }
-
- // Delete must work if rollback protection is implemented
ASSERT_EQ(ErrorCode::OK, error);
- AuthorizationSet hardwareEnforced(SecLevelAuthorizations());
- ASSERT_TRUE(hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE));
ASSERT_EQ(ErrorCode::OK, DeleteAllKeys());