Merge "Enforcing canonicalization of DeviceInfo." am: 4820b542fa am: 2b8301c90e am: 78e11bb6f4
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1968997
Change-Id: I1579db009de143e0389fec5f8607d9c6ea088969
diff --git a/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl b/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
index 586e659..153a04f 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
@@ -27,7 +27,9 @@
@VintfStability
parcelable DeviceInfo {
/**
- * DeviceInfo is a CBOR Map structure described by the following CDDL.
+ * DeviceInfo is a CBOR Map structure described by the following CDDL. DeviceInfo must be
+ * canonicalized according to the specification in RFC 7049. The ordering presented here is
+ * non-canonical to group similar entries semantically.
*
* DeviceInfo = {
* "brand" : tstr,
diff --git a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index 3a7e000..927d7d7 100644
--- a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -422,7 +422,7 @@
ASSERT_TRUE(deviceInfoMap) << "Failed to parse deviceInfo: " << deviceInfoErrMsg;
ASSERT_TRUE(deviceInfoMap->asMap());
- checkDeviceInfo(deviceInfoMap->asMap());
+ checkDeviceInfo(deviceInfoMap->asMap(), deviceInfo.deviceInfo);
auto& signingKey = bccContents->back().pubKey;
auto macKey = verifyAndParseCoseSign1(signedMac->asArray(), signingKey,
@@ -466,7 +466,7 @@
}
}
- void checkDeviceInfo(const cppbor::Map* deviceInfo) {
+ void checkDeviceInfo(const cppbor::Map* deviceInfo, bytevec deviceInfoBytes) {
const auto& version = deviceInfo->get("version");
ASSERT_TRUE(version);
ASSERT_TRUE(version->asUint());
@@ -518,6 +518,8 @@
default:
FAIL() << "Unrecognized version: " << version->asUint()->value();
}
+ ASSERT_EQ(deviceInfo->clone()->asMap()->canonicalize().encode(), deviceInfoBytes)
+ << "DeviceInfo ordering is non-canonical.";
}
bytevec eekId_;