Gitiles
Code Review Sign In
gerrit.omnirom.org / android_hardware_interfaces / 776e39b7252988c80e5369c8b7bca9694f69258b / . / security / keymint / aidl / default / ta / attest.rs
blob: 1ce20662db22cd12715386b7954bd1e02ee7a21d [file] [log] [blame]
David Drysdale30196cf2023-12-02 19:24:15 +0000[diff] [blame]1//
2// Copyright (C) 2022 The Android Open Source Project
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8// http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15
16//! Attestation keys and certificates.
17//!
18//! Hard-coded keys and certs copied from system/keymaster/context/soft_attestation_cert.cpp
19
20use kmr_common::{
21 crypto::ec, crypto::rsa, crypto::CurveType, crypto::KeyMaterial, wire::keymint,
22 wire::keymint::EcCurve, Error,
23};
24use kmr_ta::device::{RetrieveCertSigningInfo, SigningAlgorithm, SigningKeyType};
25
26/// RSA attestation private key in PKCS#1 format.
27///
28/// Decoded contents (using [der2ascii](https://github.com/google/der-ascii)):
29///
30/// ```
31/// SEQUENCE {
32/// INTEGER { 0 }
33/// INTEGER { `00c08323dc56881bb8302069f5b08561c6eebe7f05e2f5a842048abe8b47be76feaef25cf29b2afa3200141601429989a15fcfc6815eb363583c2fd2f20be4983283dd814b16d7e185417ae54abc296a3a6db5c004083b68c556c1f02339916419864d50b74d40aeca484c77356c895a0c275abfac499d5d7d2362f29c5e02e871` }
34/// INTEGER { 65537 }
35/// INTEGER { `00be860b0b99a802a6fb1a59438a7bb715065b09a36dc6e9cacc6bf3c02c34d7d79e94c6606428d88c7b7f6577c1cdea64074abe8e7286df1f0811dc9728260868de95d32efc96b6d084ff271a5f60defcc703e7a38e6e29ba9a3c5fc2c28076b6a896af1d34d78828ce9bddb1f34f9c9404430781298e201316725bbdbc993a41` }
36/// INTEGER { `00e1c6d927646c0916ec36826d594983740c21f1b074c4a1a59867c669795c85d3dc464c5b929e94bfb34e0dcc5014b10f13341ab7fdd5f60414d2a326cad41cc5` }
37/// INTEGER { `00da485997785cd5630fb0fd8c5254f98e538e18983aae9e6b7e6a5a7b5d343755b9218ebd40320d28387d789f76fa218bcc2d8b68a5f6418fbbeca5179ab3afbd` }
38/// INTEGER { `50fefc32649559616ed6534e154509329d93a3d810dbe5bdb982292cf78bd8badb8020ae8d57f4b71d05386ffe9e9db271ca3477a34999db76f8e5ece9c0d49d` }
39/// INTEGER { `15b74cf27cceff8bb36bf04d9d8346b09a2f70d2f4439b0f26ac7e03f7e9d1f77d4b915fd29b2823f03acb5d5200e0857ff2a803e93eee96d6235ce95442bc21` }
40/// INTEGER { `0090a745da8970b2cd649660324228c5f82856ffd665ba9a85c8d60f1b8bee717ecd2c72eae01dad86ba7654d4cf45adb5f1f2b31d9f8122cfa5f1a5570f9b2d25` }
41/// }
42/// ```
43const RSA_ATTEST_KEY: &str = concat!(
44 "3082025d02010002818100c08323dc56881bb8302069f5b08561c6eebe7f05e2",
45 "f5a842048abe8b47be76feaef25cf29b2afa3200141601429989a15fcfc6815e",
46 "b363583c2fd2f20be4983283dd814b16d7e185417ae54abc296a3a6db5c00408",
47 "3b68c556c1f02339916419864d50b74d40aeca484c77356c895a0c275abfac49",
48 "9d5d7d2362f29c5e02e871020301000102818100be860b0b99a802a6fb1a5943",
49 "8a7bb715065b09a36dc6e9cacc6bf3c02c34d7d79e94c6606428d88c7b7f6577",
50 "c1cdea64074abe8e7286df1f0811dc9728260868de95d32efc96b6d084ff271a",
51 "5f60defcc703e7a38e6e29ba9a3c5fc2c28076b6a896af1d34d78828ce9bddb1",
52 "f34f9c9404430781298e201316725bbdbc993a41024100e1c6d927646c0916ec",
53 "36826d594983740c21f1b074c4a1a59867c669795c85d3dc464c5b929e94bfb3",
54 "4e0dcc5014b10f13341ab7fdd5f60414d2a326cad41cc5024100da485997785c",
55 "d5630fb0fd8c5254f98e538e18983aae9e6b7e6a5a7b5d343755b9218ebd4032",
56 "0d28387d789f76fa218bcc2d8b68a5f6418fbbeca5179ab3afbd024050fefc32",
57 "649559616ed6534e154509329d93a3d810dbe5bdb982292cf78bd8badb8020ae",
58 "8d57f4b71d05386ffe9e9db271ca3477a34999db76f8e5ece9c0d49d024015b7",
59 "4cf27cceff8bb36bf04d9d8346b09a2f70d2f4439b0f26ac7e03f7e9d1f77d4b",
60 "915fd29b2823f03acb5d5200e0857ff2a803e93eee96d6235ce95442bc210241",
61 "0090a745da8970b2cd649660324228c5f82856ffd665ba9a85c8d60f1b8bee71",
62 "7ecd2c72eae01dad86ba7654d4cf45adb5f1f2b31d9f8122cfa5f1a5570f9b2d",
63 "25",
64);
65
66/// Attestation certificate corresponding to [`RSA_ATTEST_KEY`], signed by the key in
67/// [`RSA_ATTEST_ROOT_CERT`].
68///
69/// Decoded contents:
70///
71/// ```
72/// Certificate:
73/// Data:
74/// Version: 3 (0x2)
75/// Serial Number: 4096 (0x1000)
76/// Signature Algorithm: SHA256-RSA
77/// Issuer: C=US, O=Google, Inc., OU=Android, L=Mountain View, ST=California
78/// Validity:
79/// Not Before: 2016-01-04 12:40:53 +0000 UTC
80/// Not After : 2035-12-30 12:40:53 +0000 UTC
81/// Subject: C=US, O=Google, Inc., OU=Android, ST=California, CN=Android Software Attestation Key
82/// Subject Public Key Info:
83/// Public Key Algorithm: rsaEncryption
84/// Public Key: (1024 bit)
85/// Modulus:
86/// c0:83:23:dc:56:88:1b:b8:30:20:69:f5:b0:85:61:
87/// c6:ee:be:7f:05:e2:f5:a8:42:04:8a:be:8b:47:be:
88/// 76:fe:ae:f2:5c:f2:9b:2a:fa:32:00:14:16:01:42:
89/// 99:89:a1:5f:cf:c6:81:5e:b3:63:58:3c:2f:d2:f2:
90/// 0b:e4:98:32:83:dd:81:4b:16:d7:e1:85:41:7a:e5:
91/// 4a:bc:29:6a:3a:6d:b5:c0:04:08:3b:68:c5:56:c1:
92/// f0:23:39:91:64:19:86:4d:50:b7:4d:40:ae:ca:48:
93/// 4c:77:35:6c:89:5a:0c:27:5a:bf:ac:49:9d:5d:7d:
94/// 23:62:f2:9c:5e:02:e8:71:
95/// Exponent: 65537 (0x10001)
96/// X509v3 extensions:
97/// X509v3 Authority Key Identifier:
98/// keyid:29faf1accc4dd24c96402775b6b0e932e507fe2e
99/// X509v3 Subject Key Identifier:
100/// keyid:d40c101bf8cd63b9f73952b50e135ca6d7999386
101/// X509v3 Key Usage: critical
102/// Digital Signature, Certificate Signing
103/// X509v3 Basic Constraints: critical
104/// CA:true, pathlen:0
105/// Signature Algorithm: SHA256-RSA
106/// 9e:2d:48:5f:8c:67:33:dc:1a:85:ad:99:d7:50:23:ea:14:ec:
107/// 43:b0:e1:9d:ea:c2:23:46:1e:72:b5:19:dc:60:22:e4:a5:68:
108/// 31:6c:0b:55:c4:e6:9c:a2:2d:9f:3a:4f:93:6b:31:8b:16:78:
109/// 16:0d:88:cb:d9:8b:cc:80:9d:84:f0:c2:27:e3:6b:38:f1:fd:
110/// d1:e7:17:72:31:59:35:7d:96:f3:c5:7f:ab:9d:8f:96:61:26:
111/// 4f:b2:be:81:bb:0d:49:04:22:8a:ce:9f:f7:f5:42:2e:25:44:
112/// fa:21:07:12:5a:83:b5:55:ad:18:82:f8:40:14:9b:9c:20:63:
113/// 04:7f:
114/// ```
115const RSA_ATTEST_CERT: &str = concat!(
116 "308202b63082021fa00302010202021000300d06092a864886f70d01010b0500",
117 "3063310b30090603550406130255533113301106035504080c0a43616c69666f",
118 "726e69613116301406035504070c0d4d6f756e7461696e205669657731153013",
119 "060355040a0c0c476f6f676c652c20496e632e3110300e060355040b0c07416e",
120 "64726f6964301e170d3136303130343132343035335a170d3335313233303132",
121 "343035335a3076310b30090603550406130255533113301106035504080c0a43",
122 "616c69666f726e696131153013060355040a0c0c476f6f676c652c20496e632e",
123 "3110300e060355040b0c07416e64726f69643129302706035504030c20416e64",
124 "726f696420536f667477617265204174746573746174696f6e204b657930819f",
125 "300d06092a864886f70d010101050003818d0030818902818100c08323dc5688",
126 "1bb8302069f5b08561c6eebe7f05e2f5a842048abe8b47be76feaef25cf29b2a",
127 "fa3200141601429989a15fcfc6815eb363583c2fd2f20be4983283dd814b16d7",
128 "e185417ae54abc296a3a6db5c004083b68c556c1f02339916419864d50b74d40",
129 "aeca484c77356c895a0c275abfac499d5d7d2362f29c5e02e8710203010001a3",
130 "663064301d0603551d0e04160414d40c101bf8cd63b9f73952b50e135ca6d799",
131 "9386301f0603551d2304183016801429faf1accc4dd24c96402775b6b0e932e5",
132 "07fe2e30120603551d130101ff040830060101ff020100300e0603551d0f0101",
133 "ff040403020284300d06092a864886f70d01010b0500038181009e2d485f8c67",
134 "33dc1a85ad99d75023ea14ec43b0e19deac223461e72b519dc6022e4a568316c",
135 "0b55c4e69ca22d9f3a4f936b318b1678160d88cbd98bcc809d84f0c227e36b38",
136 "f1fdd1e717723159357d96f3c57fab9d8f9661264fb2be81bb0d4904228ace9f",
137 "f7f5422e2544fa2107125a83b555ad1882f840149b9c2063047f",
138);
139
140/// Attestation self-signed root certificate holding the key that signed [`RSA_ATTEST_CERT`].
141///
142/// Decoded contents:
143///
144/// ```
145/// Certificate:
146/// Data:
147/// Version: 3 (0x2)
148/// Serial Number: 18416584322103887884 (0xff94d9dd9f07c80c)
149/// Signature Algorithm: SHA256-RSA
150/// Issuer: C=US, O=Google, Inc., OU=Android, L=Mountain View, ST=California
151/// Validity:
152/// Not Before: 2016-01-04 12:31:08 +0000 UTC
153/// Not After : 2035-12-30 12:31:08 +0000 UTC
154/// Subject: C=US, O=Google, Inc., OU=Android, L=Mountain View, ST=California
155/// Subject Public Key Info:
156/// Public Key Algorithm: rsaEncryption
157/// Public Key: (1024 bit)
158/// Modulus:
159/// a2:6b:ad:eb:6e:2e:44:61:ef:d5:0e:82:e6:b7:94:
160/// d1:75:23:1f:77:9b:63:91:63:ff:f7:aa:ff:0b:72:
161/// 47:4e:c0:2c:43:ec:33:7c:d7:ac:ed:40:3e:8c:28:
162/// a0:66:d5:f7:87:0b:33:97:de:0e:b8:4e:13:40:ab:
163/// af:a5:27:bf:95:69:a0:31:db:06:52:65:f8:44:59:
164/// 57:61:f0:bb:f2:17:4b:b7:41:80:64:c0:28:0e:8f:
165/// 52:77:8e:db:d2:47:b6:45:e9:19:c8:e9:8b:c3:db:
166/// c2:91:3f:d7:d7:50:c4:1d:35:66:f9:57:e4:97:96:
167/// 0b:09:ac:ce:92:35:85:9b:
168/// Exponent: 65537 (0x10001)
169/// X509v3 extensions:
170/// X509v3 Authority Key Identifier:
171/// keyid:29faf1accc4dd24c96402775b6b0e932e507fe2e
172/// X509v3 Subject Key Identifier:
173/// keyid:29faf1accc4dd24c96402775b6b0e932e507fe2e
174/// X509v3 Key Usage: critical
175/// Digital Signature, Certificate Signing
176/// X509v3 Basic Constraints: critical
177/// CA:true
178/// Signature Algorithm: SHA256-RSA
179/// 4f:72:f3:36:59:8d:0e:c1:b9:74:5b:31:59:f6:f0:8d:25:49:
180/// 30:9e:a3:1c:1c:29:d2:45:2d:20:b9:4d:5f:64:b4:e8:80:c7:
181/// 78:7a:9c:39:de:a8:b3:f5:bf:2f:70:5f:47:10:5c:c5:e6:eb:
182/// 4d:06:99:61:d2:ae:9a:07:ff:f7:7c:b8:ab:eb:9c:0f:24:07:
183/// 5e:b1:7f:ba:79:71:fd:4d:5b:9e:df:14:a9:fe:df:ed:7c:c0:
184/// 88:5d:f8:dd:9b:64:32:56:d5:35:9a:e2:13:f9:8f:ce:c1:7c:
185/// dc:ef:a4:aa:b2:55:c3:83:a9:2e:fb:5c:f6:62:f5:27:52:17:
186/// be:63:
187/// ```
188const RSA_ATTEST_ROOT_CERT: &str = concat!(
189 "308202a730820210a003020102020900ff94d9dd9f07c80c300d06092a864886",
190 "f70d01010b05003063310b30090603550406130255533113301106035504080c",
191 "0a43616c69666f726e69613116301406035504070c0d4d6f756e7461696e2056",
192 "69657731153013060355040a0c0c476f6f676c652c20496e632e3110300e0603",
193 "55040b0c07416e64726f6964301e170d3136303130343132333130385a170d33",
194 "35313233303132333130385a3063310b30090603550406130255533113301106",
195 "035504080c0a43616c69666f726e69613116301406035504070c0d4d6f756e74",
196 "61696e205669657731153013060355040a0c0c476f6f676c652c20496e632e31",
197 "10300e060355040b0c07416e64726f696430819f300d06092a864886f70d0101",
198 "01050003818d0030818902818100a26badeb6e2e4461efd50e82e6b794d17523",
199 "1f779b639163fff7aaff0b72474ec02c43ec337cd7aced403e8c28a066d5f787",
200 "0b3397de0eb84e1340abafa527bf9569a031db065265f844595761f0bbf2174b",
201 "b7418064c0280e8f52778edbd247b645e919c8e98bc3dbc2913fd7d750c41d35",
202 "66f957e497960b09acce9235859b0203010001a3633061301d0603551d0e0416",
203 "041429faf1accc4dd24c96402775b6b0e932e507fe2e301f0603551d23041830",
204 "16801429faf1accc4dd24c96402775b6b0e932e507fe2e300f0603551d130101",
205 "ff040530030101ff300e0603551d0f0101ff040403020284300d06092a864886",
206 "f70d01010b0500038181004f72f336598d0ec1b9745b3159f6f08d2549309ea3",
207 "1c1c29d2452d20b94d5f64b4e880c7787a9c39dea8b3f5bf2f705f47105cc5e6",
208 "eb4d069961d2ae9a07fff77cb8abeb9c0f24075eb17fba7971fd4d5b9edf14a9",
209 "fedfed7cc0885df8dd9b643256d5359ae213f98fcec17cdcefa4aab255c383a9",
210 "2efb5cf662f5275217be63",
211);
212
213/// EC attestation private key in `ECPrivateKey` format.
214///
215/// Decoded contents (using [der2ascii](https://github.com/google/der-ascii)):
216///
217/// ```
218/// SEQUENCE {
219/// INTEGER { 1 }
220/// OCTET_STRING { `21e086432a15198459cf363a50fc14c9daadf935f527c2dfd71e4d6dbc42e544` }
221/// [0] {
222/// # secp256r1
223/// OBJECT_IDENTIFIER { 1.2.840.10045.3.1.7 }
224/// }
225/// [1] {
226/// BIT_STRING { `00` `04eb9e79f8426359accb2a914c8986cc70ad90669382a9732613feaccbf821274c2174974a2afea5b94d7f66d4e065106635bc53b7a0a3a671583edb3e11ae1014` }
227/// }
228/// }
229/// ```
230const EC_ATTEST_KEY: &str = concat!(
231 "3077020101042021e086432a15198459cf363a50fc14c9daadf935f527c2dfd7",
232 "1e4d6dbc42e544a00a06082a8648ce3d030107a14403420004eb9e79f8426359",
233 "accb2a914c8986cc70ad90669382a9732613feaccbf821274c2174974a2afea5",
234 "b94d7f66d4e065106635bc53b7a0a3a671583edb3e11ae1014",
235);
236
237/// Attestation certificate corresponding to [`EC_ATTEST_KEY`], signed by the key in
238/// [`EC_ATTEST_ROOT_CERT`].
239///
240/// Decoded contents:
241///
242/// ```
243/// Certificate:
244/// Data:
245/// Version: 3 (0x2)
246/// Serial Number: 4097 (0x1001)
247/// Signature Algorithm: ECDSA-SHA256
248/// Issuer: C=US, O=Google, Inc., OU=Android, L=Mountain View, ST=California, CN=Android Keystore Software Attestation Root
249/// Validity:
250/// Not Before: 2016-01-11 00:46:09 +0000 UTC
251/// Not After : 2026-01-08 00:46:09 +0000 UTC
252/// Subject: C=US, O=Google, Inc., OU=Android, ST=California, CN=Android Keystore Software Attestation Intermediate
253/// Subject Public Key Info:
254/// Public Key Algorithm: id-ecPublicKey
255/// Public Key: (256 bit)
256/// pub:
257/// 04:eb:9e:79:f8:42:63:59:ac:cb:2a:91:4c:89:86:
258/// cc:70:ad:90:66:93:82:a9:73:26:13:fe:ac:cb:f8:
259/// 21:27:4c:21:74:97:4a:2a:fe:a5:b9:4d:7f:66:d4:
260/// e0:65:10:66:35:bc:53:b7:a0:a3:a6:71:58:3e:db:
261/// 3e:11:ae:10:14:
262/// ASN1 OID: prime256v1
263/// X509v3 extensions:
264/// X509v3 Authority Key Identifier:
265/// keyid:c8ade9774c45c3a3cf0d1610e479433a215a30cf
266/// X509v3 Subject Key Identifier:
267/// keyid:3ffcacd61ab13a9e8120b8d5251cc565bb1e91a9
268/// X509v3 Key Usage: critical
269/// Digital Signature, Certificate Signing
270/// X509v3 Basic Constraints: critical
271/// CA:true, pathlen:0
272/// Signature Algorithm: ECDSA-SHA256
273/// 30:45:02:20:4b:8a:9b:7b:ee:82:bc:c0:33:87:ae:2f:c0:89:
274/// 98:b4:dd:c3:8d:ab:27:2a:45:9f:69:0c:c7:c3:92:d4:0f:8e:
275/// 02:21:00:ee:da:01:5d:b6:f4:32:e9:d4:84:3b:62:4c:94:04:
276/// ef:3a:7c:cc:bd:5e:fb:22:bb:e7:fe:b9:77:3f:59:3f:fb:
277/// ```
278const EC_ATTEST_CERT: &str = concat!(
279 "308202783082021ea00302010202021001300a06082a8648ce3d040302308198",
280 "310b30090603550406130255533113301106035504080c0a43616c69666f726e",
281 "69613116301406035504070c0d4d6f756e7461696e2056696577311530130603",
282 "55040a0c0c476f6f676c652c20496e632e3110300e060355040b0c07416e6472",
283 "6f69643133303106035504030c2a416e64726f6964204b657973746f72652053",
284 "6f667477617265204174746573746174696f6e20526f6f74301e170d31363031",
285 "31313030343630395a170d3236303130383030343630395a308188310b300906",
286 "03550406130255533113301106035504080c0a43616c69666f726e6961311530",
287 "13060355040a0c0c476f6f676c652c20496e632e3110300e060355040b0c0741",
288 "6e64726f6964313b303906035504030c32416e64726f6964204b657973746f72",
289 "6520536f667477617265204174746573746174696f6e20496e7465726d656469",
290 "6174653059301306072a8648ce3d020106082a8648ce3d03010703420004eb9e",
291 "79f8426359accb2a914c8986cc70ad90669382a9732613feaccbf821274c2174",
292 "974a2afea5b94d7f66d4e065106635bc53b7a0a3a671583edb3e11ae1014a366",
293 "3064301d0603551d0e041604143ffcacd61ab13a9e8120b8d5251cc565bb1e91",
294 "a9301f0603551d23041830168014c8ade9774c45c3a3cf0d1610e479433a215a",
295 "30cf30120603551d130101ff040830060101ff020100300e0603551d0f0101ff",
296 "040403020284300a06082a8648ce3d040302034800304502204b8a9b7bee82bc",
297 "c03387ae2fc08998b4ddc38dab272a459f690cc7c392d40f8e022100eeda015d",
298 "b6f432e9d4843b624c9404ef3a7cccbd5efb22bbe7feb9773f593ffb",
299);
300
301/// Attestation self-signed root certificate holding the key that signed [`EC_ATTEST_CERT`].
302///
303/// Decoded contents:
304///
305/// ```
306/// Certificate:
307/// Data:
308/// Version: 3 (0x2)
309/// Serial Number: 11674912229752527703 (0xa2059ed10e435b57)
310/// Signature Algorithm: ECDSA-SHA256
311/// Issuer: C=US, O=Google, Inc., OU=Android, L=Mountain View, ST=California, CN=Android Keystore Software Attestation Root
312/// Validity:
313/// Not Before: 2016-01-11 00:43:50 +0000 UTC
314/// Not After : 2036-01-06 00:43:50 +0000 UTC
315/// Subject: C=US, O=Google, Inc., OU=Android, L=Mountain View, ST=California, CN=Android Keystore Software Attestation Root
316/// Subject Public Key Info:
317/// Public Key Algorithm: id-ecPublicKey
318/// Public Key: (256 bit)
319/// pub:
320/// 04:ee:5d:5e:c7:e1:c0:db:6d:03:a6:7e:e6:b6:1b:
321/// ec:4d:6a:5d:6a:68:2e:0f:ff:7f:49:0e:7d:77:1f:
322/// 44:22:6d:bd:b1:af:fa:16:cb:c7:ad:c5:77:d2:56:
323/// 9c:aa:b7:b0:2d:54:01:5d:3e:43:2b:2a:8e:d7:4e:
324/// ec:48:75:41:a4:
325/// ASN1 OID: prime256v1
326/// X509v3 extensions:
327/// X509v3 Authority Key Identifier:
328/// keyid:c8ade9774c45c3a3cf0d1610e479433a215a30cf
329/// X509v3 Subject Key Identifier:
330/// keyid:c8ade9774c45c3a3cf0d1610e479433a215a30cf
331/// X509v3 Key Usage: critical
332/// Digital Signature, Certificate Signing
333/// X509v3 Basic Constraints: critical
334/// CA:true
335/// Signature Algorithm: ECDSA-SHA256
336/// 30:44:02:20:35:21:a3:ef:8b:34:46:1e:9c:d5:60:f3:1d:58:
337/// 89:20:6a:dc:a3:65:41:f6:0d:9e:ce:8a:19:8c:66:48:60:7b:
338/// 02:20:4d:0b:f3:51:d9:30:7c:7d:5b:da:35:34:1d:a8:47:1b:
339/// 63:a5:85:65:3c:ad:4f:24:a7:e7:4d:af:41:7d:f1:bf:
340/// ```
341const EC_ATTEST_ROOT_CERT: &str = concat!(
342 "3082028b30820232a003020102020900a2059ed10e435b57300a06082a8648ce",
343 "3d040302308198310b30090603550406130255533113301106035504080c0a43",
344 "616c69666f726e69613116301406035504070c0d4d6f756e7461696e20566965",
345 "7731153013060355040a0c0c476f6f676c652c20496e632e3110300e06035504",
346 "0b0c07416e64726f69643133303106035504030c2a416e64726f6964204b6579",
347 "73746f726520536f667477617265204174746573746174696f6e20526f6f7430",
348 "1e170d3136303131313030343335305a170d3336303130363030343335305a30",
349 "8198310b30090603550406130255533113301106035504080c0a43616c69666f",
350 "726e69613116301406035504070c0d4d6f756e7461696e205669657731153013",
351 "060355040a0c0c476f6f676c652c20496e632e3110300e060355040b0c07416e",
352 "64726f69643133303106035504030c2a416e64726f6964204b657973746f7265",
353 "20536f667477617265204174746573746174696f6e20526f6f74305930130607",
354 "2a8648ce3d020106082a8648ce3d03010703420004ee5d5ec7e1c0db6d03a67e",
355 "e6b61bec4d6a5d6a682e0fff7f490e7d771f44226dbdb1affa16cbc7adc577d2",
356 "569caab7b02d54015d3e432b2a8ed74eec487541a4a3633061301d0603551d0e",
357 "04160414c8ade9774c45c3a3cf0d1610e479433a215a30cf301f0603551d2304",
358 "1830168014c8ade9774c45c3a3cf0d1610e479433a215a30cf300f0603551d13",
359 "0101ff040530030101ff300e0603551d0f0101ff040403020284300a06082a86",
360 "48ce3d040302034700304402203521a3ef8b34461e9cd560f31d5889206adca3",
361 "6541f60d9ece8a198c6648607b02204d0bf351d9307c7d5bda35341da8471b63",
362 "a585653cad4f24a7e74daf417df1bf",
363);
364
365/// Per-algorithm attestation certificate signing information.
366pub struct CertSignAlgoInfo {
367 key: KeyMaterial,
368 chain: Vec<keymint::Certificate>,
369}
370
371/// Certificate signing information for all asymmetric key types.
372pub struct CertSignInfo {
373 rsa_info: CertSignAlgoInfo,
374 ec_info: CertSignAlgoInfo,
375}
376
377impl CertSignInfo {
378 /// Create a new cert signing impl.
379 pub fn new() -> Self {
380 CertSignInfo {
381 rsa_info: CertSignAlgoInfo {
382 key: KeyMaterial::Rsa(rsa::Key(hex::decode(RSA_ATTEST_KEY).unwrap()).into()),
383 chain: vec![
384 keymint::Certificate {
385 encoded_certificate: hex::decode(RSA_ATTEST_CERT).unwrap(),
386 },
387 keymint::Certificate {
388 encoded_certificate: hex::decode(RSA_ATTEST_ROOT_CERT).unwrap(),
389 },
390 ],
391 },
392 ec_info: CertSignAlgoInfo {
393 key: KeyMaterial::Ec(
394 EcCurve::P256,
395 CurveType::Nist,
396 ec::Key::P256(ec::NistKey(hex::decode(EC_ATTEST_KEY).unwrap())).into(),
397 ),
398 chain: vec![
399 keymint::Certificate {
400 encoded_certificate: hex::decode(EC_ATTEST_CERT).unwrap(),
401 },
402 keymint::Certificate {
403 encoded_certificate: hex::decode(EC_ATTEST_ROOT_CERT).unwrap(),
404 },
405 ],
406 },
407 }
408 }
409}
410
411impl RetrieveCertSigningInfo for CertSignInfo {
412 fn signing_key(&self, key_type: SigningKeyType) -> Result<KeyMaterial, Error> {
413 Ok(match key_type.algo_hint {
414 SigningAlgorithm::Rsa => self.rsa_info.key.clone(),
415 SigningAlgorithm::Ec => self.ec_info.key.clone(),
416 })
417 }
418
419 fn cert_chain(&self, key_type: SigningKeyType) -> Result<Vec<keymint::Certificate>, Error> {
420 Ok(match key_type.algo_hint {
421 SigningAlgorithm::Rsa => self.rsa_info.chain.clone(),
422 SigningAlgorithm::Ec => self.ec_info.chain.clone(),
423 })
424 }
425}