blob: 6f0ee4e74d2e6348ca661fbb9bb110b54dbfef8d [file] [log] [blame]
Selene Huang531a72d2021-04-15 01:09:47 -07001/*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "keymint_1_attest_key_test"
18
19#include <cutils/log.h>
20#include <cutils/properties.h>
21#include <keymint_support/key_param_output.h>
22#include <keymint_support/openssl_utils.h>
23
24#include "KeyMintAidlTestBase.h"
25
26namespace aidl::android::hardware::security::keymint::test {
27
28class DeviceUniqueAttestationTest : public KeyMintAidlTestBase {
29 protected:
30 void CheckUniqueAttestationResults(const vector<uint8_t>& key_blob,
31 const vector<KeyCharacteristics>& key_characteristics,
32 const AuthorizationSet& hw_enforced, int key_size) {
33 ASSERT_GT(cert_chain_.size(), 0);
34
35 if (KeyMintAidlTestBase::dump_Attestations) {
36 std::cout << bin2hex(cert_chain_[0].encodedCertificate) << std::endl;
37 }
38
39 ASSERT_GT(key_blob.size(), 0U);
40
41 AuthorizationSet crypto_params = SecLevelAuthorizations(key_characteristics);
42
43 EXPECT_TRUE(crypto_params.Contains(TAG_KEY_SIZE, key_size)) << "Key size missing";
44
45 EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_));
46 ASSERT_GT(cert_chain_.size(), 0);
47
48 AuthorizationSet sw_enforced = SwEnforcedAuthorizations(key_characteristics);
49 EXPECT_TRUE(verify_attestation_record("challenge", "foo", sw_enforced, hw_enforced,
50 SecLevel(), cert_chain_[0].encodedCertificate));
51 }
52};
53
54/*
55 * DeviceUniqueAttestationTest.RsaNonStrongBoxUnimplemented
56 *
57 * Verifies that non strongbox implementations do not implement Rsa device unique
58 * attestation.
59 */
60TEST_P(DeviceUniqueAttestationTest, RsaNonStrongBoxUnimplemented) {
61 if (SecLevel() == SecurityLevel::STRONGBOX) return;
62
63 vector<uint8_t> key_blob;
64 vector<KeyCharacteristics> key_characteristics;
65
66 // Check RSA implementation
67 auto result = GenerateKey(AuthorizationSetBuilder()
68 .Authorization(TAG_NO_AUTH_REQUIRED)
69 .RsaSigningKey(2048, 65537)
70 .Digest(Digest::SHA_2_256)
71 .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)
72 .Authorization(TAG_INCLUDE_UNIQUE_ID)
Selene Huang531a72d2021-04-15 01:09:47 -070073 .AttestationChallenge("challenge")
74 .AttestationApplicationId("foo")
75 .Authorization(TAG_DEVICE_UNIQUE_ATTESTATION),
76 &key_blob, &key_characteristics);
77
Shawn Willdenced5c2c2021-04-26 17:33:04 -060078 ASSERT_EQ(result, ErrorCode::INVALID_ARGUMENT);
Selene Huang531a72d2021-04-15 01:09:47 -070079}
80
81/*
82 * DeviceUniqueAttestationTest.EcdsaNonStrongBoxUnimplemented
83 *
84 * Verifies that non strongbox implementations do not implement Ecdsa device unique
85 * attestation.
86 */
87TEST_P(DeviceUniqueAttestationTest, EcdsaNonStrongBoxUnimplemented) {
88 if (SecLevel() == SecurityLevel::STRONGBOX) return;
89
90 vector<uint8_t> key_blob;
91 vector<KeyCharacteristics> key_characteristics;
92
93 // Check Ecdsa implementation
94 auto result = GenerateKey(AuthorizationSetBuilder()
95 .Authorization(TAG_NO_AUTH_REQUIRED)
96 .EcdsaSigningKey(EcCurve::P_256)
97 .Digest(Digest::SHA_2_256)
98 .Authorization(TAG_INCLUDE_UNIQUE_ID)
99 .AttestationChallenge("challenge")
100 .AttestationApplicationId("foo")
101 .Authorization(TAG_DEVICE_UNIQUE_ATTESTATION),
102 &key_blob, &key_characteristics);
103
Shawn Willdenced5c2c2021-04-26 17:33:04 -0600104 ASSERT_EQ(result, ErrorCode::INVALID_ARGUMENT);
Selene Huang531a72d2021-04-15 01:09:47 -0700105}
106
107/*
108 * DeviceUniqueAttestationTest.RsaDeviceUniqueAttestation
109 *
110 * Verifies that strongbox implementations of Rsa implements device unique
111 * attestation correctly, if implemented.
112 */
113TEST_P(DeviceUniqueAttestationTest, RsaDeviceUniqueAttestation) {
114 if (SecLevel() != SecurityLevel::STRONGBOX) return;
115
116 vector<uint8_t> key_blob;
117 vector<KeyCharacteristics> key_characteristics;
118 int key_size = 2048;
119
120 auto result = GenerateKey(AuthorizationSetBuilder()
121 .Authorization(TAG_NO_AUTH_REQUIRED)
122 .RsaSigningKey(key_size, 65537)
123 .Digest(Digest::SHA_2_256)
124 .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)
125 .Authorization(TAG_INCLUDE_UNIQUE_ID)
Selene Huang531a72d2021-04-15 01:09:47 -0700126 .AttestationChallenge("challenge")
127 .AttestationApplicationId("foo")
128 .Authorization(TAG_DEVICE_UNIQUE_ATTESTATION),
129 &key_blob, &key_characteristics);
130
131 // It is optional for Strong box to support DeviceUniqueAttestation.
132 if (result == ErrorCode::CANNOT_ATTEST_IDS) return;
133
134 ASSERT_EQ(ErrorCode::OK, result);
135
136 AuthorizationSet hw_enforced = AuthorizationSetBuilder()
137 .Authorization(TAG_DEVICE_UNIQUE_ATTESTATION)
138 .Authorization(TAG_NO_AUTH_REQUIRED)
139 .RsaSigningKey(2048, 65537)
140 .Digest(Digest::SHA_2_256)
141 .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)
142 .Authorization(TAG_ORIGIN, KeyOrigin::GENERATED)
143 .Authorization(TAG_OS_VERSION, os_version())
144 .Authorization(TAG_OS_PATCHLEVEL, os_patch_level());
145
146 CheckUniqueAttestationResults(key_blob, key_characteristics, hw_enforced, key_size);
147}
148
149/*
150 * DeviceUniqueAttestationTest.EcdsaDeviceUniqueAttestation
151 *
152 * Verifies that strongbox implementations of Rsa implements device unique
153 * attestation correctly, if implemented.
154 */
155TEST_P(DeviceUniqueAttestationTest, EcdsaDeviceUniqueAttestation) {
156 if (SecLevel() != SecurityLevel::STRONGBOX) return;
157
158 vector<uint8_t> key_blob;
159 vector<KeyCharacteristics> key_characteristics;
160 int key_size = 256;
161
162 auto result = GenerateKey(AuthorizationSetBuilder()
163 .Authorization(TAG_NO_AUTH_REQUIRED)
164 .EcdsaSigningKey(256)
165 .Digest(Digest::SHA_2_256)
166 .Authorization(TAG_INCLUDE_UNIQUE_ID)
167 .AttestationChallenge("challenge")
168 .AttestationApplicationId("foo")
169 .Authorization(TAG_DEVICE_UNIQUE_ATTESTATION),
170 &key_blob, &key_characteristics);
171
172 // It is optional for Strong box to support DeviceUniqueAttestation.
173 if (result == ErrorCode::CANNOT_ATTEST_IDS) return;
174 ASSERT_EQ(ErrorCode::OK, result);
175
176 AuthorizationSet hw_enforced = AuthorizationSetBuilder()
177 .Authorization(TAG_DEVICE_UNIQUE_ATTESTATION)
178 .Authorization(TAG_NO_AUTH_REQUIRED)
179 .EcdsaSigningKey(EcCurve::P_256)
180 .Digest(Digest::SHA_2_256)
181 .Authorization(TAG_EC_CURVE, EcCurve::P_256)
182 .Authorization(TAG_ORIGIN, KeyOrigin::GENERATED)
183 .Authorization(TAG_OS_VERSION, os_version())
184 .Authorization(TAG_OS_PATCHLEVEL, os_patch_level());
185
186 CheckUniqueAttestationResults(key_blob, key_characteristics, hw_enforced, key_size);
187}
188
189INSTANTIATE_KEYMINT_AIDL_TEST(DeviceUniqueAttestationTest);
190
191} // namespace aidl::android::hardware::security::keymint::test