blob: a5b32ab77e327e5333ac8bc2ad467f684e1949bc [file] [log] [blame]
Shawn Willden9d645a02014-06-12 13:48:46 -06001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef ANDROID_HARDWARE_KEYMASTER_DEFS_H
18#define ANDROID_HARDWARE_KEYMASTER_DEFS_H
19
20#include <stdint.h>
21#include <stdlib.h>
22#include <string.h>
23
Shawn Willdenc51d01e2015-03-18 18:59:52 -060024#ifndef __cplusplus
25extern "C" {
26#endif // __cplusplus
Shawn Willden9d645a02014-06-12 13:48:46 -060027
Shawn Willden9d645a02014-06-12 13:48:46 -060028/**
29 * Authorization tags each have an associated type. This enumeration facilitates tagging each with
30 * a type, by using the high four bits (of an implied 32-bit unsigned enum value) to specify up to
31 * 16 data types. These values are ORed with tag IDs to generate the final tag ID values.
32 */
33typedef enum {
34 KM_INVALID = 0 << 28, /* Invalid type, used to designate a tag as uninitialized */
35 KM_ENUM = 1 << 28,
36 KM_ENUM_REP = 2 << 28, /* Repeatable enumeration value. */
37 KM_INT = 3 << 28,
38 KM_INT_REP = 4 << 28, /* Repeatable integer value */
39 KM_LONG = 5 << 28,
40 KM_DATE = 6 << 28,
41 KM_BOOL = 7 << 28,
42 KM_BIGNUM = 8 << 28,
43 KM_BYTES = 9 << 28,
Shawn Willden4719aca2015-03-14 07:54:52 -060044 KM_LONG_REP = 10 << 28, /* Repeatable long value */
Shawn Willden9d645a02014-06-12 13:48:46 -060045} keymaster_tag_type_t;
46
47typedef enum {
48 KM_TAG_INVALID = KM_INVALID | 0,
49
50 /*
51 * Tags that must be semantically enforced by hardware and software implementations.
52 */
53
54 /* Crypto parameters */
Shawn Willden79d79342015-02-10 14:29:46 -070055 KM_TAG_PURPOSE = KM_ENUM_REP | 1, /* keymaster_purpose_t. */
56 KM_TAG_ALGORITHM = KM_ENUM | 2, /* keymaster_algorithm_t. */
57 KM_TAG_KEY_SIZE = KM_INT | 3, /* Key size in bits. */
58 KM_TAG_BLOCK_MODE = KM_ENUM | 4, /* keymaster_block_mode_t. */
59 KM_TAG_DIGEST = KM_ENUM | 5, /* keymaster_digest_t. */
Alex Klyubin340d0b12015-02-20 16:42:23 -080060 KM_TAG_MAC_LENGTH = KM_INT | 6, /* MAC or AEAD authentication tag length in bits. */
Shawn Willden79d79342015-02-10 14:29:46 -070061 KM_TAG_PADDING = KM_ENUM | 7, /* keymaster_padding_t. */
62 KM_TAG_RETURN_UNAUTHED = KM_BOOL | 8, /* Allow AEAD decryption to return plaintext before it has
63 been authenticated. WARNING: Not recommended. */
64 KM_TAG_CALLER_NONCE = KM_BOOL | 9, /* Allow caller to specify nonce or IV. */
Shawn Willden9d645a02014-06-12 13:48:46 -060065
66 /* Other hardware-enforced. */
67 KM_TAG_RESCOPING_ADD = KM_ENUM_REP | 101, /* Tags authorized for addition via rescoping. */
68 KM_TAG_RESCOPING_DEL = KM_ENUM_REP | 102, /* Tags authorized for removal via rescoping. */
69 KM_TAG_BLOB_USAGE_REQUIREMENTS = KM_ENUM | 705, /* keymaster_key_blob_usage_requirements_t */
70
71 /* Algorithm-specific. */
72 KM_TAG_RSA_PUBLIC_EXPONENT = KM_LONG | 200, /* Defaults to 2^16+1 */
Shawn Willden9d645a02014-06-12 13:48:46 -060073
74 /*
75 * Tags that should be semantically enforced by hardware if possible and will otherwise be
76 * enforced by software (keystore).
77 */
78
79 /* Key validity period */
80 KM_TAG_ACTIVE_DATETIME = KM_DATE | 400, /* Start of validity */
81 KM_TAG_ORIGINATION_EXPIRE_DATETIME = KM_DATE | 401, /* Date when new "messages" should no
82 longer be created. */
83 KM_TAG_USAGE_EXPIRE_DATETIME = KM_DATE | 402, /* Date when existing "messages" should no
84 longer be trusted. */
85 KM_TAG_MIN_SECONDS_BETWEEN_OPS = KM_INT | 403, /* Minimum elapsed time between
86 cryptographic operations with the key. */
Shawn Willdendc0007b2015-01-23 01:01:21 -070087 KM_TAG_MAX_USES_PER_BOOT = KM_INT | 404, /* Number of times the key can be used per
88 boot. */
Shawn Willden9d645a02014-06-12 13:48:46 -060089
90 /* User authentication */
Shawn Willden4719aca2015-03-14 07:54:52 -060091 KM_TAG_ALL_USERS = KM_BOOL | 500, /* If key is usable by all users. */
92 KM_TAG_USER_ID = KM_INT | 501, /* ID of authorized user. Disallowed if
93 KM_TAG_ALL_USERS is present. */
94 KM_TAG_USER_SECURE_ID = KM_LONG_REP | 502, /* Secure ID of authorized user or authenticator(s).
95 Disallowed if KM_TAG_ALL_USERS or
96 KM_TAG_NO_AUTH_REQUIRED is present. */
97 KM_TAG_NO_AUTH_REQUIRED = KM_BOOL | 503, /* If key is usable without authentication. */
98 KM_TAG_USER_AUTH_TYPE = KM_ENUM | 504, /* Bitmask of authenticator types allowed when
99 * KM_TAG_USER_SECURE_ID contains a secure user ID,
100 * rather than a secure authenticator ID. Defined in
101 * hw_authenticator_type_t in hw_auth_token.h. */
102 KM_TAG_AUTH_TIMEOUT = KM_INT | 505, /* Required freshness of user authentication for
103 private/secret key operations, in seconds.
104 Public key operations require no authentication.
105 If absent, authentication is required for every
106 use. Authentication state is lost when the
107 device is powered off. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600108
109 /* Application access control */
110 KM_TAG_ALL_APPLICATIONS = KM_BOOL | 600, /* If key is usable by all applications. */
111 KM_TAG_APPLICATION_ID = KM_BYTES | 601, /* ID of authorized application. Disallowed if
112 KM_TAG_ALL_APPLICATIONS is present. */
113
114 /*
115 * Semantically unenforceable tags, either because they have no specific meaning or because
116 * they're informational only.
117 */
118 KM_TAG_APPLICATION_DATA = KM_BYTES | 700, /* Data provided by authorized application. */
119 KM_TAG_CREATION_DATETIME = KM_DATE | 701, /* Key creation time */
120 KM_TAG_ORIGIN = KM_ENUM | 702, /* keymaster_key_origin_t. */
121 KM_TAG_ROLLBACK_RESISTANT = KM_BOOL | 703, /* Whether key is rollback-resistant. */
122 KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704, /* Root of trust ID. Empty array means usable by all
123 roots. */
124
Shawn Willden67ba9e82015-02-06 17:04:53 -0700125 /* Tags used only to provide data to or receive data from operations */
126 KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000, /* Used to provide associated data for AEAD modes. */
Shawn Willden41e91e92015-01-30 06:23:26 -0700127 KM_TAG_NONCE = KM_BYTES | 1001, /* Nonce or Initialization Vector */
Shawn Willden79d79342015-02-10 14:29:46 -0700128 KM_TAG_CHUNK_LENGTH = KM_INT | 1002, /* AEAD mode chunk size, in bytes. 0 means no limit,
129 which requires KM_TAG_RETURN_UNAUTHED. */
Shawn Willdenc3ab05c2015-03-14 08:23:41 -0600130 KM_TAG_AUTH_TOKEN = KM_BYTES | 1003, /* Authentication token that proves secure user
131 authentication has been performed. Structure
132 defined in hw_auth_token_t in hw_auth_token.h. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600133} keymaster_tag_t;
134
135/**
136 * Algorithms that may be provided by keymaster implementations. Those that must be provided by all
Shawn Willdenfd4b4d52015-02-24 09:17:38 -0700137 * implementations are tagged as "required".
Shawn Willden9d645a02014-06-12 13:48:46 -0600138 */
139typedef enum {
140 /* Asymmetric algorithms. */
Shawn Willdene9797a72015-04-07 13:39:12 -0600141 KM_ALGORITHM_RSA = 1,
142 // KM_ALGORITHM_DSA = 2, -- Removed, do not re-use value 2.
143 KM_ALGORITHM_EC = 3,
144
145 /* Block ciphers algorithms */
146 KM_ALGORITHM_AES = 32,
147
Shawn Willden9d645a02014-06-12 13:48:46 -0600148 /* MAC algorithms */
Shawn Willdene9797a72015-04-07 13:39:12 -0600149 KM_ALGORITHM_HMAC = 128,
Shawn Willden9d645a02014-06-12 13:48:46 -0600150} keymaster_algorithm_t;
151
152/**
153 * Symmetric block cipher modes that may be provided by keymaster implementations. Those that must
154 * be provided by all implementations are tagged as "required". This type is new in 0_4.
155 *
156 * KM_MODE_FIRST_UNAUTHENTICATED, KM_MODE_FIRST_AUTHENTICATED and KM_MODE_FIRST_MAC are not modes,
157 * but markers used to separate the available modes into classes.
158 */
159typedef enum {
160 /* Unauthenticated modes, usable only for encryption/decryption and not generally recommended
161 * except for compatibility with existing other protocols. */
162 KM_MODE_FIRST_UNAUTHENTICATED = 1,
163 KM_MODE_ECB = KM_MODE_FIRST_UNAUTHENTICATED, /* required */
164 KM_MODE_CBC = 2, /* required */
165 KM_MODE_CBC_CTS = 3, /* recommended */
166 KM_MODE_CTR = 4, /* recommended */
167 KM_MODE_OFB = 5,
168 KM_MODE_CFB = 6,
169 KM_MODE_XTS = 7, /* Note: requires double-length keys */
170 /* Authenticated modes, usable for encryption/decryption and signing/verification. Recommended
171 * over unauthenticated modes for all purposes. One of KM_MODE_GCM and KM_MODE_OCB is
172 * required. */
173 KM_MODE_FIRST_AUTHENTICATED = 32,
174 KM_MODE_GCM = KM_MODE_FIRST_AUTHENTICATED,
175 KM_MODE_OCB = 33,
176 KM_MODE_CCM = 34,
177 /* MAC modes -- only for signing/verification */
178 KM_MODE_FIRST_MAC = 128,
179 KM_MODE_CMAC = KM_MODE_FIRST_MAC,
180 KM_MODE_POLY1305 = 129,
181} keymaster_block_mode_t;
182
183/**
184 * Padding modes that may be applied to plaintext for encryption operations. This list includes
185 * padding modes for both symmetric and asymmetric algorithms. Note that implementations should not
186 * provide all possible combinations of algorithm and padding, only the
187 * cryptographically-appropriate pairs.
188 */
189typedef enum {
190 KM_PAD_NONE = 1, /* required, deprecated */
191 KM_PAD_RSA_OAEP = 2, /* required */
192 KM_PAD_RSA_PSS = 3, /* required */
193 KM_PAD_RSA_PKCS1_1_5_ENCRYPT = 4,
194 KM_PAD_RSA_PKCS1_1_5_SIGN = 5,
195 KM_PAD_ANSI_X923 = 32,
196 KM_PAD_ISO_10126 = 33,
197 KM_PAD_ZERO = 64, /* required */
198 KM_PAD_PKCS7 = 65, /* required */
199 KM_PAD_ISO_7816_4 = 66,
200} keymaster_padding_t;
201
202/**
203 * Digests that may be provided by keymaster implementations. Those that must be provided by all
204 * implementations are tagged as "required". Those that have been added since version 0_2 of the
205 * API are tagged as "new".
206 */
207typedef enum {
208 KM_DIGEST_NONE = 0, /* new, required */
Shawn Willden9d645a02014-06-12 13:48:46 -0600209 KM_DIGEST_MD5 = 1, /* new, for compatibility with old protocols only */
210 KM_DIGEST_SHA1 = 2, /* new */
211 KM_DIGEST_SHA_2_224 = 3, /* new */
212 KM_DIGEST_SHA_2_256 = 4, /* new, required */
213 KM_DIGEST_SHA_2_384 = 5, /* new, recommended */
214 KM_DIGEST_SHA_2_512 = 6, /* new, recommended */
215 KM_DIGEST_SHA_3_256 = 7, /* new */
216 KM_DIGEST_SHA_3_384 = 8, /* new */
217 KM_DIGEST_SHA_3_512 = 9, /* new */
218} keymaster_digest_t;
219
220/**
221 * The origin of a key (or pair), i.e. where it was generated. Origin and can be used together to
222 * determine whether a key may have existed outside of secure hardware. This type is new in 0_4.
223 */
224typedef enum {
225 KM_ORIGIN_HARDWARE = 0, /* Generated in secure hardware */
226 KM_ORIGIN_SOFTWARE = 1, /* Generated in non-secure software */
227 KM_ORIGIN_IMPORTED = 2, /* Imported, origin unknown */
228} keymaster_key_origin_t;
229
230/**
231 * Usability requirements of key blobs. This defines what system functionality must be available
232 * for the key to function. For example, key "blobs" which are actually handles referencing
233 * encrypted key material stored in the file system cannot be used until the file system is
234 * available, and should have BLOB_REQUIRES_FILE_SYSTEM. Other requirements entries will be added
235 * as needed for implementations. This type is new in 0_4.
236 */
237typedef enum {
238 KM_BLOB_STANDALONE = 0,
239 KM_BLOB_REQUIRES_FILE_SYSTEM = 1,
240} keymaster_key_blob_usage_requirements_t;
241
242/**
243 * Possible purposes of a key (or pair). This type is new in 0_4.
244 */
245typedef enum {
246 KM_PURPOSE_ENCRYPT = 0,
247 KM_PURPOSE_DECRYPT = 1,
248 KM_PURPOSE_SIGN = 2,
249 KM_PURPOSE_VERIFY = 3,
250} keymaster_purpose_t;
251
252typedef struct {
253 const uint8_t* data;
254 size_t data_length;
255} keymaster_blob_t;
256
257typedef struct {
258 keymaster_tag_t tag;
259 union {
260 uint32_t enumerated; /* KM_ENUM and KM_ENUM_REP */
261 bool boolean; /* KM_BOOL */
262 uint32_t integer; /* KM_INT and KM_INT_REP */
263 uint64_t long_integer; /* KM_LONG */
264 uint64_t date_time; /* KM_DATE */
265 keymaster_blob_t blob; /* KM_BIGNUM and KM_BYTES*/
266 };
267} keymaster_key_param_t;
268
269typedef struct {
270 keymaster_key_param_t* params; /* may be NULL if length == 0 */
271 size_t length;
272} keymaster_key_param_set_t;
273
274/**
275 * Parameters that define a key's characteristics, including authorized modes of usage and access
276 * control restrictions. The parameters are divided into two categories, those that are enforced by
277 * secure hardware, and those that are not. For a software-only keymaster implementation the
278 * enforced array must NULL. Hardware implementations must enforce everything in the enforced
279 * array.
280 */
281typedef struct {
282 keymaster_key_param_set_t hw_enforced;
283 keymaster_key_param_set_t sw_enforced;
284} keymaster_key_characteristics_t;
285
286typedef struct {
287 const uint8_t* key_material;
288 size_t key_material_size;
289} keymaster_key_blob_t;
290
291/**
292 * Formats for key import and export. At present, only asymmetric key import/export is supported.
293 * In the future this list will expand greatly to accommodate asymmetric key import/export.
294 */
295typedef enum {
Chad Brubakerf883b982015-02-13 13:58:36 -0800296 KM_KEY_FORMAT_X509 = 0, /* for public key export, required */
297 KM_KEY_FORMAT_PKCS8 = 1, /* for asymmetric key pair import, required */
298 KM_KEY_FORMAT_PKCS12 = 2, /* for asymmetric key pair import, not required */
299 KM_KEY_FORMAT_RAW = 3, /* for symmetric key import, required */
Shawn Willden9d645a02014-06-12 13:48:46 -0600300} keymaster_key_format_t;
301
302/**
303 * The keymaster operation API consists of begin, update, finish and abort. This is the type of the
304 * handle used to tie the sequence of calls together. A 64-bit value is used because it's important
305 * that handles not be predictable. Implementations must use strong random numbers for handle
306 * values.
307 */
308typedef uint64_t keymaster_operation_handle_t;
309
310typedef enum {
311 KM_ERROR_OK = 0,
312 KM_ERROR_ROOT_OF_TRUST_ALREADY_SET = -1,
313 KM_ERROR_UNSUPPORTED_PURPOSE = -2,
314 KM_ERROR_INCOMPATIBLE_PURPOSE = -3,
315 KM_ERROR_UNSUPPORTED_ALGORITHM = -4,
316 KM_ERROR_INCOMPATIBLE_ALGORITHM = -5,
317 KM_ERROR_UNSUPPORTED_KEY_SIZE = -6,
318 KM_ERROR_UNSUPPORTED_BLOCK_MODE = -7,
319 KM_ERROR_INCOMPATIBLE_BLOCK_MODE = -8,
Shawn Willden6b424be2015-01-26 13:04:28 -0700320 KM_ERROR_UNSUPPORTED_MAC_LENGTH = -9,
Shawn Willden9d645a02014-06-12 13:48:46 -0600321 KM_ERROR_UNSUPPORTED_PADDING_MODE = -10,
322 KM_ERROR_INCOMPATIBLE_PADDING_MODE = -11,
323 KM_ERROR_UNSUPPORTED_DIGEST = -12,
324 KM_ERROR_INCOMPATIBLE_DIGEST = -13,
325 KM_ERROR_INVALID_EXPIRATION_TIME = -14,
326 KM_ERROR_INVALID_USER_ID = -15,
327 KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT = -16,
328 KM_ERROR_UNSUPPORTED_KEY_FORMAT = -17,
329 KM_ERROR_INCOMPATIBLE_KEY_FORMAT = -18,
330 KM_ERROR_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = -19, /* For PKCS8 & PKCS12 */
331 KM_ERROR_UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = -20, /* For PKCS8 & PKCS12 */
332 KM_ERROR_INVALID_INPUT_LENGTH = -21,
333 KM_ERROR_KEY_EXPORT_OPTIONS_INVALID = -22,
334 KM_ERROR_DELEGATION_NOT_ALLOWED = -23,
335 KM_ERROR_KEY_NOT_YET_VALID = -24,
336 KM_ERROR_KEY_EXPIRED = -25,
337 KM_ERROR_KEY_USER_NOT_AUTHENTICATED = -26,
338 KM_ERROR_OUTPUT_PARAMETER_NULL = -27,
339 KM_ERROR_INVALID_OPERATION_HANDLE = -28,
340 KM_ERROR_INSUFFICIENT_BUFFER_SPACE = -29,
341 KM_ERROR_VERIFICATION_FAILED = -30,
342 KM_ERROR_TOO_MANY_OPERATIONS = -31,
343 KM_ERROR_UNEXPECTED_NULL_POINTER = -32,
344 KM_ERROR_INVALID_KEY_BLOB = -33,
345 KM_ERROR_IMPORTED_KEY_NOT_ENCRYPTED = -34,
346 KM_ERROR_IMPORTED_KEY_DECRYPTION_FAILED = -35,
347 KM_ERROR_IMPORTED_KEY_NOT_SIGNED = -36,
348 KM_ERROR_IMPORTED_KEY_VERIFICATION_FAILED = -37,
349 KM_ERROR_INVALID_ARGUMENT = -38,
350 KM_ERROR_UNSUPPORTED_TAG = -39,
351 KM_ERROR_INVALID_TAG = -40,
352 KM_ERROR_MEMORY_ALLOCATION_FAILED = -41,
353 KM_ERROR_INVALID_RESCOPING = -42,
Shawn Willden9d645a02014-06-12 13:48:46 -0600354 KM_ERROR_IMPORT_PARAMETER_MISMATCH = -44,
355 KM_ERROR_SECURE_HW_ACCESS_DENIED = -45,
356 KM_ERROR_OPERATION_CANCELLED = -46,
357 KM_ERROR_CONCURRENT_ACCESS_CONFLICT = -47,
358 KM_ERROR_SECURE_HW_BUSY = -48,
359 KM_ERROR_SECURE_HW_COMMUNICATION_FAILED = -49,
360 KM_ERROR_UNSUPPORTED_EC_FIELD = -50,
Shawn Willdened941112015-03-11 21:53:59 -0600361 KM_ERROR_MISSING_NONCE = -51,
362 KM_ERROR_INVALID_NONCE = -52,
363 KM_ERROR_UNSUPPORTED_CHUNK_LENGTH = -53,
364 KM_ERROR_RESCOPABLE_KEY_NOT_USABLE = -54,
365
Shawn Willden9d645a02014-06-12 13:48:46 -0600366 KM_ERROR_UNIMPLEMENTED = -100,
367 KM_ERROR_VERSION_MISMATCH = -101,
368
369 /* Additional error codes may be added by implementations, but implementers should coordinate
370 * with Google to avoid code collision. */
371 KM_ERROR_UNKNOWN_ERROR = -1000,
372} keymaster_error_t;
373
Shawn Willden9d645a02014-06-12 13:48:46 -0600374/* Convenience functions for manipulating keymaster tag types */
375
376static inline keymaster_tag_type_t keymaster_tag_get_type(keymaster_tag_t tag) {
377 return (keymaster_tag_type_t)(tag & (0xF << 28));
378}
379
380static inline uint32_t keymaster_tag_mask_type(keymaster_tag_t tag) {
381 return tag & 0x0FFFFFFF;
382}
383
384static inline bool keymaster_tag_type_repeatable(keymaster_tag_type_t type) {
385 switch (type) {
386 case KM_INT_REP:
387 case KM_ENUM_REP:
388 return true;
389 default:
390 return false;
391 }
392}
393
394static inline bool keymaster_tag_repeatable(keymaster_tag_t tag) {
395 return keymaster_tag_type_repeatable(keymaster_tag_get_type(tag));
396}
397
398/* Convenience functions for manipulating keymaster_key_param_t structs */
399
400inline keymaster_key_param_t keymaster_param_enum(keymaster_tag_t tag, uint32_t value) {
401 // assert(keymaster_tag_get_type(tag) == KM_ENUM || keymaster_tag_get_type(tag) == KM_ENUM_REP);
402 keymaster_key_param_t param;
403 memset(&param, 0, sizeof(param));
404 param.tag = tag;
405 param.enumerated = value;
406 return param;
407}
408
409inline keymaster_key_param_t keymaster_param_int(keymaster_tag_t tag, uint32_t value) {
410 // assert(keymaster_tag_get_type(tag) == KM_INT || keymaster_tag_get_type(tag) == KM_INT_REP);
411 keymaster_key_param_t param;
412 memset(&param, 0, sizeof(param));
413 param.tag = tag;
414 param.integer = value;
415 return param;
416}
417
418inline keymaster_key_param_t keymaster_param_long(keymaster_tag_t tag, uint64_t value) {
419 // assert(keymaster_tag_get_type(tag) == KM_LONG);
420 keymaster_key_param_t param;
421 memset(&param, 0, sizeof(param));
422 param.tag = tag;
423 param.long_integer = value;
424 return param;
425}
426
427inline keymaster_key_param_t keymaster_param_blob(keymaster_tag_t tag, const uint8_t* bytes,
428 size_t bytes_len) {
429 // assert(keymaster_tag_get_type(tag) == KM_BYTES || keymaster_tag_get_type(tag) == KM_BIGNUM);
430 keymaster_key_param_t param;
431 memset(&param, 0, sizeof(param));
432 param.tag = tag;
433 param.blob.data = (uint8_t*)bytes;
434 param.blob.data_length = bytes_len;
435 return param;
436}
437
438inline keymaster_key_param_t keymaster_param_bool(keymaster_tag_t tag) {
439 // assert(keymaster_tag_get_type(tag) == KM_BOOL);
440 keymaster_key_param_t param;
441 memset(&param, 0, sizeof(param));
442 param.tag = tag;
443 param.boolean = true;
444 return param;
445}
446
447inline keymaster_key_param_t keymaster_param_date(keymaster_tag_t tag, uint64_t value) {
448 // assert(keymaster_tag_get_type(tag) == KM_DATE);
449 keymaster_key_param_t param;
450 memset(&param, 0, sizeof(param));
451 param.tag = tag;
452 param.date_time = value;
453 return param;
454}
455
Shawn Willden67411d62015-03-04 10:00:38 -0700456#define KEYMASTER_SIMPLE_COMPARE(a, b) (a < b) ? -1 : ((a > b) ? 1 : 0)
457inline int keymaster_param_compare(const keymaster_key_param_t* a, const keymaster_key_param_t* b) {
458 int retval = KEYMASTER_SIMPLE_COMPARE(a->tag, b->tag);
459 if (retval != 0)
460 return retval;
461
462 switch (keymaster_tag_get_type(a->tag)) {
463 case KM_INVALID:
464 case KM_BOOL:
465 return 0;
466 case KM_ENUM:
467 case KM_ENUM_REP:
468 return KEYMASTER_SIMPLE_COMPARE(a->enumerated, b->enumerated);
469 case KM_INT:
470 case KM_INT_REP:
471 return KEYMASTER_SIMPLE_COMPARE(a->integer, b->integer);
472 case KM_LONG:
Shawn Willden4719aca2015-03-14 07:54:52 -0600473 case KM_LONG_REP:
Shawn Willden67411d62015-03-04 10:00:38 -0700474 return KEYMASTER_SIMPLE_COMPARE(a->long_integer, b->long_integer);
475 case KM_DATE:
476 return KEYMASTER_SIMPLE_COMPARE(a->date_time, b->date_time);
477 case KM_BIGNUM:
478 case KM_BYTES:
479 // Handle the empty cases.
480 if (a->blob.data_length != 0 && b->blob.data_length == 0)
481 return -1;
482 if (a->blob.data_length == 0 && b->blob.data_length == 0)
483 return 0;
484 if (a->blob.data_length == 0 && b->blob.data_length > 0)
485 return 1;
486
487 retval = memcmp(a->blob.data, b->blob.data, a->blob.data_length < b->blob.data_length
488 ? a->blob.data_length
489 : b->blob.data_length);
490 if (retval != 0)
491 return retval;
492 else if (a->blob.data_length != b->blob.data_length) {
493 // Equal up to the common length; longer one is larger.
494 if (a->blob.data_length < b->blob.data_length)
495 return -1;
496 if (a->blob.data_length > b->blob.data_length)
497 return 1;
498 };
499 }
500
501 return 0;
502}
503#undef KEYMASTER_SIMPLE_COMPARE
504
Shawn Willden9d645a02014-06-12 13:48:46 -0600505inline void keymaster_free_param_values(keymaster_key_param_t* param, size_t param_count) {
506 while (param_count-- > 0) {
507 switch (keymaster_tag_get_type(param->tag)) {
508 case KM_BIGNUM:
509 case KM_BYTES:
510 free((void*)param->blob.data);
511 param->blob.data = NULL;
512 break;
513 default:
514 // NOP
515 break;
516 }
517 ++param;
518 }
519}
520
521inline void keymaster_free_param_set(keymaster_key_param_set_t* set) {
522 if (set) {
523 keymaster_free_param_values(set->params, set->length);
524 free(set->params);
525 set->params = NULL;
526 }
527}
528
529inline void keymaster_free_characteristics(keymaster_key_characteristics_t* characteristics) {
530 if (characteristics) {
531 keymaster_free_param_set(&characteristics->hw_enforced);
532 keymaster_free_param_set(&characteristics->sw_enforced);
533 }
534}
535
Shawn Willdenc51d01e2015-03-18 18:59:52 -0600536#ifndef __cplusplus
537} // extern "C"
538#endif // __cplusplus
Shawn Willden9d645a02014-06-12 13:48:46 -0600539
540#endif // ANDROID_HARDWARE_KEYMASTER_DEFS_H