Specialize the KM context to use encrypted key blobs
These key blobs are intended to be exported outside the VM, without need
for further encryption. This will allows a limited form of persistence
for VMs between boots of the same code.
The authorization set is left in plain text which reveals some metadata
about the key but does not compromise its security.
Bug: 190578423
Test: atest MicrodroidHostTestCases
Change-Id: I47a0f80e2137e189634b77c0b4aafb32d002be50
diff --git a/microdroid/keymint/service.cpp b/microdroid/keymint/service.cpp
index 8e20f44..5fc0bd2 100644
--- a/microdroid/keymint/service.cpp
+++ b/microdroid/keymint/service.cpp
@@ -102,7 +102,7 @@
// Add Keymint Service
std::shared_ptr<MicrodroidKeyMintDevice> keyMint =
- ndk::SharedRefBase::make<MicrodroidKeyMintDevice>();
+ ndk::SharedRefBase::make<MicrodroidKeyMintDevice>(*rootKey);
auto instanceName = std::string(MicrodroidKeyMintDevice::descriptor) + "/default";
LOG(INFO) << "adding keymint service instance: " << instanceName;
binder_status_t status =