diff --git a/keystore/Android.bp b/keystore/Android.bp
index 42301f2..6e69e0a 100644
--- a/keystore/Android.bp
+++ b/keystore/Android.bp
@@ -40,11 +40,11 @@
     ],
     shared_libs: [
         "android.hardware.keymaster@3.0",
+        "android.hardware.keymaster@4.0",
         "android.system.wifi.keystore@1.0",
         "libbase",
         "libbinder",
         "libcrypto",
-        "libcutils",
         "libhardware",
         "libhidlbase",
         "libhidltransport",
@@ -131,7 +131,7 @@
         "keystore_aidl_hidl_marshalling_utils.cpp",
     ],
     shared_libs: [
-        "android.hardware.keymaster@3.0",
+        "android.hardware.keymaster@4.0",
         "libbinder",
         "libhardware",
         "libhidlbase",
@@ -141,7 +141,7 @@
         "libutils",
     ],
     export_shared_lib_headers: [
-        "android.hardware.keymaster@3.0",
+        "android.hardware.keymaster@4.0",
         "libbinder",
         "libhidlbase",
         "libhwbinder",
@@ -222,13 +222,13 @@
     ],
     static_libs: ["libgtest_main"],
     shared_libs: [
-        "android.hardware.keymaster@3.0",
+        "android.hardware.keymaster@4.0",
         "libhidlbase",
         "libhwbinder",
         "libutils",
     ],
     export_shared_lib_headers: [
-        "android.hardware.keymaster@3.0",
+        "android.hardware.keymaster@4.0",
         "libhidlbase",
         "libhwbinder",
     ],
diff --git a/keystore/KeyStore.cpp b/keystore/KeyStore.cpp
index 4cdae1d..fd5b26d 100644
--- a/keystore/KeyStore.cpp
+++ b/keystore/KeyStore.cpp
@@ -35,10 +35,11 @@
 
 namespace keystore {
 
-const char* KeyStore::sOldMasterKey = ".masterkey";
-const char* KeyStore::sMetaDataFile = ".metadata";
+const char* KeyStore::kOldMasterKey = ".masterkey";
+const char* KeyStore::kMetaDataFile = ".metadata";
 
-const android::String16 KeyStore::sRSAKeyType("RSA");
+const android::String16 KeyStore::kRsaKeyType("RSA");
+const android::String16 KeyStore::kEcKeyType("EC");
 
 using android::String8;
 
@@ -548,23 +549,22 @@
     return put(filename, &keyBlob, userId);
 }
 
-bool KeyStore::isHardwareBacked(const android::String16& /*keyType*/) const {
-    using ::android::hardware::hidl_string;
+bool KeyStore::isHardwareBacked(const android::String16& keyType) const {
     if (mDevice == NULL) {
         ALOGW("can't get keymaster device");
         return false;
     }
 
-    bool isSecure = false;
-    auto hidlcb = [&](bool _isSecure, bool, bool, bool, bool, const hidl_string&,
-                      const hidl_string&) { isSecure = _isSecure; };
-    auto rc = mDevice->getHardwareFeatures(hidlcb);
-    if (!rc.isOk()) {
-        ALOGE("Communication with keymaster HAL failed while retrieving hardware features (%s)",
-              rc.description().c_str());
+    auto version = mDevice->halVersion();
+    if (version.error != ErrorCode::OK) {
+        ALOGE("Failed to get HAL version info");
         return false;
     }
-    return isSecure;
+
+    if (!version.isSecure) return false;
+
+    if (keyType == kRsaKeyType) return true;  // All versions support RSA
+    return keyType == kEcKeyType && version.supportsEc;
 }
 
 ResponseCode KeyStore::getKeyForName(Blob* keyBlob, const android::String8& keyName,
@@ -701,7 +701,7 @@
 }
 
 void KeyStore::readMetaData() {
-    int in = TEMP_FAILURE_RETRY(open(sMetaDataFile, O_RDONLY));
+    int in = TEMP_FAILURE_RETRY(open(kMetaDataFile, O_RDONLY));
     if (in < 0) {
         return;
     }
@@ -726,7 +726,7 @@
               sizeof(mMetaData));
     }
     close(out);
-    rename(tmpFileName, sMetaDataFile);
+    rename(tmpFileName, kMetaDataFile);
 }
 
 bool KeyStore::upgradeKeystore() {
@@ -739,8 +739,8 @@
         userState->initialize();
 
         // Migrate the old .masterkey file to user 0.
-        if (access(sOldMasterKey, R_OK) == 0) {
-            if (rename(sOldMasterKey, userState->getMasterKeyFileName()) < 0) {
+        if (access(kOldMasterKey, R_OK) == 0) {
+            if (rename(kOldMasterKey, userState->getMasterKeyFileName()) < 0) {
                 ALOGE("couldn't migrate old masterkey: %s", strerror(errno));
                 return false;
             }
diff --git a/keystore/KeyStore.h b/keystore/KeyStore.h
index 4000b81..60cf56d 100644
--- a/keystore/KeyStore.h
+++ b/keystore/KeyStore.h
@@ -122,9 +122,10 @@
     const UserState* getUserStateByUid(uid_t uid) const;
 
   private:
-    static const char* sOldMasterKey;
-    static const char* sMetaDataFile;
-    static const android::String16 sRSAKeyType;
+    static const char* kOldMasterKey;
+    static const char* kMetaDataFile;
+    static const android::String16 kRsaKeyType;
+    static const android::String16 kEcKeyType;
     Entropy* mEntropy;
 
     sp<Keymaster> mDevice;
diff --git a/keystore/Keymaster3.cpp b/keystore/Keymaster3.cpp
index 53a92cc..c4ddc75 100644
--- a/keystore/Keymaster3.cpp
+++ b/keystore/Keymaster3.cpp
@@ -23,7 +23,73 @@
 
 namespace keystore {
 
-using android::hardware::hidl_string;
+namespace oldkeymaster = ::android::hardware::keymaster::V3_0;
+using android::hardware::details::StatusOf;
+
+namespace {
+
+ErrorCode convert(oldkeymaster::ErrorCode error) {
+    return static_cast<ErrorCode>(error);
+}
+
+oldkeymaster::KeyPurpose convert(KeyPurpose purpose) {
+    return static_cast<oldkeymaster::KeyPurpose>(purpose);
+}
+
+oldkeymaster::KeyParameter convert(const KeyParameter& param) {
+    oldkeymaster::KeyParameter converted;
+    converted.tag = static_cast<oldkeymaster::Tag>(param.tag);
+    static_assert(sizeof(converted.f) == sizeof(param.f), "This function assumes sizes match");
+    memcpy(&converted.f, &param.f, sizeof(param.f));
+    converted.blob = param.blob;
+    return converted;
+}
+
+KeyParameter convert(const oldkeymaster::KeyParameter& param) {
+    KeyParameter converted;
+    converted.tag = static_cast<Tag>(param.tag);
+    static_assert(sizeof(converted.f) == sizeof(param.f), "This function assumes sizes match");
+    memcpy(&converted.f, &param.f, sizeof(param.f));
+    converted.blob = param.blob;
+    return converted;
+}
+
+hidl_vec<oldkeymaster::KeyParameter> convert(const hidl_vec<KeyParameter>& params) {
+    hidl_vec<oldkeymaster::KeyParameter> converted(params.size());
+    for (size_t i = 0; i < params.size(); ++i) {
+        converted[i] = convert(params[i]);
+    }
+    return converted;
+}
+
+hidl_vec<KeyParameter> convert(const hidl_vec<oldkeymaster::KeyParameter>& params) {
+    hidl_vec<KeyParameter> converted(params.size());
+    for (size_t i = 0; i < params.size(); ++i) {
+        converted[i] = convert(params[i]);
+    }
+    return converted;
+}
+
+hidl_vec<oldkeymaster::KeyParameter> convertAndAddAuthToken(const hidl_vec<KeyParameter>& params,
+                                                            const HardwareAuthToken& authToken) {
+    hidl_vec<oldkeymaster::KeyParameter> converted(params.size() + 1);
+    for (size_t i = 0; i < params.size(); ++i) {
+        converted[i] = convert(params[i]);
+    }
+    converted[params.size()].tag = oldkeymaster::Tag::AUTH_TOKEN;
+    converted[params.size()].blob = authToken2HidlVec(authToken);
+
+    return converted;
+}
+
+KeyCharacteristics convert(const oldkeymaster::KeyCharacteristics& chars) {
+    KeyCharacteristics converted;
+    converted.hardwareEnforced = convert(chars.teeEnforced);
+    converted.softwareEnforced = convert(chars.softwareEnforced);
+    return converted;
+}
+
+}  // namespace
 
 void Keymaster3::getVersionIfNeeded() {
     if (haveVersion_) return;
@@ -39,19 +105,19 @@
             supportsAllDigests_ = supportsAllDigests;
             keymasterName_ = keymasterName;
             authorName_ = keymasterAuthorName;
-
-            if (!isSecure) {
-                majorVersion_ = 3;  // SW version is 3 (don't think this should happen).
-            } else if (supportsAttestation) {
-                majorVersion_ = 2;  // Could be 3, no real difference.
-            } else if (supportsSymmetricCryptography) {
-                majorVersion_ = 1;
-            } else {
-                majorVersion_ = 0;
-            }
         });
 
     CHECK(rc.isOk()) << "Got error " << rc.description() << " trying to get hardware features";
+
+    if (!isSecure_) {
+        majorVersion_ = 3;
+    } else if (supportsAttestation_) {
+        majorVersion_ = 3;  // Could be 2, doesn't matter.
+    } else if (supportsSymmetricCryptography_) {
+        majorVersion_ = 1;
+    } else {
+        majorVersion_ = 0;
+    }
 }
 
 Keymaster::VersionResult Keymaster3::halVersion() {
@@ -59,4 +125,159 @@
     return {ErrorCode::OK, majorVersion_, isSecure_, supportsEllipticCurve_};
 }
 
+Return<void> Keymaster3::getHardwareInfo(Keymaster3::getHardwareInfo_cb _hidl_cb) {
+    getVersionIfNeeded();
+    _hidl_cb(isSecure_ ? SecurityLevel::TRUSTED_ENVIRONMENT : SecurityLevel::SOFTWARE,
+             keymasterName_ + " (wrapped by keystore::Keymaster3)", authorName_);
+    return Void();
+}
+
+Return<ErrorCode> Keymaster3::addRngEntropy(const hidl_vec<uint8_t>& data) {
+    auto rc = km3_dev_->addRngEntropy(data);
+    if (!rc.isOk()) {
+        return StatusOf<oldkeymaster::ErrorCode, ErrorCode>(rc);
+    }
+    return convert(rc);
+}
+
+Return<void> Keymaster3::generateKey(const hidl_vec<KeyParameter>& keyParams,
+                                     generateKey_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error, const hidl_vec<uint8_t>& keyBlob,
+                  const oldkeymaster::KeyCharacteristics& characteristics) {
+        _hidl_cb(convert(error), keyBlob, convert(characteristics));
+    };
+    auto rc = km3_dev_->generateKey(convert(keyParams), cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<void> Keymaster3::getKeyCharacteristics(const hidl_vec<uint8_t>& keyBlob,
+                                               const hidl_vec<uint8_t>& clientId,
+                                               const hidl_vec<uint8_t>& appData,
+                                               getKeyCharacteristics_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error, const oldkeymaster::KeyCharacteristics& chars) {
+        _hidl_cb(convert(error), convert(chars));
+    };
+
+    auto rc = km3_dev_->getKeyCharacteristics(keyBlob, clientId, appData, cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<void> Keymaster3::importKey(const hidl_vec<KeyParameter>& params, KeyFormat keyFormat,
+                                   const hidl_vec<uint8_t>& keyData, importKey_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error, const hidl_vec<uint8_t>& keyBlob,
+                  const oldkeymaster::KeyCharacteristics& chars) {
+        _hidl_cb(convert(error), keyBlob, convert(chars));
+    };
+    auto rc = km3_dev_->importKey(convert(params), keyFormat, keyData, cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<void> Keymaster3::exportKey(KeyFormat exportFormat, const hidl_vec<uint8_t>& keyBlob,
+                                   const hidl_vec<uint8_t>& clientId,
+                                   const hidl_vec<uint8_t>& appData, exportKey_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error, const hidl_vec<uint8_t>& keyMaterial) {
+        _hidl_cb(convert(error), keyMaterial);
+    };
+    auto rc = km3_dev_->exportKey(exportFormat, keyBlob, clientId, appData, cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<void> Keymaster3::attestKey(const hidl_vec<uint8_t>& keyToAttest,
+                                   const hidl_vec<KeyParameter>& attestParams,
+                                   attestKey_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error, const hidl_vec<hidl_vec<uint8_t>>& certChain) {
+        _hidl_cb(convert(error), certChain);
+    };
+    auto rc = km3_dev_->attestKey(keyToAttest, convert(attestParams), cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<void> Keymaster3::upgradeKey(const hidl_vec<uint8_t>& keyBlobToUpgrade,
+                                    const hidl_vec<KeyParameter>& upgradeParams,
+                                    upgradeKey_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error, const hidl_vec<uint8_t>& upgradedKeyBlob) {
+        _hidl_cb(convert(error), upgradedKeyBlob);
+    };
+    auto rc = km3_dev_->upgradeKey(keyBlobToUpgrade, convert(upgradeParams), cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<ErrorCode> Keymaster3::deleteKey(const hidl_vec<uint8_t>& keyBlob) {
+    auto rc = km3_dev_->deleteKey(keyBlob);
+    if (!rc.isOk()) return StatusOf<oldkeymaster::ErrorCode, ErrorCode>(rc);
+    return convert(rc);
+}
+
+Return<ErrorCode> Keymaster3::deleteAllKeys() {
+    auto rc = km3_dev_->deleteAllKeys();
+    if (!rc.isOk()) return StatusOf<oldkeymaster::ErrorCode, ErrorCode>(rc);
+    return convert(rc);
+}
+
+Return<ErrorCode> Keymaster3::destroyAttestationIds() {
+    auto rc = km3_dev_->destroyAttestationIds();
+    if (!rc.isOk()) return StatusOf<oldkeymaster::ErrorCode, ErrorCode>(rc);
+    return convert(rc);
+}
+
+Return<void> Keymaster3::begin(KeyPurpose purpose, const hidl_vec<uint8_t>& key,
+                               const hidl_vec<KeyParameter>& inParams,
+                               const HardwareAuthToken& authToken, begin_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error,
+                  const hidl_vec<oldkeymaster::KeyParameter>& outParams,
+                  OperationHandle operationHandle) {
+        _hidl_cb(convert(error), convert(outParams), operationHandle);
+    };
+
+    auto rc =
+        km3_dev_->begin(convert(purpose), key, convertAndAddAuthToken(inParams, authToken), cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<void> Keymaster3::update(uint64_t operationHandle, const hidl_vec<KeyParameter>& inParams,
+                                const hidl_vec<uint8_t>& input, const HardwareAuthToken& authToken,
+                                const VerificationToken& /* verificationToken */,
+                                update_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error, uint32_t inputConsumed,
+                  const hidl_vec<oldkeymaster::KeyParameter>& outParams,
+                  const hidl_vec<uint8_t>& output) {
+        _hidl_cb(convert(error), inputConsumed, convert(outParams), output);
+    };
+
+    auto rc =
+        km3_dev_->update(operationHandle, convertAndAddAuthToken(inParams, authToken), input, cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<void> Keymaster3::finish(uint64_t operationHandle, const hidl_vec<KeyParameter>& inParams,
+                                const hidl_vec<uint8_t>& input, const hidl_vec<uint8_t>& signature,
+                                const HardwareAuthToken& authToken,
+                                const VerificationToken& /* verificationToken */,
+                                finish_cb _hidl_cb) {
+    auto cb = [&](oldkeymaster::ErrorCode error,
+                  const hidl_vec<oldkeymaster::KeyParameter>& outParams,
+                  const hidl_vec<uint8_t>& output) {
+        _hidl_cb(convert(error), convert(outParams), output);
+    };
+
+    auto rc = km3_dev_->finish(operationHandle, convertAndAddAuthToken(inParams, authToken), input,
+                               signature, cb);
+    rc.isOk();  // move ctor prereq
+    return rc;
+}
+
+Return<ErrorCode> Keymaster3::abort(uint64_t operationHandle) {
+    auto rc = km3_dev_->abort(operationHandle);
+    if (!rc.isOk()) return StatusOf<oldkeymaster::ErrorCode, ErrorCode>(rc);
+    return convert(rc);
+}
+
 }  // namespace keystore
diff --git a/keystore/Keymaster3.h b/keystore/Keymaster3.h
index 3be01d7..172ab23 100644
--- a/keystore/Keymaster3.h
+++ b/keystore/Keymaster3.h
@@ -15,99 +15,90 @@
  ** limitations under the License.
  */
 
-#ifndef KEYSTORE_KEYMASTER_3_H_
-#define KEYSTORE_KEYMASTER_3_H_
+#ifndef KEYMASTER_3_DEVICE_WRAPPER_H_
+#define KEYMASTER_3_DEVICE_WRAPPER_H_
 
+#include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
 #include <keystore/keymaster_types.h>
-#include <utils/StrongPointer.h>
 
 #include "Keymaster.h"
 
 namespace keystore {
 
-using android::sp;
 using IKeymaster3Device = ::android::hardware::keymaster::V3_0::IKeymasterDevice;
 
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hardware::details::return_status;
+
 class Keymaster3 : public Keymaster {
   public:
-    Keymaster3(sp<IKeymasterDevice> km3_dev) : km3_dev_(km3_dev) {}
+    Keymaster3(sp<IKeymaster3Device> km3_dev) : km3_dev_(km3_dev) {}
 
     VersionResult halVersion() override;
 
-    Return<void> getHardwareFeatures(getHardwareFeatures_cb _hidl_cb) override {
-        getVersionIfNeeded();
-        _hidl_cb(isSecure_, supportsEllipticCurve_, supportsSymmetricCryptography_,
-                 supportsAttestation_, supportsAllDigests_,
-                 keymasterName_ + " (wrapped by keystore::Keymaster3)", authorName_);
-        return android::hardware::Void();
+    Return<void> getHardwareInfo(getHardwareInfo_cb _hidl_cb);
+
+    Return<void> getHmacSharingParameters(getHmacSharingParameters_cb _hidl_cb) override {
+        _hidl_cb(ErrorCode::UNIMPLEMENTED, {});
+        return Void();
     }
 
-    Return<ErrorCode> addRngEntropy(const hidl_vec<uint8_t>& data) override {
-        return km3_dev_->addRngEntropy(data);
+    Return<void> computeSharedHmac(const hidl_vec<HmacSharingParameters>&,
+                                   computeSharedHmac_cb _hidl_cb) override {
+        _hidl_cb(ErrorCode::UNIMPLEMENTED, {});
+        return Void();
     }
 
+    Return<void> verifyAuthorization(uint64_t, const hidl_vec<KeyParameter>&,
+                                     const HardwareAuthToken&,
+                                     verifyAuthorization_cb _hidl_cb) override {
+        _hidl_cb(ErrorCode::UNIMPLEMENTED, {});
+        return Void();
+    }
+
+    Return<ErrorCode> addRngEntropy(const hidl_vec<uint8_t>& data) override;
     Return<void> generateKey(const hidl_vec<KeyParameter>& keyParams,
-                             generateKey_cb _hidl_cb) override {
-        return km3_dev_->generateKey(keyParams, _hidl_cb);
-    }
-
+                             generateKey_cb _hidl_cb) override;
     Return<void> getKeyCharacteristics(const hidl_vec<uint8_t>& keyBlob,
                                        const hidl_vec<uint8_t>& clientId,
                                        const hidl_vec<uint8_t>& appData,
-                                       getKeyCharacteristics_cb _hidl_cb) override {
-        return km3_dev_->getKeyCharacteristics(keyBlob, clientId, appData, _hidl_cb);
-    }
-
+                                       getKeyCharacteristics_cb _hidl_cb) override;
     Return<void> importKey(const hidl_vec<KeyParameter>& params, KeyFormat keyFormat,
-                           const hidl_vec<uint8_t>& keyData, importKey_cb _hidl_cb) override {
-        return km3_dev_->importKey(params, keyFormat, keyData, _hidl_cb);
+                           const hidl_vec<uint8_t>& keyData, importKey_cb _hidl_cb) override;
+
+    Return<void> importWrappedKey(const hidl_vec<uint8_t>&, const hidl_vec<uint8_t>&,
+                                  const hidl_vec<uint8_t>&, importWrappedKey_cb _hidl_cb) {
+        _hidl_cb(ErrorCode::UNIMPLEMENTED, {}, {});
+        return Void();
     }
 
     Return<void> exportKey(KeyFormat exportFormat, const hidl_vec<uint8_t>& keyBlob,
                            const hidl_vec<uint8_t>& clientId, const hidl_vec<uint8_t>& appData,
-                           exportKey_cb _hidl_cb) override {
-        return km3_dev_->exportKey(exportFormat, keyBlob, clientId, appData, _hidl_cb);
-    }
-
+                           exportKey_cb _hidl_cb) override;
     Return<void> attestKey(const hidl_vec<uint8_t>& keyToAttest,
                            const hidl_vec<KeyParameter>& attestParams,
-                           attestKey_cb _hidl_cb) override {
-        return km3_dev_->attestKey(keyToAttest, attestParams, _hidl_cb);
-    }
-
+                           attestKey_cb _hidl_cb) override;
     Return<void> upgradeKey(const hidl_vec<uint8_t>& keyBlobToUpgrade,
                             const hidl_vec<KeyParameter>& upgradeParams,
-                            upgradeKey_cb _hidl_cb) override {
-        return km3_dev_->upgradeKey(keyBlobToUpgrade, upgradeParams, _hidl_cb);
-    }
-
-    Return<ErrorCode> deleteKey(const hidl_vec<uint8_t>& keyBlob) override {
-        return km3_dev_->deleteKey(keyBlob);
-    }
-
-    Return<ErrorCode> deleteAllKeys() override { return km3_dev_->deleteAllKeys(); }
-
-    Return<ErrorCode> destroyAttestationIds() override { return km3_dev_->destroyAttestationIds(); }
-
+                            upgradeKey_cb _hidl_cb) override;
+    Return<ErrorCode> deleteKey(const hidl_vec<uint8_t>& keyBlob) override;
+    Return<ErrorCode> deleteAllKeys() override;
+    Return<ErrorCode> destroyAttestationIds() override;
     Return<void> begin(KeyPurpose purpose, const hidl_vec<uint8_t>& key,
-                       const hidl_vec<KeyParameter>& inParams, begin_cb _hidl_cb) override {
-        return km3_dev_->begin(purpose, key, inParams, _hidl_cb);
-    }
-
+                       const hidl_vec<KeyParameter>& inParams, const HardwareAuthToken& authToken,
+                       begin_cb _hidl_cb) override;
     Return<void> update(uint64_t operationHandle, const hidl_vec<KeyParameter>& inParams,
-                        const hidl_vec<uint8_t>& input, update_cb _hidl_cb) override {
-        return km3_dev_->update(operationHandle, inParams, input, _hidl_cb);
-    }
-
+                        const hidl_vec<uint8_t>& input, const HardwareAuthToken& authToken,
+                        const VerificationToken& verificationToken, update_cb _hidl_cb) override;
     Return<void> finish(uint64_t operationHandle, const hidl_vec<KeyParameter>& inParams,
                         const hidl_vec<uint8_t>& input, const hidl_vec<uint8_t>& signature,
-                        finish_cb _hidl_cb) override {
-        return km3_dev_->finish(operationHandle, inParams, input, signature, _hidl_cb);
-    }
-
-    Return<ErrorCode> abort(uint64_t operationHandle) override {
-        return km3_dev_->abort(operationHandle);
-    }
+                        const HardwareAuthToken& authToken,
+                        const VerificationToken& verificationToken, finish_cb _hidl_cb) override;
+    Return<ErrorCode> abort(uint64_t operationHandle) override;
 
   private:
     void getVersionIfNeeded();
@@ -125,6 +116,8 @@
     std::string authorName_;
 };
 
+sp<IKeymaster3Device> makeSoftwareKeymasterDevice();
+
 }  // namespace keystore
 
-#endif  // KEYSTORE_KEYMASTER_3_H_
+#endif  // KEYMASTER_3_DEVICE_WRAPPER_H_
diff --git a/keystore/Keymaster4.h b/keystore/Keymaster4.h
new file mode 100644
index 0000000..867f304
--- /dev/null
+++ b/keystore/Keymaster4.h
@@ -0,0 +1,143 @@
+/*
+ **
+ ** Copyright 2017, The Android Open Source Project
+ **
+ ** Licensed under the Apache License, Version 2.0 (the "License");
+ ** you may not use this file except in compliance with the License.
+ ** You may obtain a copy of the License at
+ **
+ **     http://www.apache.org/licenses/LICENSE-2.0
+ **
+ ** Unless required by applicable law or agreed to in writing, software
+ ** distributed under the License is distributed on an "AS IS" BASIS,
+ ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ ** See the License for the specific language governing permissions and
+ ** limitations under the License.
+ */
+
+#ifndef KEYSTORE_KEYMASTER_4_H_
+#define KEYSTORE_KEYMASTER_4_H_
+
+#include <keystore/keymaster_types.h>
+#include <utils/StrongPointer.h>
+
+#include "Keymaster.h"
+
+namespace keystore {
+
+using android::sp;
+using IKeymaster4Device = ::android::hardware::keymaster::V4_0::IKeymasterDevice;
+
+class Keymaster4 : public Keymaster {
+  public:
+    Keymaster4(sp<IKeymasterDevice> km4_dev) : dev_(km4_dev) {}
+
+    uint8_t halMajorVersion() { return 4; }
+
+    VersionResult halVersion() override { return {ErrorCode::OK, halMajorVersion(), true, true}; }
+
+    Return<void> getHardwareInfo(getHardwareInfo_cb _hidl_cb) override {
+        return dev_->getHardwareInfo(_hidl_cb);
+    }
+
+    Return<void> getHmacSharingParameters(getHmacSharingParameters_cb _hidl_cb) override {
+        return dev_->getHmacSharingParameters(_hidl_cb);
+    }
+
+    Return<void> computeSharedHmac(const hidl_vec<HmacSharingParameters>& params,
+                                   computeSharedHmac_cb _hidl_cb) override {
+        return dev_->computeSharedHmac(params, _hidl_cb);
+    }
+
+    Return<void> verifyAuthorization(uint64_t operationHandle, const hidl_vec<KeyParameter>& params,
+                                     const HardwareAuthToken& authToken,
+                                     verifyAuthorization_cb _hidl_cb) override {
+        return dev_->verifyAuthorization(operationHandle, params, authToken, _hidl_cb);
+    }
+
+    Return<ErrorCode> addRngEntropy(const hidl_vec<uint8_t>& data) override {
+        return dev_->addRngEntropy(data);
+    }
+
+    Return<void> generateKey(const hidl_vec<KeyParameter>& keyParams,
+                             generateKey_cb _hidl_cb) override {
+        return dev_->generateKey(keyParams, _hidl_cb);
+    }
+
+    Return<void> getKeyCharacteristics(const hidl_vec<uint8_t>& keyBlob,
+                                       const hidl_vec<uint8_t>& clientId,
+                                       const hidl_vec<uint8_t>& appData,
+                                       getKeyCharacteristics_cb _hidl_cb) override {
+        return dev_->getKeyCharacteristics(keyBlob, clientId, appData, _hidl_cb);
+    }
+
+    Return<void> importKey(const hidl_vec<KeyParameter>& params, KeyFormat keyFormat,
+                           const hidl_vec<uint8_t>& keyData, importKey_cb _hidl_cb) override {
+        return dev_->importKey(params, keyFormat, keyData, _hidl_cb);
+    }
+
+    Return<void> importWrappedKey(const hidl_vec<uint8_t>& wrappedKeyData,
+                                  const hidl_vec<uint8_t>& wrappingKeyBlob,
+                                  const hidl_vec<uint8_t>& maskingKey,
+                                  importWrappedKey_cb _hidl_cb) {
+        return dev_->importWrappedKey(wrappedKeyData, wrappingKeyBlob, maskingKey, _hidl_cb);
+    }
+
+    Return<void> exportKey(KeyFormat exportFormat, const hidl_vec<uint8_t>& keyBlob,
+                           const hidl_vec<uint8_t>& clientId, const hidl_vec<uint8_t>& appData,
+                           exportKey_cb _hidl_cb) override {
+        return dev_->exportKey(exportFormat, keyBlob, clientId, appData, _hidl_cb);
+    }
+
+    Return<void> attestKey(const hidl_vec<uint8_t>& keyToAttest,
+                           const hidl_vec<KeyParameter>& attestParams,
+                           attestKey_cb _hidl_cb) override {
+        return dev_->attestKey(keyToAttest, attestParams, _hidl_cb);
+    }
+
+    Return<void> upgradeKey(const hidl_vec<uint8_t>& keyBlobToUpgrade,
+                            const hidl_vec<KeyParameter>& upgradeParams,
+                            upgradeKey_cb _hidl_cb) override {
+        return dev_->upgradeKey(keyBlobToUpgrade, upgradeParams, _hidl_cb);
+    }
+
+    Return<ErrorCode> deleteKey(const hidl_vec<uint8_t>& keyBlob) override {
+        return dev_->deleteKey(keyBlob);
+    }
+
+    Return<ErrorCode> deleteAllKeys() override { return dev_->deleteAllKeys(); }
+
+    Return<ErrorCode> destroyAttestationIds() override { return dev_->destroyAttestationIds(); }
+
+    Return<void> begin(KeyPurpose purpose, const hidl_vec<uint8_t>& key,
+                       const hidl_vec<KeyParameter>& inParams, const HardwareAuthToken& authToken,
+                       begin_cb _hidl_cb) override {
+        return dev_->begin(purpose, key, inParams, authToken, _hidl_cb);
+    }
+
+    Return<void> update(uint64_t operationHandle, const hidl_vec<KeyParameter>& inParams,
+                        const hidl_vec<uint8_t>& input, const HardwareAuthToken& authToken,
+                        const VerificationToken& verificationToken, update_cb _hidl_cb) override {
+        return dev_->update(operationHandle, inParams, input, authToken, verificationToken,
+                            _hidl_cb);
+    }
+
+    Return<void> finish(uint64_t operationHandle, const hidl_vec<KeyParameter>& inParams,
+                        const hidl_vec<uint8_t>& input, const hidl_vec<uint8_t>& signature,
+                        const HardwareAuthToken& authToken,
+                        const VerificationToken& verificationToken, finish_cb _hidl_cb) override {
+        return dev_->finish(operationHandle, inParams, input, signature, authToken,
+                            verificationToken, _hidl_cb);
+    }
+
+    Return<ErrorCode> abort(uint64_t operationHandle) override {
+        return dev_->abort(operationHandle);
+    }
+
+  private:
+    sp<IKeymaster4Device> dev_;
+};
+
+}  // namespace keystore
+
+#endif  // KEYSTORE_KEYMASTER_3_H_
diff --git a/keystore/KeymasterArguments.cpp b/keystore/KeymasterArguments.cpp
index 792c831..829156c 100644
--- a/keystore/KeymasterArguments.cpp
+++ b/keystore/KeymasterArguments.cpp
@@ -34,7 +34,7 @@
     return keystore::writeParamSetToParcel(data_, out);
 };
 
-KeymasterArguments::KeymasterArguments(const hardware::hidl_vec<keymaster::KeyParameter>& other)
+KeymasterArguments::KeymasterArguments(const hardware::hidl_vec<keystore::KeyParameter>& other)
     : data_(other) {}
 
 }  // namespace keymaster
diff --git a/keystore/OperationResult.cpp b/keystore/OperationResult.cpp
index f7f33f9..62c957e 100644
--- a/keystore/OperationResult.cpp
+++ b/keystore/OperationResult.cpp
@@ -27,7 +27,7 @@
 namespace security {
 namespace keymaster {
 
-using ::android::hardware::keymaster::V3_0::ErrorCode;
+using keystore::keymaster::ErrorCode;
 using ::android::status_t;
 
 OperationResult::OperationResult() : resultCode(), token(), handle(0), inputConsumed(0), data() {}
diff --git a/keystore/auth_token_table.cpp b/keystore/auth_token_table.cpp
index e54febe..3c51c70 100644
--- a/keystore/auth_token_table.cpp
+++ b/keystore/auth_token_table.cpp
@@ -77,13 +77,12 @@
     return time.tv_sec;
 }
 
-void AuthTokenTable::AddAuthenticationToken(std::unique_ptr<const HardwareAuthToken>&& auth_token) {
+void AuthTokenTable::AddAuthenticationToken(HardwareAuthToken&& auth_token) {
     Entry new_entry(std::move(auth_token), clock_function_());
-    //STOPSHIP: debug only, to be removed
-    ALOGD("AddAuthenticationToken: timestamp = %llu (%llu), time_received = %lld",
-        static_cast<unsigned long long>(new_entry.timestamp_host_order()),
-        static_cast<unsigned long long>(new_entry.token().timestamp),
-        static_cast<long long>(new_entry.time_received()));
+    // STOPSHIP: debug only, to be removed
+    ALOGD("AddAuthenticationToken: timestamp = %llu, time_received = %lld",
+          static_cast<unsigned long long>(new_entry.token().timestamp),
+          static_cast<long long>(new_entry.time_received()));
 
     RemoveEntriesSupersededBy(new_entry);
     if (entries_.size() >= max_entries_) {
@@ -95,10 +94,8 @@
 }
 
 inline bool is_secret_key_operation(Algorithm algorithm, KeyPurpose purpose) {
-    if ((algorithm != Algorithm::RSA && algorithm != Algorithm::EC))
-        return true;
-    if (purpose == KeyPurpose::SIGN || purpose == KeyPurpose::DECRYPT)
-        return true;
+    if ((algorithm != Algorithm::RSA && algorithm != Algorithm::EC)) return true;
+    if (purpose == KeyPurpose::SIGN || purpose == KeyPurpose::DECRYPT) return true;
     return false;
 }
 
@@ -211,26 +208,15 @@
     if (IsSupersededBySomeEntry(*found)) entries_.erase(found);
 }
 
-AuthTokenTable::Entry::Entry(std::unique_ptr<const HardwareAuthToken>&& token, time_t current_time)
+AuthTokenTable::Entry::Entry(HardwareAuthToken&& token, time_t current_time)
     : token_(std::move(token)), time_received_(current_time), last_use_(current_time),
-      operation_completed_(token_->challenge == 0) {}
-
-uint64_t AuthTokenTable::Entry::timestamp_host_order() const {
-    return ntoh(token_->timestamp);
-}
-
-HardwareAuthenticatorType AuthTokenTable::Entry::authenticator_type() const {
-    HardwareAuthenticatorType result = static_cast<HardwareAuthenticatorType>(
-        ntoh(static_cast<uint32_t>(token_->authenticatorType)));
-    return result;
-}
+      operation_completed_(token_.challenge == 0) {}
 
 bool AuthTokenTable::Entry::SatisfiesAuth(const std::vector<uint64_t>& sids,
                                           HardwareAuthenticatorType auth_type) {
-    for (auto sid : sids)
-        if ((sid == token_->authenticatorId) ||
-            (sid == token_->userId && (auth_type & authenticator_type()) != 0))
-            return true;
+    for (auto sid : sids) {
+        if (SatisfiesAuth(sid, auth_type)) return true;
+    }
     return false;
 }
 
@@ -241,10 +227,9 @@
 bool AuthTokenTable::Entry::Supersedes(const Entry& entry) const {
     if (!entry.completed()) return false;
 
-    return (token_->userId == entry.token_->userId &&
-            token_->authenticatorType == entry.token_->authenticatorType &&
-            token_->authenticatorId == entry.token_->authenticatorId &&
-            is_newer_than(&entry));
+    return (token_.userId == entry.token_.userId &&
+            token_.authenticatorType == entry.token_.authenticatorType &&
+            token_.authenticatorId == entry.token_.authenticatorId && is_newer_than(&entry));
 }
 
-}  // namespace keymaster
+}  // namespace keystore
diff --git a/keystore/auth_token_table.h b/keystore/auth_token_table.h
index 3e3ff6e..0a23c99 100644
--- a/keystore/auth_token_table.h
+++ b/keystore/auth_token_table.h
@@ -18,13 +18,14 @@
 #include <vector>
 
 #include <keystore/authorization_set.h>
+#include <keystore/keymaster_types.h>
 
 #ifndef KEYSTORE_AUTH_TOKEN_TABLE_H_
 #define KEYSTORE_AUTH_TOKEN_TABLE_H_
 
 namespace keystore {
 
-using android::hardware::keymaster::V3_0::HardwareAuthToken;
+using keymaster::HardwareAuthToken;
 
 namespace test {
 class AuthTokenTableTest;
@@ -60,7 +61,7 @@
     /**
      * Add an authorization token to the table.  The table takes ownership of the argument.
      */
-    void AddAuthenticationToken(std::unique_ptr<const HardwareAuthToken>&& auth_token);
+    void AddAuthenticationToken(HardwareAuthToken&& auth_token);
 
     /**
      * Find an authorization token that authorizes the operation specified by \p operation_handle on
@@ -96,7 +97,7 @@
 
     class Entry {
       public:
-        Entry(std::unique_ptr<const HardwareAuthToken>&& token, time_t current_time);
+        Entry(HardwareAuthToken&& token, time_t current_time);
         Entry(Entry&& entry) { *this = std::move(entry); }
 
         void operator=(Entry&& rhs) {
@@ -115,8 +116,8 @@
 
         bool is_newer_than(const Entry* entry) const {
             if (!entry) return true;
-            uint64_t ts = timestamp_host_order();
-            uint64_t other_ts = entry->timestamp_host_order();
+            uint64_t ts = token_.timestamp;
+            uint64_t other_ts = entry->token_.timestamp;
             // Normally comparing timestamp_host_order alone is sufficient, but here is an
             // additional hack to compare time_received value for some devices where their auth
             // tokens contain fixed timestamp (due to the a stuck secure RTC on them)
@@ -126,14 +127,17 @@
 
         void mark_completed() { operation_completed_ = true; }
 
-        const HardwareAuthToken& token() { return *token_.get(); }
+        const HardwareAuthToken& token() const & { return token_; }
         time_t time_received() const { return time_received_; }
         bool completed() const { return operation_completed_; }
-        uint64_t timestamp_host_order() const;
-        HardwareAuthenticatorType authenticator_type() const;
 
       private:
-        std::unique_ptr<const HardwareAuthToken> token_;
+        bool SatisfiesAuth(uint64_t sid, HardwareAuthenticatorType auth_type) const {
+            return (sid == token_.userId || sid == token_.authenticatorId) &&
+                   (auth_type & token_.authenticatorType) != 0;
+        }
+
+        HardwareAuthToken token_;
         time_t time_received_;
         time_t last_use_;
         bool operation_completed_;
@@ -155,6 +159,6 @@
     time_t (*clock_function_)();
 };
 
-}  // namespace keymaster
+}  // namespace keystore
 
 #endif  // KEYSTORE_AUTH_TOKEN_TABLE_H_
diff --git a/keystore/include/keystore/KeyCharacteristics.h b/keystore/include/keystore/KeyCharacteristics.h
index ddb1208..7fc89c6 100644
--- a/keystore/include/keystore/KeyCharacteristics.h
+++ b/keystore/include/keystore/KeyCharacteristics.h
@@ -18,25 +18,24 @@
 #include <binder/Parcelable.h>
 
 #include "KeymasterArguments.h"
+#include "keymaster_types.h"
 
 namespace android {
 namespace security {
 namespace keymaster {
 
-using hardware::keymaster::V3_0::KeyParameter;
-
-// Parcelable version of hardware::keymaster::V3_0::KeyCharacteristics
+// Parcelable version of keystore::KeyCharacteristics
 struct KeyCharacteristics : public ::android::Parcelable {
     KeyCharacteristics(){};
-    explicit KeyCharacteristics(const android::hardware::keymaster::V3_0::KeyCharacteristics& other) {
+    explicit KeyCharacteristics(const keystore::KeyCharacteristics& other) {
         softwareEnforced = KeymasterArguments(other.softwareEnforced);
-        teeEnforced = KeymasterArguments(other.teeEnforced);
+        hardwareEnforced = KeymasterArguments(other.hardwareEnforced);
     }
     status_t readFromParcel(const Parcel* in) override;
     status_t writeToParcel(Parcel* out) const override;
 
     KeymasterArguments softwareEnforced;
-    KeymasterArguments teeEnforced;
+    KeymasterArguments hardwareEnforced;
 };
 
 }  // namespace keymaster
diff --git a/keystore/include/keystore/KeymasterArguments.h b/keystore/include/keystore/KeymasterArguments.h
index 3f35a91..329579a 100644
--- a/keystore/include/keystore/KeymasterArguments.h
+++ b/keystore/include/keystore/KeymasterArguments.h
@@ -23,20 +23,18 @@
 namespace security {
 namespace keymaster {
 
-using hardware::keymaster::V3_0::KeyParameter;
-
-// struct for serializing/deserializing a list of KeyParameter's
+// struct for serializing/deserializing a list of KeyParameters
 struct KeymasterArguments : public Parcelable {
     KeymasterArguments(){};
-    explicit KeymasterArguments(const hardware::hidl_vec<KeyParameter>& other);
+    explicit KeymasterArguments(const hardware::hidl_vec<keystore::KeyParameter>& other);
 
     status_t readFromParcel(const Parcel* in) override;
     status_t writeToParcel(Parcel* out) const override;
 
-    const inline hardware::hidl_vec<KeyParameter>& getParameters() const { return data_; }
+    const inline hardware::hidl_vec<keystore::KeyParameter>& getParameters() const { return data_; }
 
   private:
-    hardware::hidl_vec<KeyParameter> data_;
+    hardware::hidl_vec<keystore::KeyParameter> data_;
 };
 
 }  // namespace keymaster
diff --git a/keystore/include/keystore/KeystoreArguments.h b/keystore/include/keystore/KeystoreArguments.h
index 8c2e336..c0a8b0a 100644
--- a/keystore/include/keystore/KeystoreArguments.h
+++ b/keystore/include/keystore/KeystoreArguments.h
@@ -17,6 +17,7 @@
 
 #include <binder/Parcelable.h>
 #include <utils/RefBase.h>
+#include <utils/Vector.h>
 
 #include "KeystoreArg.h"
 #include "keystore_return_types.h"
diff --git a/keystore/include/keystore/keymaster_tags.h b/keystore/include/keystore/keymaster_tags.h
index 1b3e71b..6d2048a 100644
--- a/keystore/include/keystore/keymaster_tags.h
+++ b/keystore/include/keystore/keymaster_tags.h
@@ -62,26 +62,36 @@
 #include <android/hardware/keymaster/3.0/IHwKeymasterDevice.h>
 #include <type_traits>
 
+#include "keymaster_types.h"
+
 namespace keystore {
 
-using ::android::hardware::keymaster::V3_0::Algorithm;
-using ::android::hardware::keymaster::V3_0::BlockMode;
-using ::android::hardware::keymaster::V3_0::Digest;
-using ::android::hardware::keymaster::V3_0::EcCurve;
-using ::android::hardware::keymaster::V3_0::ErrorCode;
-using ::android::hardware::keymaster::V3_0::HardwareAuthToken;
-using ::android::hardware::keymaster::V3_0::HardwareAuthenticatorType;
-using ::android::hardware::keymaster::V3_0::IKeymasterDevice;
-using ::android::hardware::keymaster::V3_0::KeyBlobUsageRequirements;
-using ::android::hardware::keymaster::V3_0::KeyCharacteristics;
-using ::android::hardware::keymaster::V3_0::KeyDerivationFunction;
-using ::android::hardware::keymaster::V3_0::KeyFormat;
-using ::android::hardware::keymaster::V3_0::KeyOrigin;
-using ::android::hardware::keymaster::V3_0::KeyParameter;
-using ::android::hardware::keymaster::V3_0::KeyPurpose;
-using ::android::hardware::keymaster::V3_0::PaddingMode;
-using ::android::hardware::keymaster::V3_0::Tag;
-using ::android::hardware::keymaster::V3_0::TagType;
+// This namespace alias is temporary.  This file will be removed in favor of the KM4 support
+// library version.
+namespace oldkeymaster = android::hardware::keymaster::V3_0;
+
+using keymaster::ErrorCode;
+using keymaster::HardwareAuthToken;
+using keymaster::HmacSharingParameters;
+using keymaster::IKeymasterDevice;
+using keymaster::KeyCharacteristics;
+using keymaster::KeyOrigin;
+using keymaster::KeyParameter;
+using keymaster::KeyPurpose;
+using keymaster::OperationHandle;
+using keymaster::SecurityLevel;
+using keymaster::Tag;
+using keymaster::VerificationToken;
+using oldkeymaster::Algorithm;
+using oldkeymaster::BlockMode;
+using oldkeymaster::Digest;
+using oldkeymaster::EcCurve;
+using oldkeymaster::HardwareAuthenticatorType;
+using oldkeymaster::KeyBlobUsageRequirements;
+using oldkeymaster::KeyDerivationFunction;
+using oldkeymaster::KeyFormat;
+using oldkeymaster::PaddingMode;
+using oldkeymaster::TagType;
 
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
@@ -131,28 +141,23 @@
 DECLARE_TYPED_TAG(CALLER_NONCE);
 DECLARE_TYPED_TAG(MIN_MAC_LENGTH);
 DECLARE_TYPED_TAG(RSA_PUBLIC_EXPONENT);
-DECLARE_TYPED_TAG(ECIES_SINGLE_HASH_MODE);
 DECLARE_TYPED_TAG(INCLUDE_UNIQUE_ID);
 DECLARE_TYPED_TAG(ACTIVE_DATETIME);
 DECLARE_TYPED_TAG(ORIGINATION_EXPIRE_DATETIME);
 DECLARE_TYPED_TAG(USAGE_EXPIRE_DATETIME);
 DECLARE_TYPED_TAG(MIN_SECONDS_BETWEEN_OPS);
 DECLARE_TYPED_TAG(MAX_USES_PER_BOOT);
-DECLARE_TYPED_TAG(ALL_USERS);
-DECLARE_TYPED_TAG(USER_ID);
 DECLARE_TYPED_TAG(USER_SECURE_ID);
 DECLARE_TYPED_TAG(NO_AUTH_REQUIRED);
 DECLARE_TYPED_TAG(AUTH_TIMEOUT);
 DECLARE_TYPED_TAG(ALLOW_WHILE_ON_BODY);
-DECLARE_TYPED_TAG(ALL_APPLICATIONS);
 DECLARE_TYPED_TAG(APPLICATION_ID);
 DECLARE_TYPED_TAG(APPLICATION_DATA);
 DECLARE_TYPED_TAG(CREATION_DATETIME);
-DECLARE_TYPED_TAG(ROLLBACK_RESISTANT);
+DECLARE_TYPED_TAG(ROLLBACK_RESISTANCE);
 DECLARE_TYPED_TAG(ROOT_OF_TRUST);
 DECLARE_TYPED_TAG(ASSOCIATED_DATA);
 DECLARE_TYPED_TAG(NONCE);
-DECLARE_TYPED_TAG(AUTH_TOKEN);
 DECLARE_TYPED_TAG(BOOTLOADER_ONLY);
 DECLARE_TYPED_TAG(OS_VERSION);
 DECLARE_TYPED_TAG(OS_PATCHLEVEL);
@@ -169,23 +174,21 @@
 DECLARE_TYPED_TAG(BLOB_USAGE_REQUIREMENTS);
 DECLARE_TYPED_TAG(ORIGIN);
 DECLARE_TYPED_TAG(USER_AUTH_TYPE);
-DECLARE_TYPED_TAG(KDF);
 DECLARE_TYPED_TAG(EC_CURVE);
 
 template <typename... Elems> struct MetaList {};
 
 using all_tags_t = MetaList<
     TAG_INVALID_t, TAG_KEY_SIZE_t, TAG_MAC_LENGTH_t, TAG_CALLER_NONCE_t, TAG_MIN_MAC_LENGTH_t,
-    TAG_RSA_PUBLIC_EXPONENT_t, TAG_ECIES_SINGLE_HASH_MODE_t, TAG_INCLUDE_UNIQUE_ID_t,
-    TAG_ACTIVE_DATETIME_t, TAG_ORIGINATION_EXPIRE_DATETIME_t, TAG_USAGE_EXPIRE_DATETIME_t,
-    TAG_MIN_SECONDS_BETWEEN_OPS_t, TAG_MAX_USES_PER_BOOT_t, TAG_ALL_USERS_t, TAG_USER_ID_t,
-    TAG_USER_SECURE_ID_t, TAG_NO_AUTH_REQUIRED_t, TAG_AUTH_TIMEOUT_t, TAG_ALLOW_WHILE_ON_BODY_t,
-    TAG_ALL_APPLICATIONS_t, TAG_APPLICATION_ID_t, TAG_APPLICATION_DATA_t, TAG_CREATION_DATETIME_t,
-    TAG_ROLLBACK_RESISTANT_t, TAG_ROOT_OF_TRUST_t, TAG_ASSOCIATED_DATA_t, TAG_NONCE_t,
-    TAG_AUTH_TOKEN_t, TAG_BOOTLOADER_ONLY_t, TAG_OS_VERSION_t, TAG_OS_PATCHLEVEL_t, TAG_UNIQUE_ID_t,
+    TAG_RSA_PUBLIC_EXPONENT_t, TAG_INCLUDE_UNIQUE_ID_t, TAG_ACTIVE_DATETIME_t,
+    TAG_ORIGINATION_EXPIRE_DATETIME_t, TAG_USAGE_EXPIRE_DATETIME_t, TAG_MIN_SECONDS_BETWEEN_OPS_t,
+    TAG_MAX_USES_PER_BOOT_t, TAG_USER_SECURE_ID_t, TAG_NO_AUTH_REQUIRED_t, TAG_AUTH_TIMEOUT_t,
+    TAG_ALLOW_WHILE_ON_BODY_t, TAG_APPLICATION_ID_t, TAG_APPLICATION_DATA_t,
+    TAG_CREATION_DATETIME_t, TAG_ROLLBACK_RESISTANCE_t, TAG_ROOT_OF_TRUST_t, TAG_ASSOCIATED_DATA_t,
+    TAG_NONCE_t, TAG_BOOTLOADER_ONLY_t, TAG_OS_VERSION_t, TAG_OS_PATCHLEVEL_t, TAG_UNIQUE_ID_t,
     TAG_ATTESTATION_CHALLENGE_t, TAG_ATTESTATION_APPLICATION_ID_t, TAG_RESET_SINCE_ID_ROTATION_t,
     TAG_PURPOSE_t, TAG_ALGORITHM_t, TAG_BLOCK_MODE_t, TAG_DIGEST_t, TAG_PADDING_t,
-    TAG_BLOB_USAGE_REQUIREMENTS_t, TAG_ORIGIN_t, TAG_USER_AUTH_TYPE_t, TAG_KDF_t, TAG_EC_CURVE_t>;
+    TAG_BLOB_USAGE_REQUIREMENTS_t, TAG_ORIGIN_t, TAG_USER_AUTH_TYPE_t, TAG_EC_CURVE_t>;
 
 /* implementation in keystore_utils.cpp */
 extern const char* stringifyTag(Tag tag);
@@ -234,7 +237,6 @@
 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_BLOCK_MODE, f.blockMode)
 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_DIGEST, f.digest)
 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_EC_CURVE, f.ecCurve)
-MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_KDF, f.keyDerivationFunction)
 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_ORIGIN, f.origin)
 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_PADDING, f.paddingMode)
 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_PURPOSE, f.purpose)
@@ -345,6 +347,6 @@
     return accessTagValue(ttag, param);
 }
 
-}  // namespace keymaster
+}  // namespace keystore
 
 #endif  // SYSTEM_SECURITY_KEYSTORE_KEYMASTER_TAGS_H_
diff --git a/keystore/include/keystore/keymaster_types.h b/keystore/include/keystore/keymaster_types.h
index 14ab059..272105f 100644
--- a/keystore/include/keystore/keymaster_types.h
+++ b/keystore/include/keystore/keymaster_types.h
@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
-#include <android/hardware/keymaster/3.0/types.h>
+#include <android/hardware/keymaster/4.0/IKeymasterDevice.h>
+#include <android/hardware/keymaster/4.0/types.h>
 
 /**
  * This header lifts the types from the current Keymaster version into the keystore namespace.
@@ -21,9 +21,13 @@
 
 namespace keystore {
 
-namespace keymaster = ::android::hardware::keymaster::V3_0;
+namespace keymaster = ::android::hardware::keymaster::V4_0;
 
 using keymaster::IKeymasterDevice;
 using keymaster::SecurityLevel;
 
+using Km3HardwareAuthToken = ::android::hardware::keymaster::V3_0::HardwareAuthToken;
+using Km3HardwareAuthenticatorType =
+    ::android::hardware::keymaster::V3_0::HardwareAuthenticatorType;
+
 }  // namespace keystore
diff --git a/keystore/include/keystore/keystore_hidl_support.h b/keystore/include/keystore/keystore_hidl_support.h
index 0edaa3b..944c3f6 100644
--- a/keystore/include/keystore/keystore_hidl_support.h
+++ b/keystore/include/keystore/keystore_hidl_support.h
@@ -18,14 +18,17 @@
 #ifndef KEYSTORE_KEYSTORE_HIDL_SUPPORT_H_
 #define KEYSTORE_KEYSTORE_HIDL_SUPPORT_H_
 
-#include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
-#include <hardware/hw_auth_token.h>
-#include <hidl/Status.h>
-#include <keystore/keymaster_tags.h>
 #include <ostream>
 #include <sstream>
 #include <string>
 
+#include <android-base/logging.h>
+#include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
+#include <hardware/hw_auth_token.h>
+#include <hidl/Status.h>
+
+#include <keystore/keymaster_tags.h>
+
 namespace keystore {
 
 inline static std::ostream& formatArgs(std::ostream& out) {
@@ -98,14 +101,16 @@
     return std::copy(value_ptr, value_ptr + sizeof(value), dest);
 }
 
-inline static hidl_vec<uint8_t> authToken2HidlVec(const HardwareAuthToken& token) {
-    static_assert(
-        std::is_same<decltype(token.hmac), ::android::hardware::hidl_array<uint8_t, 32>>::value,
-        "This function assumes token HMAC is 32 bytes, but it might not be.");
+constexpr size_t kHmacSize = 32;
+
+inline static hidl_vec<uint8_t> authToken2HidlVec(const Km3HardwareAuthToken& token) {
+    static_assert(std::is_same<decltype(token.hmac),
+                               ::android::hardware::hidl_array<uint8_t, kHmacSize>>::value,
+                  "This function assumes token HMAC is 32 bytes, but it might not be.");
     static_assert(1 /* version size */ + sizeof(token.challenge) + sizeof(token.userId) +
                           sizeof(token.authenticatorId) + sizeof(token.authenticatorType) +
-                          sizeof(token.timestamp) + 32 /* HMAC size */
-                      == sizeof(hw_auth_token_t),
+                          sizeof(token.timestamp) + kHmacSize ==
+                      sizeof(hw_auth_token_t),
                   "HardwareAuthToken content size does not match hw_auth_token_t size");
 
     hidl_vec<uint8_t> result;
@@ -129,21 +134,21 @@
     return src + sizeof(T);
 }
 
-inline static HardwareAuthToken hidlVec2AuthToken(const hidl_vec<uint8_t>& buffer) {
-    HardwareAuthToken token;
-    static_assert(
-        std::is_same<decltype(token.hmac), ::android::hardware::hidl_array<uint8_t, 32>>::value,
-        "This function assumes token HMAC is 32 bytes, but it might not be.");
+inline static Km3HardwareAuthToken hidlVec2Km3AuthToken(const hidl_vec<uint8_t>& buffer) {
+    Km3HardwareAuthToken token;
+    static_assert(std::is_same<decltype(token.hmac),
+                               ::android::hardware::hidl_array<uint8_t, kHmacSize>>::value,
+                  "This function assumes token HMAC is 32 bytes, but it might not be.");
     static_assert(1 /* version size */ + sizeof(token.challenge) + sizeof(token.userId) +
                           sizeof(token.authenticatorId) + sizeof(token.authenticatorType) +
-                          sizeof(token.timestamp) + 32 /* HMAC size */
-                      == sizeof(hw_auth_token_t),
+                          sizeof(token.timestamp) + kHmacSize ==
+                      sizeof(hw_auth_token_t),
                   "HardwareAuthToken content size does not match hw_auth_token_t size");
 
     if (buffer.size() != sizeof(hw_auth_token_t)) return {};
 
     auto pos = buffer.begin();
-    ++pos; // skip first byte
+    ++pos;  // skip first byte
     pos = copy_bytes_from_iterator(&token.challenge, pos);
     pos = copy_bytes_from_iterator(&token.userId, pos);
     pos = copy_bytes_from_iterator(&token.authenticatorId, pos);
@@ -154,6 +159,59 @@
     return token;
 }
 
+inline static hidl_vec<uint8_t> authToken2HidlVec(const HardwareAuthToken& token) {
+    static_assert(1 /* version size */ + sizeof(token.challenge) + sizeof(token.userId) +
+                          sizeof(token.authenticatorId) + sizeof(token.authenticatorType) +
+                          sizeof(token.timestamp) + kHmacSize ==
+                      sizeof(hw_auth_token_t),
+                  "HardwareAuthToken content size does not match hw_auth_token_t size");
+
+    hidl_vec<uint8_t> result;
+    result.resize(sizeof(hw_auth_token_t));
+    auto pos = result.begin();
+    *pos++ = 0;  // Version byte
+    pos = copy_bytes_to_iterator(token.challenge, pos);
+    pos = copy_bytes_to_iterator(token.userId, pos);
+    pos = copy_bytes_to_iterator(token.authenticatorId, pos);
+    auto auth_type = htonl(static_cast<uint32_t>(token.authenticatorType));
+    pos = copy_bytes_to_iterator(auth_type, pos);
+    auto timestamp = htonq(token.timestamp);
+    pos = copy_bytes_to_iterator(timestamp, pos);
+    if (token.mac.size() != kHmacSize) {
+        std::fill(pos, pos + kHmacSize, 0);
+    } else {
+        std::copy(token.mac.begin(), token.mac.end(), pos);
+    }
+
+    return result;
+}
+
+inline static HardwareAuthToken hidlVec2AuthToken(const hidl_vec<uint8_t>& buffer) {
+    HardwareAuthToken token;
+    static_assert(1 /* version size */ + sizeof(token.challenge) + sizeof(token.userId) +
+                          sizeof(token.authenticatorId) + sizeof(token.authenticatorType) +
+                          sizeof(token.timestamp) + kHmacSize ==
+                      sizeof(hw_auth_token_t),
+                  "HardwareAuthToken content size does not match hw_auth_token_t size");
+
+    if (buffer.size() != sizeof(hw_auth_token_t)) return {};
+
+    auto pos = buffer.begin();
+    ++pos;  // skip first byte
+    pos = copy_bytes_from_iterator(&token.challenge, pos);
+    pos = copy_bytes_from_iterator(&token.userId, pos);
+    pos = copy_bytes_from_iterator(&token.authenticatorId, pos);
+    pos = copy_bytes_from_iterator(&token.authenticatorType, pos);
+    token.authenticatorType = static_cast<HardwareAuthenticatorType>(
+        ntohl(static_cast<uint32_t>(token.authenticatorType)));
+    pos = copy_bytes_from_iterator(&token.timestamp, pos);
+    token.timestamp = ntohq(token.timestamp);
+    token.mac.resize(kHmacSize);
+    std::copy(pos, pos + kHmacSize, token.mac.data());
+
+    return token;
+}
+
 inline std::string hidlVec2String(const hidl_vec<uint8_t>& value) {
     return std::string(reinterpret_cast<const std::string::value_type*>(&value[0]), value.size());
 }
diff --git a/keystore/include/keystore/keystore_return_types.h b/keystore/include/keystore/keystore_return_types.h
index 52d700a..fa4a224 100644
--- a/keystore/include/keystore/keystore_return_types.h
+++ b/keystore/include/keystore/keystore_return_types.h
@@ -18,12 +18,12 @@
 #ifndef KEYSTORE_INCLUDE_KEYSTORE_KEYSTORE_RETURN_TYPES_H_
 #define KEYSTORE_INCLUDE_KEYSTORE_KEYSTORE_RETURN_TYPES_H_
 
+#include "keymaster_types.h"
 #include "keystore.h"
-#include <android/hardware/keymaster/3.0/IHwKeymasterDevice.h>
 
 namespace keystore {
 
-using ::android::hardware::keymaster::V3_0::ErrorCode;
+using keymaster::ErrorCode;
 
 class KeyStoreServiceReturnCode;
 class KeyStoreNativeReturnCode;
diff --git a/keystore/key_store_service.cpp b/keystore/key_store_service.cpp
index 9459520..137ab48 100644
--- a/keystore/key_store_service.cpp
+++ b/keystore/key_store_service.cpp
@@ -1172,16 +1172,12 @@
     return Status::ok();
 }
 
-static inline void addAuthTokenToParams(AuthorizationSet* params, const HardwareAuthToken* token) {
-    if (token) {
-        params->push_back(TAG_AUTH_TOKEN, authToken2HidlVec(*token));
-    }
-}
-
 Status KeyStoreService::begin(const sp<IBinder>& appToken, const String16& name, int32_t purpose,
                               bool pruneable, const KeymasterArguments& params,
                               const ::std::vector<uint8_t>& entropy, int32_t uid,
                               OperationResult* result) {
+    auto keyPurpose = static_cast<KeyPurpose>(purpose);
+
     uid_t callingUid = IPCThreadState::self()->getCallingUid();
     uid_t targetUid = getEffectiveUid(uid);
     if (!is_granted_to(callingUid, targetUid)) {
@@ -1198,15 +1194,14 @@
         result->resultCode = ErrorCode::INVALID_ARGUMENT;
         return Status::ok();
     }
+
     Blob keyBlob;
     String8 name8(name);
     result->resultCode = mKeyStore->getKeyForName(&keyBlob, name8, targetUid, TYPE_KEYMASTER_10);
     if (result->resultCode == ResponseCode::LOCKED && keyBlob.isSuperEncrypted()) {
         result->resultCode = ErrorCode::KEY_USER_NOT_AUTHENTICATED;
     }
-    if (!result->resultCode.isOk()) {
-        return Status::ok();
-    }
+    if (!result->resultCode.isOk()) return Status::ok();
 
     auto key = blob2hidlVec(keyBlob);
     auto& dev = mKeyStore->getDevice(keyBlob);
@@ -1226,8 +1221,6 @@
         return Status::ok();
     }
 
-    const HardwareAuthToken* authToken = NULL;
-
     // Merge these characteristics with the ones cached when the key was generated or imported
     Blob charBlob;
     AuthorizationSet persistedCharacteristics;
@@ -1245,13 +1238,17 @@
 
     // Replace the sw_enforced set with those persisted to disk, minus hw_enforced
     AuthorizationSet softwareEnforced = characteristics.softwareEnforced;
-    AuthorizationSet teeEnforced = characteristics.teeEnforced;
+    AuthorizationSet hardwareEnforced = characteristics.hardwareEnforced;
     persistedCharacteristics.Union(softwareEnforced);
-    persistedCharacteristics.Subtract(teeEnforced);
+    persistedCharacteristics.Subtract(hardwareEnforced);
     characteristics.softwareEnforced = persistedCharacteristics.hidl_data();
 
-    auto authResult = getAuthToken(characteristics, 0, KeyPurpose(purpose), &authToken,
-                                   /*failOnTokenMissing*/ false);
+    KeyStoreServiceReturnCode authResult;
+    HardwareAuthToken authToken;
+    std::tie(authResult, authToken) =
+        getAuthToken(characteristics, 0 /* no challenge */, keyPurpose,
+                     /*failOnTokenMissing*/ false);
+
     // If per-operation auth is needed we need to begin the operation and
     // the client will need to authorize that operation before calling
     // update. Any other auth issues stop here.
@@ -1260,8 +1257,6 @@
         return Status::ok();
     }
 
-    addAuthTokenToParams(&opParams, authToken);
-
     // Add entropy to the device first.
     if (entropy.size()) {
         int32_t resultCode;
@@ -1281,12 +1276,12 @@
     }
 
     // Check that all key authorization policy requirements are met.
-    AuthorizationSet key_auths = characteristics.teeEnforced;
-    key_auths.append(&characteristics.softwareEnforced[0],
-                     &characteristics.softwareEnforced[characteristics.softwareEnforced.size()]);
+    AuthorizationSet key_auths = characteristics.hardwareEnforced;
+    key_auths.append(characteristics.softwareEnforced.begin(),
+                     characteristics.softwareEnforced.end());
 
     result->resultCode =
-        enforcement_policy.AuthorizeOperation(KeyPurpose(purpose), keyid, key_auths, opParams,
+        enforcement_policy.AuthorizeOperation(keyPurpose, keyid, key_auths, opParams, authToken,
                                               0 /* op_handle */, true /* is_begin_operation */);
     if (!result->resultCode.isOk()) {
         return Status::ok();
@@ -1312,7 +1307,7 @@
     };
 
     ErrorCode rc =
-        KS_HANDLE_HIDL_ERROR(dev->begin(KeyPurpose(purpose), key, opParams.hidl_data(), hidlCb));
+        KS_HANDLE_HIDL_ERROR(dev->begin(keyPurpose, key, opParams.hidl_data(), authToken, hidlCb));
     if (rc != ErrorCode::OK) {
         ALOGW("Got error %d from begin()", rc);
     }
@@ -1325,7 +1320,7 @@
             break;
         }
         rc = KS_HANDLE_HIDL_ERROR(
-            dev->begin(KeyPurpose(purpose), key, opParams.hidl_data(), hidlCb));
+            dev->begin(keyPurpose, key, opParams.hidl_data(), authToken, hidlCb));
     }
     if (rc != ErrorCode::OK) {
         result->resultCode = rc;
@@ -1334,16 +1329,14 @@
 
     // Note: The operation map takes possession of the contents of "characteristics".
     // It is safe to use characteristics after the following line but it will be empty.
-    sp<IBinder> operationToken =
-        mOperationMap.addOperation(result->handle, keyid, KeyPurpose(purpose), dev, appToken,
-                                   std::move(characteristics), pruneable);
-    assert(characteristics.teeEnforced.size() == 0);
+    sp<IBinder> operationToken = mOperationMap.addOperation(
+        result->handle, keyid, keyPurpose, dev, appToken, std::move(characteristics), pruneable);
+    assert(characteristics.hardwareEnforced.size() == 0);
     assert(characteristics.softwareEnforced.size() == 0);
     result->token = operationToken;
 
-    if (authToken) {
-        mOperationMap.setOperationAuthToken(operationToken, *authToken);
-    }
+    mOperationMap.setOperationAuthToken(operationToken, std::move(authToken));
+
     // Return the authentication lookup result. If this is a per operation
     // auth'd key then the resultCode will be ::OP_AUTH_NEEDED and the
     // application should get an auth token using the handle before the
@@ -1371,17 +1364,18 @@
     }
     const auto& op = getOpResult.value();
 
-    AuthorizationSet opParams = params.getParameters();
-    result->resultCode = addOperationAuthTokenIfNeeded(token, &opParams);
+    HardwareAuthToken authToken;
+    std::tie(result->resultCode, authToken) = getOperationAuthTokenIfNeeded(token);
     if (!result->resultCode.isOk()) return Status::ok();
 
     // Check that all key authorization policy requirements are met.
-    AuthorizationSet key_auths(op.characteristics.teeEnforced);
+    AuthorizationSet key_auths(op.characteristics.hardwareEnforced);
     key_auths.append(op.characteristics.softwareEnforced.begin(),
                      op.characteristics.softwareEnforced.end());
 
     result->resultCode = enforcement_policy.AuthorizeOperation(
-        op.purpose, op.keyid, key_auths, opParams, op.handle, false /* is_begin_operation */);
+        op.purpose, op.keyid, key_auths, params.getParameters(), authToken, op.handle,
+        false /* is_begin_operation */);
     if (!result->resultCode.isOk()) return Status::ok();
 
     auto hidlCb = [&](ErrorCode ret, uint32_t inputConsumed,
@@ -1395,8 +1389,8 @@
         }
     };
 
-    KeyStoreServiceReturnCode rc =
-        KS_HANDLE_HIDL_ERROR(op.device->update(op.handle, opParams.hidl_data(), data, hidlCb));
+    KeyStoreServiceReturnCode rc = KS_HANDLE_HIDL_ERROR(op.device->update(
+        op.handle, params.getParameters(), data, authToken, VerificationToken(), hidlCb));
 
     // just a reminder: on success result->resultCode was set in the callback. So we only overwrite
     // it if there was a communication error indicated by the ErrorCode.
@@ -1419,8 +1413,8 @@
         return Status::ok();
     }
 
-    AuthorizationSet opParams = params.getParameters();
-    result->resultCode = addOperationAuthTokenIfNeeded(token, &opParams);
+    HardwareAuthToken authToken;
+    std::tie(result->resultCode, authToken) = getOperationAuthTokenIfNeeded(token);
     if (!result->resultCode.isOk()) return Status::ok();
 
     if (entropy.size()) {
@@ -1433,12 +1427,13 @@
     }
 
     // Check that all key authorization policy requirements are met.
-    AuthorizationSet key_auths(op.characteristics.teeEnforced);
+    AuthorizationSet key_auths(op.characteristics.hardwareEnforced);
     key_auths.append(op.characteristics.softwareEnforced.begin(),
                      op.characteristics.softwareEnforced.end());
 
     result->resultCode = enforcement_policy.AuthorizeOperation(
-        op.purpose, op.keyid, key_auths, opParams, op.handle, false /* is_begin_operation */);
+        op.purpose, op.keyid, key_auths, params.getParameters(), authToken, op.handle,
+        false /* is_begin_operation */);
     if (!result->resultCode.isOk()) return Status::ok();
 
     auto hidlCb = [&](ErrorCode ret, const hidl_vec<KeyParameter>& outParams,
@@ -1451,9 +1446,9 @@
     };
 
     KeyStoreServiceReturnCode rc = KS_HANDLE_HIDL_ERROR(
-        op.device->finish(op.handle, opParams.hidl_data(),
+        op.device->finish(op.handle, params.getParameters(),
                           ::std::vector<uint8_t>() /* TODO(swillden): wire up input to finish() */,
-                          signature, hidlCb));
+                          signature, authToken, VerificationToken(), hidlCb));
     mOperationMap.removeOperation(token);
     mAuthTokenTable.MarkCompleted(op.handle);
 
@@ -1481,8 +1476,9 @@
 
 Status KeyStoreService::isOperationAuthorized(const sp<IBinder>& token, bool* aidl_return) {
     AuthorizationSet ignored;
-    auto authResult = addOperationAuthTokenIfNeeded(token, &ignored);
-    *aidl_return = authResult.isOk();
+    KeyStoreServiceReturnCode rc;
+    std::tie(rc, std::ignore) = getOperationAuthTokenIfNeeded(token);
+    *aidl_return = rc.isOk();
     return Status::ok();
 }
 
@@ -1509,19 +1505,7 @@
         return Status::ok();
     }
 
-    std::unique_ptr<HardwareAuthToken> hidlAuthToken(new HardwareAuthToken);
-    hidlAuthToken->challenge = authToken.challenge;
-    hidlAuthToken->userId = authToken.user_id;
-    hidlAuthToken->authenticatorId = authToken.authenticator_id;
-    hidlAuthToken->authenticatorType = authToken.authenticator_type;
-    hidlAuthToken->timestamp = authToken.timestamp;
-    static_assert(
-        std::is_same<decltype(hidlAuthToken->hmac),
-                     ::android::hardware::hidl_array<uint8_t, sizeof(authToken.hmac)>>::value,
-        "This function assumes token HMAC is 32 bytes, but it might not be.");
-    std::copy(authToken.hmac, authToken.hmac + sizeof(authToken.hmac), hidlAuthToken->hmac.data());
-
-    mAuthTokenTable.AddAuthenticationToken(std::move(hidlAuthToken));
+    mAuthTokenTable.AddAuthenticationToken(hidlVec2AuthToken(hidl_vec<uint8_t>(authTokenAsVector)));
     *aidl_return = static_cast<int32_t>(ResponseCode::NO_ERROR);
     return Status::ok();
 }
@@ -1814,14 +1798,13 @@
 }
 
 /**
- * Check that all KeyParameter's provided by the application are
- * allowed. Any parameter that keystore adds itself should be disallowed here.
+ * Check that all KeyParameters provided by the application are allowed. Any parameter that keystore
+ * adds itself should be disallowed here.
  */
 bool KeyStoreService::checkAllowedOperationParams(const hidl_vec<KeyParameter>& params) {
     for (size_t i = 0; i < params.size(); ++i) {
         switch (params[i].tag) {
         case Tag::ATTESTATION_APPLICATION_ID:
-        case Tag::AUTH_TOKEN:
         case Tag::RESET_SINCE_ID_ROTATION:
             return false;
         default:
@@ -1871,36 +1854,44 @@
  *         KM_ERROR_KEY_USER_NOT_AUTHENTICATED if there is no valid auth
  *         token for the operation
  */
-KeyStoreServiceReturnCode KeyStoreService::getAuthToken(const KeyCharacteristics& characteristics,
-                                                        uint64_t handle, KeyPurpose purpose,
-                                                        const HardwareAuthToken** authToken,
-                                                        bool failOnTokenMissing) {
+std::pair<KeyStoreServiceReturnCode, HardwareAuthToken>
+KeyStoreService::getAuthToken(const KeyCharacteristics& characteristics, uint64_t handle,
+                              KeyPurpose purpose, bool failOnTokenMissing) {
 
-    AuthorizationSet allCharacteristics;
-    for (size_t i = 0; i < characteristics.softwareEnforced.size(); i++) {
-        allCharacteristics.push_back(characteristics.softwareEnforced[i]);
-    }
-    for (size_t i = 0; i < characteristics.teeEnforced.size(); i++) {
-        allCharacteristics.push_back(characteristics.teeEnforced[i]);
-    }
+    AuthorizationSet allCharacteristics(characteristics.softwareEnforced);
+    allCharacteristics.append(characteristics.hardwareEnforced.begin(),
+                              characteristics.hardwareEnforced.end());
+
+    const HardwareAuthToken* authToken = nullptr;
     AuthTokenTable::Error err = mAuthTokenTable.FindAuthorization(
-        allCharacteristics, KeyPurpose(purpose), handle, authToken);
+        allCharacteristics, static_cast<KeyPurpose>(purpose), handle, &authToken);
+
+    KeyStoreServiceReturnCode rc;
+
     switch (err) {
     case AuthTokenTable::OK:
     case AuthTokenTable::AUTH_NOT_REQUIRED:
-        return ResponseCode::NO_ERROR;
+        rc = ResponseCode::NO_ERROR;
+        break;
+
     case AuthTokenTable::AUTH_TOKEN_NOT_FOUND:
     case AuthTokenTable::AUTH_TOKEN_EXPIRED:
     case AuthTokenTable::AUTH_TOKEN_WRONG_SID:
         ALOGE("getAuthToken failed: %d", err);  // STOPSHIP: debug only, to be removed
-        return ErrorCode::KEY_USER_NOT_AUTHENTICATED;
+        rc = ErrorCode::KEY_USER_NOT_AUTHENTICATED;
+        break;
+
     case AuthTokenTable::OP_HANDLE_REQUIRED:
-        return failOnTokenMissing ? KeyStoreServiceReturnCode(ErrorCode::KEY_USER_NOT_AUTHENTICATED)
-                                  : KeyStoreServiceReturnCode(ResponseCode::OP_AUTH_NEEDED);
+        rc = failOnTokenMissing ? KeyStoreServiceReturnCode(ErrorCode::KEY_USER_NOT_AUTHENTICATED)
+                                : KeyStoreServiceReturnCode(ResponseCode::OP_AUTH_NEEDED);
+        break;
+
     default:
         ALOGE("Unexpected FindAuthorization return value %d", err);
-        return ErrorCode::INVALID_ARGUMENT;
+        rc = ErrorCode::INVALID_ARGUMENT;
     }
+
+    return {rc, authToken ? std::move(*authToken) : HardwareAuthToken()};
 }
 
 /**
@@ -1914,21 +1905,23 @@
  *         KM_ERROR_INVALID_OPERATION_HANDLE if token is not a valid
  *         operation token.
  */
-KeyStoreServiceReturnCode KeyStoreService::addOperationAuthTokenIfNeeded(const sp<IBinder>& token,
-                                                                         AuthorizationSet* params) {
+std::pair<KeyStoreServiceReturnCode, const HardwareAuthToken&>
+KeyStoreService::getOperationAuthTokenIfNeeded(const sp<IBinder>& token) {
+    static HardwareAuthToken emptyToken = {};
+
     auto getOpResult = mOperationMap.getOperation(token);
-    if (!getOpResult.isOk()) return ErrorCode::INVALID_OPERATION_HANDLE;
+    if (!getOpResult.isOk()) return {ErrorCode::INVALID_OPERATION_HANDLE, emptyToken};
     const auto& op = getOpResult.value();
 
-    if (!op.authToken) {
-        const HardwareAuthToken* found = nullptr;
-        auto result = getAuthToken(op.characteristics, op.handle, op.purpose, &found);
-        if (!result.isOk()) return result;
-        if (found) mOperationMap.setOperationAuthToken(token, *found);
-        assert(*op.authToken == *found);
+    if (!op.hasAuthToken()) {
+        KeyStoreServiceReturnCode rc;
+        HardwareAuthToken found;
+        std::tie(rc, found) = getAuthToken(op.characteristics, op.handle, op.purpose);
+        if (!rc.isOk()) return {rc, emptyToken};
+        mOperationMap.setOperationAuthToken(token, std::move(found));
     }
-    addAuthTokenToParams(params, op.authToken.get());
-    return ResponseCode::NO_ERROR;
+
+    return {ResponseCode::NO_ERROR, op.authToken};
 }
 
 /**
@@ -1936,23 +1929,19 @@
  * preserved and keymaster errors become SYSTEM_ERRORs
  */
 KeyStoreServiceReturnCode KeyStoreService::translateResultToLegacyResult(int32_t result) {
-    if (result > 0) {
-        return static_cast<ResponseCode>(result);
-    }
+    if (result > 0) return static_cast<ResponseCode>(result);
     return ResponseCode::SYSTEM_ERROR;
 }
 
 static NullOr<const Algorithm&> getKeyAlgoritmFromKeyCharacteristics(
     const ::android::security::keymaster::KeyCharacteristics& characteristics) {
-    for (size_t i = 0; i < characteristics.teeEnforced.getParameters().size(); ++i) {
-        auto algo =
-            authorizationValue(TAG_ALGORITHM, characteristics.teeEnforced.getParameters()[i]);
-        if (algo.isOk()) return algo.value();
+    for (const auto& param : characteristics.hardwareEnforced.getParameters()) {
+        auto algo = authorizationValue(TAG_ALGORITHM, param);
+        if (algo.isOk()) return algo;
     }
-    for (size_t i = 0; i < characteristics.softwareEnforced.getParameters().size(); ++i) {
-        auto algo =
-            authorizationValue(TAG_ALGORITHM, characteristics.softwareEnforced.getParameters()[i]);
-        if (algo.isOk()) return algo.value();
+    for (const auto& param : characteristics.softwareEnforced.getParameters()) {
+        auto algo = authorizationValue(TAG_ALGORITHM, param);
+        if (algo.isOk()) return algo;
     }
     return {};
 }
diff --git a/keystore/key_store_service.h b/keystore/key_store_service.h
index 0316d6d..da3e60a 100644
--- a/keystore/key_store_service.h
+++ b/keystore/key_store_service.h
@@ -222,31 +222,28 @@
     /**
      * Get the auth token for this operation from the auth token table.
      *
-     * Returns ::NO_ERROR if the auth token was set or none was required.
-     *         ::OP_AUTH_NEEDED if it is a per op authorization, no
-     *         authorization token exists for that operation and
-     *         failOnTokenMissing is false.
-     *         KM_ERROR_KEY_USER_NOT_AUTHENTICATED if there is no valid auth
-     *         token for the operation
+     * Returns NO_ERROR if the auth token was found or none was required.  If not needed, the
+     *             token will be empty (which keymaster interprets as no auth token).
+     *         OP_AUTH_NEEDED if it is a per op authorization, no authorization token exists for
+     *             that operation and  failOnTokenMissing is false.
+     *         KM_ERROR_KEY_USER_NOT_AUTHENTICATED if there is no valid auth token for the operation
      */
-    KeyStoreServiceReturnCode getAuthToken(const KeyCharacteristics& characteristics,
-                                           uint64_t handle, KeyPurpose purpose,
-                                           const HardwareAuthToken** authToken,
-                                           bool failOnTokenMissing = true);
+    std::pair<KeyStoreServiceReturnCode, HardwareAuthToken>
+    getAuthToken(const KeyCharacteristics& characteristics, uint64_t handle, KeyPurpose purpose,
+                 bool failOnTokenMissing = true);
 
     /**
-     * Add the auth token for the operation to the param list if the operation
-     * requires authorization. Uses the cached result in the OperationMap if available
-     * otherwise gets the token from the AuthTokenTable and caches the result.
+     * Get the auth token for the operation if the operation requires authorization. Uses the cached
+     * result in the OperationMap if available otherwise gets the token from the AuthTokenTable and
+     * caches the result.
      *
-     * Returns ::NO_ERROR if the auth token was added or not needed.
-     *         KM_ERROR_KEY_USER_NOT_AUTHENTICATED if the operation is not
-     *         authenticated.
-     *         KM_ERROR_INVALID_OPERATION_HANDLE if token is not a valid
-     *         operation token.
+     * Returns NO_ERROR if the auth token was found or not needed.  If not needed, the token will
+     *             be empty (which keymaster interprets as no auth token).
+     *         KM_ERROR_KEY_USER_NOT_AUTHENTICATED if the operation is not authenticated.
+     *         KM_ERROR_INVALID_OPERATION_HANDLE if token is not a valid operation token.
      */
-    KeyStoreServiceReturnCode addOperationAuthTokenIfNeeded(const sp<android::IBinder>& token,
-                                                            AuthorizationSet* params);
+    std::pair<KeyStoreServiceReturnCode, const HardwareAuthToken&>
+    getOperationAuthTokenIfNeeded(const sp<android::IBinder>& token);
 
     /**
      * Translate a result value to a legacy return value. All keystore errors are
diff --git a/keystore/keymaster_enforcement.cpp b/keystore/keymaster_enforcement.cpp
index c27ec6b..16d1354 100644
--- a/keystore/keymaster_enforcement.cpp
+++ b/keystore/keymaster_enforcement.cpp
@@ -117,6 +117,7 @@
 ErrorCode KeymasterEnforcement::AuthorizeOperation(const KeyPurpose purpose, const km_id_t keyid,
                                                    const AuthorizationSet& auth_set,
                                                    const AuthorizationSet& operation_params,
+                                                   const HardwareAuthToken& auth_token,
                                                    uint64_t op_handle, bool is_begin_operation) {
     if (is_public_key_algorithm(auth_set)) {
         switch (purpose) {
@@ -127,23 +128,23 @@
 
         case KeyPurpose::DECRYPT:
         case KeyPurpose::SIGN:
-        case KeyPurpose::DERIVE_KEY:
             break;
+
         case KeyPurpose::WRAP_KEY:
             return ErrorCode::INCOMPATIBLE_PURPOSE;
         };
     };
 
     if (is_begin_operation)
-        return AuthorizeBegin(purpose, keyid, auth_set, operation_params);
+        return AuthorizeBegin(purpose, keyid, auth_set, operation_params, auth_token);
     else
-        return AuthorizeUpdateOrFinish(auth_set, operation_params, op_handle);
+        return AuthorizeUpdateOrFinish(auth_set, auth_token, op_handle);
 }
 
 // For update and finish the only thing to check is user authentication, and then only if it's not
 // timeout-based.
 ErrorCode KeymasterEnforcement::AuthorizeUpdateOrFinish(const AuthorizationSet& auth_set,
-                                                        const AuthorizationSet& operation_params,
+                                                        const HardwareAuthToken& auth_token,
                                                         uint64_t op_handle) {
     int auth_type_index = -1;
     for (size_t pos = 0; pos < auth_set.size(); ++pos) {
@@ -176,9 +177,9 @@
         if (user_secure_id.isOk()) {
             authentication_required = true;
             int auth_timeout_index = -1;
-            if (AuthTokenMatches(auth_set, operation_params, user_secure_id.value(),
-                                 auth_type_index, auth_timeout_index, op_handle,
-                                 false /* is_begin_operation */))
+            if (auth_token.mac.size() &&
+                AuthTokenMatches(auth_set, auth_token, user_secure_id.value(), auth_type_index,
+                                 auth_timeout_index, op_handle, false /* is_begin_operation */))
                 return ErrorCode::OK;
         }
     }
@@ -190,7 +191,8 @@
 
 ErrorCode KeymasterEnforcement::AuthorizeBegin(const KeyPurpose purpose, const km_id_t keyid,
                                                const AuthorizationSet& auth_set,
-                                               const AuthorizationSet& operation_params) {
+                                               const AuthorizationSet& operation_params,
+                                               NullOr<const HardwareAuthToken&> auth_token) {
     // Find some entries that may be needed to handle KM_TAG_USER_SECURE_ID
     int auth_timeout_index = -1;
     int auth_type_index = -1;
@@ -272,9 +274,9 @@
             if (auth_timeout_index != -1) {
                 auto secure_id = authorizationValue(TAG_USER_SECURE_ID, param);
                 authentication_required = true;
-                if (secure_id.isOk() &&
-                    AuthTokenMatches(auth_set, operation_params, secure_id.value(), auth_type_index,
-                                     auth_timeout_index, 0 /* op_handle */,
+                if (secure_id.isOk() && auth_token.isOk() &&
+                    AuthTokenMatches(auth_set, auth_token.value(), secure_id.value(),
+                                     auth_type_index, auth_timeout_index, 0 /* op_handle */,
                                      true /* is_begin_operation */))
                     auth_token_matched = true;
             }
@@ -286,7 +288,6 @@
 
         /* Tags should never be in key auths. */
         case Tag::INVALID:
-        case Tag::AUTH_TOKEN:
         case Tag::ROOT_OF_TRUST:
         case Tag::APPLICATION_DATA:
         case Tag::ATTESTATION_CHALLENGE:
@@ -311,21 +312,18 @@
         case Tag::PADDING:
         case Tag::NONCE:
         case Tag::MIN_MAC_LENGTH:
-        case Tag::KDF:
         case Tag::EC_CURVE:
 
         /* Tags not used for operations. */
         case Tag::BLOB_USAGE_REQUIREMENTS:
-        case Tag::EXPORTABLE:
 
         /* Algorithm specific parameters not used for access control. */
         case Tag::RSA_PUBLIC_EXPONENT:
-        case Tag::ECIES_SINGLE_HASH_MODE:
 
         /* Informational tags. */
         case Tag::CREATION_DATETIME:
         case Tag::ORIGIN:
-        case Tag::ROLLBACK_RESISTANT:
+        case Tag::ROLLBACK_RESISTANCE:
 
         /* Tags handled when KM_TAG_USER_SECURE_ID is handled */
         case Tag::NO_AUTH_REQUIRED:
@@ -336,20 +334,16 @@
         case Tag::ASSOCIATED_DATA:
 
         /* Tags that are implicitly verified by secure side */
-        case Tag::ALL_APPLICATIONS:
         case Tag::APPLICATION_ID:
         case Tag::OS_VERSION:
         case Tag::OS_PATCHLEVEL:
 
-        /* Ignored pending removal */
-        case Tag::USER_ID:
-        case Tag::ALL_USERS:
-
         /* TODO(swillden): Handle these */
         case Tag::INCLUDE_UNIQUE_ID:
         case Tag::UNIQUE_ID:
         case Tag::RESET_SINCE_ID_ROTATION:
         case Tag::ALLOW_WHILE_ON_BODY:
+        case Tag::HARDWARE_TYPE:
             break;
 
         case Tag::BOOTLOADER_ONLY:
@@ -465,7 +459,7 @@
 }
 
 bool KeymasterEnforcement::AuthTokenMatches(const AuthorizationSet& auth_set,
-                                            const AuthorizationSet& operation_params,
+                                            const HardwareAuthToken& auth_token,
                                             const uint64_t user_secure_id,
                                             const int auth_type_index, const int auth_timeout_index,
                                             const uint64_t op_handle,
@@ -473,25 +467,6 @@
     assert(auth_type_index < static_cast<int>(auth_set.size()));
     assert(auth_timeout_index < static_cast<int>(auth_set.size()));
 
-    auto auth_token_blob = operation_params.GetTagValue(TAG_AUTH_TOKEN);
-    if (!auth_token_blob.isOk()) {
-        ALOGE("Authentication required, but auth token not provided");
-        return false;
-    }
-
-    if (auth_token_blob.value().size() != sizeof(hw_auth_token_t)) {
-        ALOGE("Bug: Auth token is the wrong size (%zu expected, %zu found)",
-              sizeof(hw_auth_token_t), auth_token_blob.value().size());
-        return false;
-    }
-    uint8_t auth_token_version = auth_token_blob.value()[0];
-    HardwareAuthToken auth_token = hidlVec2AuthToken(auth_token_blob.value());
-    if (auth_token_version != HW_AUTH_TOKEN_VERSION) {
-        ALOGE("Bug: Auth token is the version %hhu (or is not an auth token). Expected %d",
-              auth_token_version, HW_AUTH_TOKEN_VERSION);
-        return false;
-    }
-
     if (!ValidateTokenSignature(auth_token)) {
         ALOGE("Auth token signature invalid");
         return false;
@@ -518,10 +493,9 @@
     auto key_auth_type_mask = authorizationValue(TAG_USER_AUTH_TYPE, auth_set[auth_type_index]);
     if (!key_auth_type_mask.isOk()) return false;
 
-    uint32_t token_auth_type = ntoh(auth_token.authenticatorType);
-    if ((uint32_t(key_auth_type_mask.value()) & token_auth_type) == 0) {
+    if ((uint32_t(key_auth_type_mask.value()) & auth_token.authenticatorType) == 0) {
         ALOGE("Key requires match of auth type mask 0%uo, but token contained 0%uo",
-              key_auth_type_mask.value(), token_auth_type);
+              key_auth_type_mask.value(), auth_token.authenticatorType);
         return false;
     }
 
diff --git a/keystore/keymaster_enforcement.h b/keystore/keymaster_enforcement.h
index 28d546a..d751071 100644
--- a/keystore/keymaster_enforcement.h
+++ b/keystore/keymaster_enforcement.h
@@ -51,7 +51,8 @@
      */
     ErrorCode AuthorizeOperation(const KeyPurpose purpose, const km_id_t keyid,
                                  const AuthorizationSet& auth_set,
-                                 const AuthorizationSet& operation_params, uint64_t op_handle,
+                                 const AuthorizationSet& operation_params,
+                                 const HardwareAuthToken& auth_token, uint64_t op_handle,
                                  bool is_begin_operation);
 
     /**
@@ -61,16 +62,17 @@
      */
     ErrorCode AuthorizeBegin(const KeyPurpose purpose, const km_id_t keyid,
                              const AuthorizationSet& auth_set,
-                             const AuthorizationSet& operation_params);
+                             const AuthorizationSet& operation_params,
+                             NullOr<const HardwareAuthToken&> auth_token);
 
     /**
      * Iterates through the authorization set and returns the corresponding keymaster error. Will
      * return KM_ERROR_OK if all criteria is met for the given purpose in the authorization set with
      * the given operation params and handle. Used for encrypt, decrypt sign, and verify.
      */
-    ErrorCode AuthorizeUpdate(const AuthorizationSet& auth_set,
-                              const AuthorizationSet& operation_params, uint64_t op_handle) {
-        return AuthorizeUpdateOrFinish(auth_set, operation_params, op_handle);
+    ErrorCode AuthorizeUpdate(const AuthorizationSet& auth_set, const HardwareAuthToken& auth_token,
+                              uint64_t op_handle) {
+        return AuthorizeUpdateOrFinish(auth_set, auth_token, op_handle);
     }
 
     /**
@@ -78,9 +80,9 @@
      * return KM_ERROR_OK if all criteria is met for the given purpose in the authorization set with
      * the given operation params and handle. Used for encrypt, decrypt sign, and verify.
      */
-    ErrorCode AuthorizeFinish(const AuthorizationSet& auth_set,
-                              const AuthorizationSet& operation_params, uint64_t op_handle) {
-        return AuthorizeUpdateOrFinish(auth_set, operation_params, op_handle);
+    ErrorCode AuthorizeFinish(const AuthorizationSet& auth_set, const HardwareAuthToken& auth_token,
+                              uint64_t op_handle) {
+        return AuthorizeUpdateOrFinish(auth_set, auth_token, op_handle);
     }
 
     /**
@@ -142,14 +144,14 @@
 
   private:
     ErrorCode AuthorizeUpdateOrFinish(const AuthorizationSet& auth_set,
-                                      const AuthorizationSet& operation_params, uint64_t op_handle);
+                                      const HardwareAuthToken& auth_token, uint64_t op_handle);
 
     bool MinTimeBetweenOpsPassed(uint32_t min_time_between, const km_id_t keyid);
     bool MaxUsesPerBootNotExceeded(const km_id_t keyid, uint32_t max_uses);
-    bool AuthTokenMatches(const AuthorizationSet& auth_set,
-                          const AuthorizationSet& operation_params, const uint64_t user_secure_id,
-                          const int auth_type_index, const int auth_timeout_index,
-                          const uint64_t op_handle, bool is_begin_operation) const;
+    bool AuthTokenMatches(const AuthorizationSet& auth_set, const HardwareAuthToken& auth_token,
+                          const uint64_t user_secure_id, const int auth_type_index,
+                          const int auth_timeout_index, const uint64_t op_handle,
+                          bool is_begin_operation) const;
 
     AccessTimeMap* access_time_map_;
     AccessCountMap* access_count_map_;
diff --git a/keystore/keystore_aidl_hidl_marshalling_utils.cpp b/keystore/keystore_aidl_hidl_marshalling_utils.cpp
index 1927cfc..db9b983 100644
--- a/keystore/keystore_aidl_hidl_marshalling_utils.cpp
+++ b/keystore/keystore_aidl_hidl_marshalling_utils.cpp
@@ -15,17 +15,15 @@
 ** limitations under the License.
 */
 
-#define LOG_TAG "KeystoreService"
-#include <utils/Log.h>
-
 #include "keystore_aidl_hidl_marshalling_utils.h"
-#include <keystore/keystore_hidl_support.h>
 
-#include "include/keystore/ExportResult.h"
-#include "include/keystore/KeyCharacteristics.h"
-#include "include/keystore/KeymasterBlob.h"
-#include "include/keystore/KeymasterCertificateChain.h"
-#include "include/keystore/KeystoreArg.h"
+#include <keystore/ExportResult.h>
+#include <keystore/KeyCharacteristics.h>
+#include <keystore/KeymasterBlob.h>
+#include <keystore/KeymasterCertificateChain.h>
+#include <keystore/KeystoreArg.h>
+#include <keystore/keymaster_types.h>
+#include <keystore/keystore_hidl_support.h>
 
 namespace keystore {
 
@@ -207,8 +205,8 @@
 namespace security {
 namespace keymaster {
 
-using ::android::hardware::keymaster::V3_0::ErrorCode;
 using ::android::status_t;
+using ::keystore::keymaster::ErrorCode;
 
 ExportResult::ExportResult() : resultCode() {}
 
@@ -228,12 +226,12 @@
 
 status_t KeyCharacteristics::readFromParcel(const Parcel* in) {
     softwareEnforced.readFromParcel(in);
-    return teeEnforced.readFromParcel(in);
+    return hardwareEnforced.readFromParcel(in);
 }
 
 status_t KeyCharacteristics::writeToParcel(Parcel* out) const {
     softwareEnforced.writeToParcel(out);
-    return teeEnforced.writeToParcel(out);
+    return hardwareEnforced.writeToParcel(out);
 }
 
 status_t KeymasterBlob::readFromParcel(const Parcel* in) {
diff --git a/keystore/keystore_client_impl.cpp b/keystore/keystore_client_impl.cpp
index 99fe606..d9a824b 100644
--- a/keystore/keystore_client_impl.cpp
+++ b/keystore/keystore_client_impl.cpp
@@ -201,7 +201,7 @@
     /* assignment (hidl_vec<KeyParameter> -> AuthorizationSet) makes a deep copy.
      * There are no references to Parcel memory after that, and ownership of the newly acquired
      * memory is with the AuthorizationSet objects. */
-    *hardware_enforced_characteristics = characteristics.teeEnforced.getParameters();
+    *hardware_enforced_characteristics = characteristics.hardwareEnforced.getParameters();
     *software_enforced_characteristics = characteristics.softwareEnforced.getParameters();
     return KeyStoreNativeReturnCode(result);
 }
@@ -220,7 +220,7 @@
     /* assignment (hidl_vec<KeyParameter> -> AuthorizationSet) makes a deep copy.
      * There are no references to Parcel memory after that, and ownership of the newly acquired
      * memory is with the AuthorizationSet objects. */
-    *hardware_enforced_characteristics = characteristics.teeEnforced.getParameters();
+    *hardware_enforced_characteristics = characteristics.hardwareEnforced.getParameters();
     *software_enforced_characteristics = characteristics.softwareEnforced.getParameters();
     return KeyStoreNativeReturnCode(result);
 }
@@ -240,7 +240,7 @@
     /* assignment (hidl_vec<KeyParameter> -> AuthorizationSet) makes a deep copy.
      * There are no references to Parcel memory after that, and ownership of the newly acquired
      * memory is with the AuthorizationSet objects. */
-    *hardware_enforced_characteristics = characteristics.teeEnforced.getParameters();
+    *hardware_enforced_characteristics = characteristics.hardwareEnforced.getParameters();
     *software_enforced_characteristics = characteristics.softwareEnforced.getParameters();
     return KeyStoreNativeReturnCode(result);
 }
diff --git a/keystore/keystore_main.cpp b/keystore/keystore_main.cpp
index 59361b4..f4ccf04 100644
--- a/keystore/keystore_main.cpp
+++ b/keystore/keystore_main.cpp
@@ -14,13 +14,10 @@
  * limitations under the License.
  */
 
-//#define LOG_NDEBUG 0
-#define LOG_TAG "keystore"
-
+#include <android-base/logging.h>
 #include <android/system/wifi/keystore/1.0/IKeystore.h>
 #include <binder/IPCThreadState.h>
 #include <binder/IServiceManager.h>
-#include <cutils/log.h>
 #include <utils/StrongPointer.h>
 #include <wifikeystorehal/keystore.h>
 
@@ -53,57 +50,37 @@
 
 int main(int argc, char* argv[]) {
     using android::hardware::hidl_string;
-    if (argc < 2) {
-        ALOGE("A directory must be specified!");
-        return 1;
-    }
-    if (chdir(argv[1]) == -1) {
-        ALOGE("chdir: %s: %s", argv[1], strerror(errno));
-        return 1;
-    }
+    CHECK(argc >= 2) << "A directory must be specified!";
+    CHECK(chdir(argv[1]) != -1) << "chdir: " << argv[1] << ": " << strerror(errno);
 
     Entropy entropy;
-    if (!entropy.open()) {
-        return 1;
-    }
+    CHECK(entropy.open()) << "Failed to open entropy source.";
 
     auto hwdev = android::hardware::keymaster::V3_0::IKeymasterDevice::getService();
-    if (hwdev.get() == nullptr) return -1;
+    CHECK(hwdev.get()) << "Failed to load @3.0::IKeymasterDevice";
     sp<Keymaster> dev = new keystore::Keymaster3(hwdev);
 
     auto fbdev = android::keystore::makeSoftwareKeymasterDevice();
     if (fbdev.get() == nullptr) return -1;
     sp<Keymaster> fallback = new keystore::Keymaster3(fbdev);
 
-    if (configure_selinux() == -1) {
-        return -1;
-    }
+    CHECK(configure_selinux() != -1) << "Failed to configure SELinux.";
 
-    bool allowNewFallbackDevice = false;
+    auto halVersion = dev->halVersion();
+    CHECK(halVersion.error == keystore::ErrorCode::OK)
+        << "Error " << toString(halVersion.error) << " getting HAL version";
 
-    keystore::KeyStoreServiceReturnCode rc;
-    rc = KS_HANDLE_HIDL_ERROR(
-        dev->getHardwareFeatures([&](bool, bool, bool, bool supportsAttestation, bool,
-                                     const hidl_string&, const hidl_string&) {
-            // Attestation support indicates the hardware is keymaster 2.0 or higher.
-            // For these devices we will not allow the fallback device for import or generation
-            // of keys. The fallback device is only used for legacy keys present on the device.
-            allowNewFallbackDevice = !supportsAttestation;
-        }));
-
-    if (!rc.isOk()) {
-        return -1;
-    }
+    // If the hardware is keymaster 2.0 or higher we will not allow the fallback device for import
+    // or generation of keys. The fallback device is only used for legacy keys present on the
+    // device.
+    bool allowNewFallbackDevice = halVersion.majorVersion >= 2 && halVersion.isSecure;
 
     keystore::KeyStore keyStore(&entropy, dev, fallback, allowNewFallbackDevice);
     keyStore.initialize();
     android::sp<android::IServiceManager> sm = android::defaultServiceManager();
     android::sp<keystore::KeyStoreService> service = new keystore::KeyStoreService(&keyStore);
     android::status_t ret = sm->addService(android::String16("android.security.keystore"), service);
-    if (ret != android::OK) {
-        ALOGE("Couldn't register binder service!");
-        return -1;
-    }
+    CHECK(ret == android::OK) << "Couldn't register binder service!";
 
     /**
      * Register the wifi keystore HAL service to run in passthrough mode.
@@ -113,9 +90,7 @@
     configureRpcThreadpool(1, false /* callerWillJoin */);
     android::sp<IKeystore> wifiKeystoreHalService = new Keystore();
     android::status_t err = wifiKeystoreHalService->registerAsService();
-    if (ret != android::OK) {
-        ALOGE("Cannot register wifi keystore HAL service: %d", err);
-    }
+    CHECK(ret == android::OK) << "Cannot register wifi keystore HAL service: " << err;
 
     /*
      * This thread is just going to process Binder transactions.
diff --git a/keystore/keystore_utils.cpp b/keystore/keystore_utils.cpp
index 54883b9..54f61cc 100644
--- a/keystore/keystore_utils.cpp
+++ b/keystore/keystore_utils.cpp
@@ -78,7 +78,6 @@
     params->push_back(TAG_DIGEST, Digest::SHA_2_256);
     params->push_back(TAG_DIGEST, Digest::SHA_2_384);
     params->push_back(TAG_DIGEST, Digest::SHA_2_512);
-    params->push_back(TAG_ALL_USERS);
     params->push_back(TAG_NO_AUTH_REQUIRED);
     params->push_back(TAG_ORIGINATION_EXPIRE_DATETIME, LLONG_MAX);
     params->push_back(TAG_USAGE_EXPIRE_DATETIME, LLONG_MAX);
diff --git a/keystore/operation.cpp b/keystore/operation.cpp
index 66fcee2..e09d515 100644
--- a/keystore/operation.cpp
+++ b/keystore/operation.cpp
@@ -25,8 +25,7 @@
     : mDeathRecipient(deathRecipient) {}
 
 sp<IBinder> OperationMap::addOperation(uint64_t handle, uint64_t keyid, KeyPurpose purpose,
-                                       const OperationMap::km_device_t& dev,
-                                       const sp<IBinder>& appToken,
+                                       const sp<Keymaster>& dev, const sp<IBinder>& appToken,
                                        KeyCharacteristics&& characteristics, bool pruneable) {
     sp<IBinder> token = new ::android::BBinder();
     mMap.emplace(token,
@@ -100,7 +99,7 @@
     auto entry = mMap.find(token);
     if (entry == mMap.end()) return false;
 
-    entry->second.authToken = std::make_unique<HardwareAuthToken>(std::move(authToken));
+    entry->second.authToken = std::move(authToken);
     return true;
 }
 
@@ -111,7 +110,7 @@
 }
 
 OperationMap::Operation::Operation(uint64_t handle_, uint64_t keyid_, KeyPurpose purpose_,
-                                   const OperationMap::km_device_t& device_,
+                                   const sp<Keymaster>& device_,
                                    KeyCharacteristics&& characteristics_, sp<IBinder> appToken_)
     : handle(handle_), keyid(keyid_), purpose(purpose_), device(device_),
       characteristics(characteristics_), appToken(appToken_) {}
diff --git a/keystore/operation.h b/keystore/operation.h
index ac8e945..6e97346 100644
--- a/keystore/operation.h
+++ b/keystore/operation.h
@@ -17,13 +17,16 @@
 #ifndef KEYSTORE_OPERATION_H_
 #define KEYSTORE_OPERATION_H_
 
+#include <map>
+#include <vector>
+
 #include <binder/Binder.h>
 #include <binder/IBinder.h>
-#include <keystore/keymaster_tags.h>
-#include <map>
-#include <utils/LruCache.h>
 #include <utils/StrongPointer.h>
-#include <vector>
+
+#include <keystore/keymaster_tags.h>
+
+#include "Keymaster.h"
 
 namespace keystore {
 
@@ -38,28 +41,28 @@
  */
 
 class OperationMap {
-    typedef sp<::android::hardware::keymaster::V3_0::IKeymasterDevice> km_device_t;
-
   public:
     struct Operation {
         Operation() = default;
-        Operation(uint64_t handle, uint64_t keyid, KeyPurpose purpose, const km_device_t& device,
+        Operation(uint64_t handle, uint64_t keyid, KeyPurpose purpose, const sp<Keymaster>& device,
                   KeyCharacteristics&& characteristics, sp<IBinder> appToken);
         Operation(Operation&&) = default;
         Operation(const Operation&) = delete;
 
+        bool hasAuthToken() const { return authToken.mac.size() == 0; }
+
         uint64_t handle;
         uint64_t keyid;
         KeyPurpose purpose;
-        km_device_t device;
+        sp<Keymaster> device;
         KeyCharacteristics characteristics;
         sp<IBinder> appToken;
-        std::unique_ptr<HardwareAuthToken> authToken;
+        HardwareAuthToken authToken;
     };
 
     explicit OperationMap(IBinder::DeathRecipient* deathRecipient);
     sp<IBinder> addOperation(uint64_t handle, uint64_t keyid, KeyPurpose purpose,
-                             const km_device_t& dev, const sp<IBinder>& appToken,
+                             const sp<Keymaster>& dev, const sp<IBinder>& appToken,
                              KeyCharacteristics&& characteristics, bool pruneable);
     NullOr<const Operation&> getOperation(const sp<IBinder>& token);
     NullOr<Operation> removeOperation(const sp<IBinder>& token);
diff --git a/keystore/tests/auth_token_formatting_test.cpp b/keystore/tests/auth_token_formatting_test.cpp
index d6e712e..511256f 100644
--- a/keystore/tests/auth_token_formatting_test.cpp
+++ b/keystore/tests/auth_token_formatting_test.cpp
@@ -16,11 +16,11 @@
 
 #include <gtest/gtest.h>
 
-#include <endian.h>
-#include <keymaster/logger.h>
-#include <hidl/HidlSupport.h>
 #include <android/hardware/keymaster/3.0/types.h>
+#include <endian.h>
 #include <hardware/hw_auth_token.h>
+#include <hidl/HidlSupport.h>
+#include <keymaster/logger.h>
 
 #include "../auth_token_table.h"
 #include <keystore/keystore_hidl_support.h>
@@ -32,7 +32,7 @@
 
 namespace {
 
-class StdoutLogger : public keymaster::Logger {
+class StdoutLogger : public ::keymaster::Logger {
   public:
     StdoutLogger() { set_instance(this); }
 
@@ -64,69 +64,92 @@
 
 StdoutLogger logger;
 
-}
+}  // namespace
 
-
-using android::hardware::keymaster::V3_0::HardwareAuthToken;
-using android::hardware::hidl_vec;
 using android::hardware::hidl_array;
+using android::hardware::hidl_vec;
 
 constexpr const uint8_t test_token[69] = {
-        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
-        0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
-        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-        0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
-        0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-        0x40, 0x41, 0x42, 0x43, 0x44
-};
-
+    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d,
+    0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
+    0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29,
+    0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+    0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44};
 
 constexpr const uint8_t test_hmac_data[] = {
-        0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c,
-        0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34,
-        0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c,
-        0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44 };
+    0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34,
+    0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44};
 
-static const HardwareAuthToken hidl_test_token_little_endian = {
-        UINT64_C(0x0807060504030201),
-        UINT64_C(0x100f0e0d0c0b0a09),
-        UINT64_C(0x1817161514131211),
-        UINT32_C(0x1c1b1a19),
-        UINT64_C(0x24232221201f1e1d),
-        hidl_array<uint8_t, 32>(test_hmac_data)
-};
+static const Km3HardwareAuthToken km3_hidl_test_token_little_endian = {
+    UINT64_C(0x0807060504030201), UINT64_C(0x100f0e0d0c0b0a09),
+    UINT64_C(0x1817161514131211), UINT32_C(0x1c1b1a19),
+    UINT64_C(0x24232221201f1e1d), hidl_array<uint8_t, 32>(test_hmac_data)};
 
+static const HardwareAuthToken km4_hidl_test_token = {
+    UINT64_C(0x0807060504030201), UINT64_C(0x100f0e0d0c0b0a09),
+    UINT64_C(0x1817161514131211), static_cast<HardwareAuthenticatorType>(UINT32_C(0x191a1b1c)),
+    UINT64_C(0x1d1e1f2021222324), hidl_vec<uint8_t>(test_hmac_data, test_hmac_data + 32)};
 
-TEST(AuthenticationTokenFormattingTest, hidlVec2AuthToken) {
+TEST(AuthenticationTokenFormattingTest, hidlVec2Km3AuthToken) {
     static_assert(sizeof(hw_auth_token_t) == sizeof(test_token), "test_token has wrong size");
     hidl_vec<uint8_t> hidl_test_token;
     hidl_test_token.setToExternal(const_cast<unsigned char*>(test_token), sizeof(test_token));
-    ASSERT_EQ(hidl_test_token_little_endian, hidlVec2AuthToken(hidl_test_token));
+    ASSERT_EQ(km3_hidl_test_token_little_endian, hidlVec2Km3AuthToken(hidl_test_token));
 }
 
-TEST(AuthenticationTokenFormattingTest, authToken2HidlVec) {
+TEST(AuthenticationTokenFormattingTest, hidlVec2Km4AuthToken) {
     static_assert(sizeof(hw_auth_token_t) == sizeof(test_token), "test_token has wrong size");
     hidl_vec<uint8_t> hidl_test_token;
     hidl_test_token.setToExternal(const_cast<unsigned char*>(test_token), sizeof(test_token));
-    ASSERT_EQ(hidl_test_token, authToken2HidlVec(hidl_test_token_little_endian));
+    ASSERT_EQ(km4_hidl_test_token, hidlVec2AuthToken(hidl_test_token));
+}
+
+TEST(AuthenticationTokenFormattingTest, km3AuthToken2HidlVec) {
+    static_assert(sizeof(hw_auth_token_t) == sizeof(test_token), "test_token has wrong size");
+    hidl_vec<uint8_t> hidl_test_token;
+    hidl_test_token.setToExternal(const_cast<unsigned char*>(test_token), sizeof(test_token));
+    ASSERT_EQ(hidl_test_token, authToken2HidlVec(km3_hidl_test_token_little_endian));
+}
+
+TEST(AuthenticationTokenFormattingTest, km4AuthToken2HidlVec) {
+    static_assert(sizeof(hw_auth_token_t) == sizeof(test_token), "test_token has wrong size");
+    hidl_vec<uint8_t> hidl_test_token;
+    hidl_test_token.setToExternal(const_cast<unsigned char*>(test_token), sizeof(test_token));
+    ASSERT_EQ(hidl_test_token, authToken2HidlVec(km4_hidl_test_token));
 }
 
 TEST(AuthenticationTokenFormattingTest, backAndForth) {
     static_assert(sizeof(hw_auth_token_t) == sizeof(test_token), "test_token has wrong size");
     hidl_vec<uint8_t> hidl_test_token;
     hidl_test_token.setToExternal(const_cast<unsigned char*>(test_token), sizeof(test_token));
-    ASSERT_EQ(hidl_test_token_little_endian, hidlVec2AuthToken(authToken2HidlVec(hidl_test_token_little_endian)));
+    ASSERT_EQ(km3_hidl_test_token_little_endian,
+              hidlVec2Km3AuthToken(authToken2HidlVec(km3_hidl_test_token_little_endian)));
+    ASSERT_EQ(km4_hidl_test_token, hidlVec2AuthToken(authToken2HidlVec(km4_hidl_test_token)));
 }
 
 TEST(AuthenticationTokenFormattingTest, forthAndBack) {
     static_assert(sizeof(hw_auth_token_t) == sizeof(test_token), "test_token has wrong size");
     hidl_vec<uint8_t> hidl_test_token;
     hidl_test_token.setToExternal(const_cast<unsigned char*>(test_token), sizeof(test_token));
-    ASSERT_EQ(hidl_test_token, authToken2HidlVec(hidlVec2AuthToken(hidl_test_token)));
+    ASSERT_EQ(hidl_test_token, authToken2HidlVec(hidlVec2Km3AuthToken(hidl_test_token)));
+    ASSERT_EQ(hidl_test_token, authToken2HidlVec(hidlVec2Km3AuthToken(hidl_test_token)));
 }
 
-}  // namespace keymaster
+TEST(AuthenticationTokenFormattingTest, roundAndRound) {
+    static_assert(sizeof(hw_auth_token_t) == sizeof(test_token), "test_token has wrong size");
+    hidl_vec<uint8_t> hidl_test_token;
+    hidl_test_token.setToExternal(const_cast<unsigned char*>(test_token), sizeof(test_token));
+    HardwareAuthToken km4_from_hidl = hidlVec2AuthToken(hidl_test_token);
+    hidl_vec<uint8_t> hidl_from_km4 = authToken2HidlVec(km4_from_hidl);
+    Km3HardwareAuthToken km3_from_hidl = hidlVec2Km3AuthToken(hidl_from_km4);
+    hidl_vec<uint8_t> hidl_from_km3 = authToken2HidlVec(km3_from_hidl);
+
+    ASSERT_EQ(hidl_from_km4, hidl_test_token);
+    ASSERT_EQ(hidl_from_km3, hidl_test_token);
+    ASSERT_NE(km4_from_hidl.timestamp, km3_from_hidl.timestamp);
+    ASSERT_NE(static_cast<uint32_t>(km4_from_hidl.authenticatorType),
+              km3_from_hidl.authenticatorType);
+}
+
 }  // namespace test
+}  // namespace keystore
diff --git a/keystore/tests/auth_token_table_test.cpp b/keystore/tests/auth_token_table_test.cpp
index 5206ba2..1a5ef90 100644
--- a/keystore/tests/auth_token_table_test.cpp
+++ b/keystore/tests/auth_token_table_test.cpp
@@ -26,7 +26,7 @@
 namespace keystore {
 namespace test {
 
-class StdoutLogger : public keymaster::Logger {
+class StdoutLogger : public ::keymaster::Logger {
   public:
     StdoutLogger() { set_instance(this); }
 
@@ -62,26 +62,23 @@
     AuthTokenTable table;
 }
 
-static std::unique_ptr<const HardwareAuthToken> make_token(uint64_t rsid, uint64_t ssid = 0,
-                                                     uint64_t challenge = 0,
-                                                     uint64_t timestamp = 0) {
-    std::unique_ptr<HardwareAuthToken> token(new HardwareAuthToken);
-    token->userId = rsid;
-    token->authenticatorId = ssid;
-    token->authenticatorType = htonl(static_cast<uint32_t>(HardwareAuthenticatorType::PASSWORD));
-    token->challenge = challenge;
-    token->timestamp = htonq(timestamp);
+HardwareAuthToken make_token(uint64_t rsid, uint64_t ssid = 0, uint64_t challenge = 0,
+                             uint64_t timestamp = 0) {
+    HardwareAuthToken token;
+    token.userId = rsid;
+    token.authenticatorId = ssid;
+    token.authenticatorType = HardwareAuthenticatorType::PASSWORD;
+    token.challenge = challenge;
+    token.timestamp = timestamp;
     return token;
 }
 
 static AuthorizationSet make_set(uint64_t rsid, uint32_t timeout = 10000) {
     AuthorizationSetBuilder builder;
-    builder.Authorization(TAG_USER_ID, 10)
-        .Authorization(TAG_USER_AUTH_TYPE, HardwareAuthenticatorType::PASSWORD)
+    builder.Authorization(TAG_USER_AUTH_TYPE, HardwareAuthenticatorType::PASSWORD)
         .Authorization(TAG_USER_SECURE_ID, rsid);
     // Use timeout == 0 to indicate tags that require auth per operation.
-    if (timeout != 0)
-        builder.Authorization(TAG_AUTH_TIMEOUT, timeout);
+    if (timeout != 0) builder.Authorization(TAG_AUTH_TIMEOUT, timeout);
     return builder;
 }
 
@@ -101,19 +98,23 @@
 
     const HardwareAuthToken* found;
 
-    ASSERT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
+    ASSERT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
     EXPECT_EQ(1U, found->userId);
     EXPECT_EQ(2U, found->authenticatorId);
 
-    ASSERT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
+    ASSERT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
     EXPECT_EQ(1U, found->userId);
     EXPECT_EQ(2U, found->authenticatorId);
 
-    ASSERT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
+    ASSERT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
     EXPECT_EQ(3U, found->userId);
     EXPECT_EQ(4U, found->authenticatorId);
 
-    ASSERT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(4), KeyPurpose::SIGN, 0, &found));
+    ASSERT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(4), KeyPurpose::SIGN, 0, &found));
     EXPECT_EQ(3U, found->userId);
     EXPECT_EQ(4U, found->authenticatorId);
 
@@ -132,9 +133,12 @@
 
     // All three should be in the table.
     EXPECT_EQ(3U, table.size());
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
 
     table.Clear();
     EXPECT_EQ(0U, table.size());
@@ -151,9 +155,12 @@
 
     // All three should be in the table.
     EXPECT_EQ(3U, table.size());
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
 
     table.AddAuthenticationToken(make_token(4));
 
@@ -164,9 +171,12 @@
 
     // Others should be there, including the new one (4).  Search for it first, then the others, so
     // 4 becomes the least recently used.
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(4), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(4), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
 
     table.AddAuthenticationToken(make_token(5));
 
@@ -174,9 +184,12 @@
     EXPECT_EQ(3U, table.size());
     EXPECT_EQ(AuthTokenTable::AUTH_TOKEN_NOT_FOUND,
               table.FindAuthorization(make_set(4), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(5), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(5), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
 
     table.AddAuthenticationToken(make_token(6));
     table.AddAuthenticationToken(make_token(7));
@@ -187,9 +200,12 @@
               table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
     EXPECT_EQ(AuthTokenTable::AUTH_TOKEN_NOT_FOUND,
               table.FindAuthorization(make_set(5), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(6), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(7), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(6), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(7), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(3), KeyPurpose::SIGN, 0, &found));
 
     table.AddAuthenticationToken(make_token(8));
     table.AddAuthenticationToken(make_token(9));
@@ -211,8 +227,10 @@
               table.FindAuthorization(make_set(6), KeyPurpose::SIGN, 0, &found));
     EXPECT_EQ(AuthTokenTable::AUTH_TOKEN_NOT_FOUND,
               table.FindAuthorization(make_set(7), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(8), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(9), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(8), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(9), KeyPurpose::SIGN, 0, &found));
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(10), KeyPurpose::SIGN, 0, &found));
 }
@@ -222,9 +240,8 @@
     const HardwareAuthToken* found;
 
     EXPECT_EQ(AuthTokenTable::AUTH_NOT_REQUIRED,
-              table.FindAuthorization(
-                  AuthorizationSetBuilder().Authorization(TAG_NO_AUTH_REQUIRED),
-                  KeyPurpose::SIGN, 0 /* no challenge */, &found));
+              table.FindAuthorization(AuthorizationSetBuilder().Authorization(TAG_NO_AUTH_REQUIRED),
+                                      KeyPurpose::SIGN, 0 /* no challenge */, &found));
 }
 
 TEST(AuthTokenTableTest, OperationHandleNotFound) {
@@ -306,8 +323,9 @@
     table.AddAuthenticationToken(make_token(1, 0, 0, 0));
     table.AddAuthenticationToken(make_token(1, 0, 0, 1));
     EXPECT_EQ(1U, table.size());
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(1U, ntohq(found->timestamp));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(1U, found->timestamp);
 
     // Add a third token, this with a different RSID.  It should not be superseded.
     table.AddAuthenticationToken(make_token(2, 0, 0, 2));
@@ -317,10 +335,12 @@
     table.AddAuthenticationToken(make_token(1, 0, 0, 3));
     table.AddAuthenticationToken(make_token(2, 0, 0, 4));
     EXPECT_EQ(2U, table.size());
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(3U, ntohq(found->timestamp));
-    EXPECT_EQ(AuthTokenTable::OK, table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
-    EXPECT_EQ(4U, ntohq(found->timestamp));
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(3U, found->timestamp);
+    EXPECT_EQ(AuthTokenTable::OK,
+              table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0, &found));
+    EXPECT_EQ(4U, found->timestamp);
 
     // Add another, this one with a challenge value.  It should supersede the old one since it is
     // newer, and matches other than the challenge.
@@ -337,11 +357,11 @@
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1, 0 /* no timeout*/), KeyPurpose::SIGN,
                                       1 /* challenge */, &found));
-    EXPECT_EQ(5U, ntohq(found->timestamp));
+    EXPECT_EQ(5U, found->timestamp);
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1, 0 /* no timeout */), KeyPurpose::SIGN,
                                       2 /* challenge */, &found));
-    EXPECT_EQ(6U, ntohq(found->timestamp));
+    EXPECT_EQ(6U, found->timestamp);
 
     // Add another, without a challenge, and the same timestamp as the last one.  This new one
     // actually could be considered already-superseded, but the table doesn't handle that case,
@@ -350,7 +370,7 @@
     EXPECT_EQ(4U, table.size());
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0 /* challenge */, &found));
-    EXPECT_EQ(6U, ntohq(found->timestamp));
+    EXPECT_EQ(6U, found->timestamp);
 
     // Add another without a challenge but an increased timestamp. This should supersede the
     // previous challenge-free entry.
@@ -359,10 +379,10 @@
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1, 0 /* no timeout */), KeyPurpose::SIGN,
                                       2 /* challenge */, &found));
-    EXPECT_EQ(6U, ntohq(found->timestamp));
+    EXPECT_EQ(6U, found->timestamp);
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0 /* challenge */, &found));
-    EXPECT_EQ(7U, ntohq(found->timestamp));
+    EXPECT_EQ(7U, found->timestamp);
 
     // Mark the entry with challenge 2 as complete.  Since there's a newer challenge-free entry, the
     // challenge entry will be superseded.
@@ -373,7 +393,7 @@
                                       2 /* challenge */, &found));
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0 /* challenge */, &found));
-    EXPECT_EQ(7U, ntohq(found->timestamp));
+    EXPECT_EQ(7U, found->timestamp);
 
     // Add another SID 1 entry with a challenge.  It supersedes the previous SID 1 entry with
     // no challenge (timestamp 7), but not the one with challenge 1 (timestamp 5).
@@ -383,17 +403,17 @@
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1, 0 /* no timeout */), KeyPurpose::SIGN,
                                       1 /* challenge */, &found));
-    EXPECT_EQ(5U, ntohq(found->timestamp));
+    EXPECT_EQ(5U, found->timestamp);
 
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1, 0 /* no timeout */), KeyPurpose::SIGN,
                                       3 /* challenge */, &found));
-    EXPECT_EQ(8U, ntohq(found->timestamp));
+    EXPECT_EQ(8U, found->timestamp);
 
     // SID 2 entry is still there.
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(2), KeyPurpose::SIGN, 0 /* challenge */, &found));
-    EXPECT_EQ(4U, ntohq(found->timestamp));
+    EXPECT_EQ(4U, found->timestamp);
 
     // Mark the entry with challenge 3 as complete.  Since the older challenge 1 entry is
     // incomplete, nothing is superseded.
@@ -403,11 +423,11 @@
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1, 0 /* no timeout */), KeyPurpose::SIGN,
                                       1 /* challenge */, &found));
-    EXPECT_EQ(5U, ntohq(found->timestamp));
+    EXPECT_EQ(5U, found->timestamp);
 
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0 /* challenge */, &found));
-    EXPECT_EQ(8U, ntohq(found->timestamp));
+    EXPECT_EQ(8U, found->timestamp);
 
     // Mark the entry with challenge 1 as complete.  Since there's a newer one (with challenge 3,
     // completed), the challenge 1 entry is superseded and removed.
@@ -418,8 +438,8 @@
                                       1 /* challenge */, &found));
     EXPECT_EQ(AuthTokenTable::OK,
               table.FindAuthorization(make_set(1), KeyPurpose::SIGN, 0 /* challenge */, &found));
-    EXPECT_EQ(8U, ntohq(found->timestamp));
+    EXPECT_EQ(8U, found->timestamp);
 }
 
-}  // namespace keymaster
 }  // namespace test
+}  // namespace keystore