Allow entropy to be provided to some operations
generateKey and begin can now optionally take an array of bytes to add
to the rng entropy of the device before the operation. If entropy is
specified and the device does not support add_rng_entropy or the call
fails then that device will not be used, leading to fallback or error
depending on the situation.
Change-Id: Id7d33e3cc959594dfa5483d002993ba35c1fb134
diff --git a/keystore/IKeystoreService.cpp b/keystore/IKeystoreService.cpp
index 3a23059..7be3a97 100644
--- a/keystore/IKeystoreService.cpp
+++ b/keystore/IKeystoreService.cpp
@@ -999,13 +999,15 @@
};
virtual int32_t generateKey(const String16& name, const KeymasterArguments& params,
- int uid, int flags, KeyCharacteristics* outCharacteristics)
+ const uint8_t* entropy, size_t entropyLength, int uid, int flags,
+ KeyCharacteristics* outCharacteristics)
{
Parcel data, reply;
data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
data.writeString16(name);
data.writeInt32(1);
params.writeToParcel(&data);
+ data.writeByteArray(entropyLength, entropy);
data.writeInt32(uid);
data.writeInt32(flags);
status_t status = remote()->transact(BnKeystoreService::GENERATE_KEY, data, &reply);
@@ -1131,7 +1133,8 @@
virtual void begin(const sp<IBinder>& appToken, const String16& name,
keymaster_purpose_t purpose, bool pruneable,
- const KeymasterArguments& params, KeymasterArguments* outParams,
+ const KeymasterArguments& params, const uint8_t* entropy,
+ size_t entropyLength, KeymasterArguments* outParams,
OperationResult* result)
{
if (!result || !outParams) {
@@ -1145,6 +1148,7 @@
data.writeInt32(pruneable ? 1 : 0);
data.writeInt32(1);
params.writeToParcel(&data);
+ data.writeByteArray(entropyLength, entropy);
status_t status = remote()->transact(BnKeystoreService::BEGIN, data, &reply);
if (status != NO_ERROR) {
ALOGD("begin() could not contact remote: %d\n", status);
@@ -1584,10 +1588,14 @@
if (data.readInt32() != 0) {
args.readFromParcel(data);
}
+ const uint8_t* entropy = NULL;
+ size_t entropyLength = 0;
+ readByteArray(data, &entropy, &entropyLength);
int32_t uid = data.readInt32();
int32_t flags = data.readInt32();
KeyCharacteristics outCharacteristics;
- int32_t ret = generateKey(name, args, uid, flags, &outCharacteristics);
+ int32_t ret = generateKey(name, args, entropy, entropyLength, uid, flags,
+ &outCharacteristics);
reply->writeNoException();
reply->writeInt32(ret);
reply->writeInt32(1);
@@ -1655,9 +1663,13 @@
if (data.readInt32() != 0) {
args.readFromParcel(data);
}
+ const uint8_t* entropy = NULL;
+ size_t entropyLength = 0;
+ readByteArray(data, &entropy, &entropyLength);
KeymasterArguments outArgs;
OperationResult result;
- begin(token, name, purpose, pruneable, args, &outArgs, &result);
+ begin(token, name, purpose, pruneable, args, entropy, entropyLength, &outArgs,
+ &result);
reply->writeNoException();
reply->writeInt32(1);
result.writeToParcel(reply);