commit 52e103c8de943ab28f1cb8fc848e39b6bb5a6d4b
author android-build-team Robot <android-build-team-robot@google.com> Wed Mar 28 07:21:29 2018 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Wed Mar 28 07:21:29 2018 +0000
tree cfd9a032c4283d1e88859beac46090a2701a22a2
parent 2d0bca3f55e93e39a1dd57e42b0a594611a09744
parent 4a1da2f371de41a397a019020d402b95b0d9dd7e

Snap for 4683893 from 4a1da2f371de41a397a019020d402b95b0d9dd7e to pi-release

Change-Id: I0b40e14a9e675c52da5e2d62e3370f1d6c4032b5

keystore/key_store_service.cpp

diff --git a/keystore/key_store_service.cpp b/keystore/key_store_service.cpp
index 1b927b8..3e8783b 100644
--- a/keystore/key_store_service.cpp
+++ b/keystore/key_store_service.cpp
@@ -818,6 +818,16 @@
     if (!error.isOk()) {
         ALOGE("Failed to generate key -> falling back to software keymaster");
         securityLevel = SecurityLevel::SOFTWARE;
+
+        // No fall back for 3DES
+        for (auto& param : params.getParameters()) {
+            auto algorithm = authorizationValue(TAG_ALGORITHM, param);
+            if (algorithm.isOk() && algorithm.value() == Algorithm::TRIPLE_DES) {
+                *aidl_return = static_cast<int32_t>(ErrorCode::UNSUPPORTED_ALGORITHM);
+                return Status::ok();
+            }
+        }
+
         auto fallback = mKeyStore->getFallbackDevice();
         if (!fallback) {
             *aidl_return = static_cast<int32_t>(error);
@@ -1031,6 +1041,16 @@
     if (!error.isOk()) {
         ALOGE("Failed to import key -> falling back to software keymaster");
         securityLevel = SecurityLevel::SOFTWARE;
+
+        // No fall back for 3DES
+        for (auto& param : params.getParameters()) {
+            auto algorithm = authorizationValue(TAG_ALGORITHM, param);
+            if (algorithm.isOk() && algorithm.value() == Algorithm::TRIPLE_DES) {
+                *aidl_return = static_cast<int32_t>(ErrorCode::UNSUPPORTED_ALGORITHM);
+                return Status::ok();
+            }
+        }
+
         auto fallback = mKeyStore->getFallbackDevice();
         if (!fallback) {
             *aidl_return = static_cast<int32_t>(error);