Keystore and KeyMint version bump
Bug: 369375199
Test: Builds
Ignore-AOSP-First: Lands with other HAL version bump changes to avoid
build failure. At least one of the changes is internal. Will
cherry-pick to AOSP ASAP.
Change-Id: I46b6cc227ef7484932f298733efd73ec7dec2cf3
diff --git a/keystore2/aidl/Android.bp b/keystore2/aidl/Android.bp
index afc2743..13bf455 100644
--- a/keystore2/aidl/Android.bp
+++ b/keystore2/aidl/Android.bp
@@ -24,8 +24,8 @@
aidl_interface {
name: "android.security.authorization",
srcs: ["android/security/authorization/*.aidl"],
+ defaults: ["android.hardware.security.keymint-latest-defaults"],
imports: [
- "android.hardware.security.keymint-V3",
"android.hardware.security.secureclock-V1",
],
unstable: true,
@@ -63,8 +63,8 @@
aidl_interface {
name: "android.security.compat",
srcs: ["android/security/compat/*.aidl"],
+ defaults: ["android.hardware.security.keymint-latest-defaults"],
imports: [
- "android.hardware.security.keymint-V3",
"android.hardware.security.secureclock-V1",
"android.hardware.security.sharedsecret-V1",
],
@@ -86,8 +86,8 @@
aidl_interface {
name: "android.security.maintenance",
srcs: ["android/security/maintenance/*.aidl"],
- imports: [
- "android.system.keystore2-V4",
+ defaults: [
+ "android.system.keystore2-latest-defaults",
],
unstable: true,
backend: {
@@ -145,8 +145,8 @@
aidl_interface {
name: "android.security.metrics",
srcs: ["android/security/metrics/*.aidl"],
- imports: [
- "android.system.keystore2-V4",
+ defaults: [
+ "android.system.keystore2-latest-defaults",
],
unstable: true,
backend: {
@@ -169,21 +169,21 @@
java_defaults {
name: "keystore2_use_latest_aidl_java_static",
static_libs: [
- "android.system.keystore2-V4-java-source",
+ "android.system.keystore2-V5-java-source",
],
}
java_defaults {
name: "keystore2_use_latest_aidl_java_shared",
libs: [
- "android.system.keystore2-V4-java-source",
+ "android.system.keystore2-V5-java-source",
],
}
java_defaults {
name: "keystore2_use_latest_aidl_java",
libs: [
- "android.system.keystore2-V4-java",
+ "android.system.keystore2-V5-java",
],
}
@@ -193,28 +193,28 @@
cc_defaults {
name: "keystore2_use_latest_aidl_ndk_static",
static_libs: [
- "android.system.keystore2-V4-ndk",
+ "android.system.keystore2-V5-ndk",
],
}
cc_defaults {
name: "keystore2_use_latest_aidl_ndk_shared",
shared_libs: [
- "android.system.keystore2-V4-ndk",
+ "android.system.keystore2-V5-ndk",
],
}
cc_defaults {
name: "keystore2_use_latest_aidl_cpp_shared",
shared_libs: [
- "android.system.keystore2-V4-cpp",
+ "android.system.keystore2-V5-cpp",
],
}
cc_defaults {
name: "keystore2_use_latest_aidl_cpp_static",
static_libs: [
- "android.system.keystore2-V4-cpp",
+ "android.system.keystore2-V5-cpp",
],
}
@@ -224,6 +224,6 @@
rust_defaults {
name: "keystore2_use_latest_aidl_rust",
rustlibs: [
- "android.system.keystore2-V4-rust",
+ "android.system.keystore2-V5-rust",
],
}
diff --git a/keystore2/android.system.keystore2-service.xml b/keystore2/android.system.keystore2-service.xml
index 4d8a756..35b9cc8 100644
--- a/keystore2/android.system.keystore2-service.xml
+++ b/keystore2/android.system.keystore2-service.xml
@@ -1,7 +1,7 @@
<manifest version="1.0" type="framework">
<hal format="aidl">
<name>android.system.keystore2</name>
- <version>4</version>
+ <version>5</version>
<interface>
<name>IKeystoreService</name>
<instance>default</instance>
diff --git a/keystore2/src/globals.rs b/keystore2/src/globals.rs
index 39d6f9c..0e8892b 100644
--- a/keystore2/src/globals.rs
+++ b/keystore2/src/globals.rs
@@ -271,17 +271,8 @@
// If the KeyMint device is back-level, use a wrapper that intercepts and
// emulates things that are not supported by the hardware.
let keymint = match hal_version {
- Some(300) => {
- // Current KeyMint version: use as-is as v3 Keymint is current version
- log::info!(
- "KeyMint device is current version ({:?}) for security level: {:?}",
- hal_version,
- security_level
- );
- keymint
- }
- Some(200) => {
- // Previous KeyMint version: use as-is as we don't have any software emulation of v3-specific KeyMint features.
+ Some(400) | Some(300) | Some(200) => {
+ // KeyMint v2+: use as-is (we don't have any software emulation of v3 or v4-specific KeyMint features).
log::info!(
"KeyMint device is current version ({:?}) for security level: {:?}",
hal_version,
diff --git a/keystore2/src/km_compat.rs b/keystore2/src/km_compat.rs
index 5e3bdfa..95e9294 100644
--- a/keystore2/src/km_compat.rs
+++ b/keystore2/src/km_compat.rs
@@ -214,6 +214,12 @@
fn sendRootOfTrust(&self, root_of_trust: &[u8]) -> binder::Result<()> {
self.real.sendRootOfTrust(root_of_trust)
}
+ fn setAdditionalAttestationInfo(
+ &self,
+ additional_attestation_info: &[KeyParameter],
+ ) -> binder::Result<()> {
+ self.real.setAdditionalAttestationInfo(additional_attestation_info)
+ }
// For methods that emit keyblobs, check whether the underlying real device
// supports the relevant parameters, and forward to the appropriate device.
diff --git a/keystore2/src/km_compat/km_compat.cpp b/keystore2/src/km_compat/km_compat.cpp
index e9ff1ff..7a6ef4a 100644
--- a/keystore2/src/km_compat/km_compat.cpp
+++ b/keystore2/src/km_compat/km_compat.cpp
@@ -839,6 +839,11 @@
return convertErrorCode(KMV1::ErrorCode::UNIMPLEMENTED);
}
+ScopedAStatus KeyMintDevice::setAdditionalAttestationInfo(
+ const std::vector<KeyParameter>& /* additionalAttestationInfo */) {
+ return convertErrorCode(KMV1::ErrorCode::UNIMPLEMENTED);
+}
+
ScopedAStatus KeyMintOperation::updateAad(const std::vector<uint8_t>& input,
const std::optional<HardwareAuthToken>& optAuthToken,
const std::optional<TimeStampToken>& optTimeStampToken) {
diff --git a/keystore2/src/km_compat/km_compat.h b/keystore2/src/km_compat/km_compat.h
index c4bcdaa..71f7fbe 100644
--- a/keystore2/src/km_compat/km_compat.h
+++ b/keystore2/src/km_compat/km_compat.h
@@ -147,6 +147,9 @@
std::vector<uint8_t>* rootOfTrust);
ScopedAStatus sendRootOfTrust(const std::vector<uint8_t>& rootOfTrust);
+ ScopedAStatus
+ setAdditionalAttestationInfo(const std::vector<KeyParameter>& additionalAttestationInfo);
+
// These are public to allow testing code to use them directly.
// This class should not be used publicly anyway.
std::variant<std::vector<Certificate>, KMV1_ErrorCode>
diff --git a/keystore2/src/km_compat/km_compat_type_conversion.h b/keystore2/src/km_compat/km_compat_type_conversion.h
index 5db7e3d..d6a2dcc 100644
--- a/keystore2/src/km_compat/km_compat_type_conversion.h
+++ b/keystore2/src/km_compat/km_compat_type_conversion.h
@@ -750,8 +750,12 @@
case KMV1::Tag::CERTIFICATE_SUBJECT:
case KMV1::Tag::CERTIFICATE_NOT_BEFORE:
case KMV1::Tag::CERTIFICATE_NOT_AFTER:
+ // These tags do not exist in KM < KeyMint 1.
+ break;
case KMV1::Tag::ATTESTATION_ID_SECOND_IMEI:
- // These tags do not exist in KM < KeyMint 1.0.
+ // This tag doesn't exist in KM < KeyMint 3.
+ case KMV1::Tag::MODULE_HASH:
+ // This tag doesn't exist in KM < KeyMint 4.
break;
case KMV1::Tag::MAX_BOOT_LEVEL:
// Does not exist in API level 30 or below.
diff --git a/keystore2/test_utils/Android.bp b/keystore2/test_utils/Android.bp
index d0b5540..57da27f 100644
--- a/keystore2/test_utils/Android.bp
+++ b/keystore2/test_utils/Android.bp
@@ -62,8 +62,8 @@
static_libs: [
// Also include static_libs for the NDK variants so that they are available
// for dependencies.
- "android.system.keystore2-V4-ndk",
- "android.hardware.security.keymint-V3-ndk",
+ "android.system.keystore2-V5-ndk",
+ "android.hardware.security.keymint-V4-ndk",
],
}
diff --git a/keystore2/tests/Android.bp b/keystore2/tests/Android.bp
index 0406a71..f18824b 100644
--- a/keystore2/tests/Android.bp
+++ b/keystore2/tests/Android.bp
@@ -31,8 +31,8 @@
static_libs: [
// Also include static_libs for the NDK variants so that they are available
// for dependencies.
- "android.system.keystore2-V4-ndk",
- "android.hardware.security.keymint-V3-ndk",
+ "android.system.keystore2-V5-ndk",
+ "android.hardware.security.keymint-V4-ndk",
],
srcs: ["keystore2_client_tests.rs"],
test_suites: [