commit 634a1aac20ab5970e731c41010520260e7a66c3c
author Bartosz Fabianowski <bartfab@google.com> Mon Mar 20 14:02:32 2017 +0100
committer Bartosz Fabianowski <bartfab@google.com> Mon Mar 20 14:02:36 2017 +0100
tree 70d96b14f4d802745a7a12f5353cb2888ab3b1fa
parent 7675c9f2c7b62f5a127fd06af83223482ff9b594

Add manufacturer and model to device ID attestation

Discussions have shown that in addition to brand, device and product,
we should also allow devices to attest their manufacturer and model.

Bug: 36433192
Test: GTS com.google.android.gts.security.DeviceIdAttestationHostTest

Change-Id: I28ee51d9f95c3e4efb8932f3c9b899082eb62e55

keystore/key_store_service.cpp

diff --git a/keystore/key_store_service.cpp b/keystore/key_store_service.cpp
index 48b580c..cd81674 100644
--- a/keystore/key_store_service.cpp
+++ b/keystore/key_store_service.cpp
@@ -1250,6 +1250,8 @@
             case Tag::ATTESTATION_ID_SERIAL:
             case Tag::ATTESTATION_ID_IMEI:
             case Tag::ATTESTATION_ID_MEID:
+            case Tag::ATTESTATION_ID_MANUFACTURER:
+            case Tag::ATTESTATION_ID_MODEL:
                 return true;
             default:
                 break;

keystore/keymaster_enforcement.cpp

diff --git a/keystore/keymaster_enforcement.cpp b/keystore/keymaster_enforcement.cpp
index 8333860..4cee57d 100644
--- a/keystore/keymaster_enforcement.cpp
+++ b/keystore/keymaster_enforcement.cpp
@@ -295,6 +295,8 @@
         case Tag::ATTESTATION_ID_SERIAL:
         case Tag::ATTESTATION_ID_IMEI:
         case Tag::ATTESTATION_ID_MEID:
+        case Tag::ATTESTATION_ID_MANUFACTURER:
+        case Tag::ATTESTATION_ID_MODEL:
             return ErrorCode::INVALID_KEY_BLOB;
 
         /* Tags used for cryptographic parameters in keygen.  Nothing to enforce. */

keystore/legacy_keymaster_device_wrapper.cpp

diff --git a/keystore/legacy_keymaster_device_wrapper.cpp b/keystore/legacy_keymaster_device_wrapper.cpp
index 440eb50..c57bfed 100644
--- a/keystore/legacy_keymaster_device_wrapper.cpp
+++ b/keystore/legacy_keymaster_device_wrapper.cpp
@@ -356,6 +356,8 @@
             case Tag::ATTESTATION_ID_SERIAL:
             case Tag::ATTESTATION_ID_IMEI:
             case Tag::ATTESTATION_ID_MEID:
+            case Tag::ATTESTATION_ID_MANUFACTURER:
+            case Tag::ATTESTATION_ID_MODEL:
                 // Device id attestation may only be supported if the device is able to permanently
                 // destroy its knowledge of the ids. This device is unable to do this, so it must
                 // never perform any device id attestation.