Remove incorrect/confusing Certificate use
The `Certificate` type from the KeyMint AIDL is intended to hold a
single DER-encoded certificate, but some of the RKP-handling code
re-uses it to hold a concatenated cert chain.
Remove as many of these incorrect/misleading uses of the AIDL
`Certificate` type as possible, and add comments for the ones remaining.
Flag: none, comments + pure refactor
Test: keystore2_client_tests
Change-Id: Id159078f31dd892d51596cc67308ced27fadd968
diff --git a/keystore2/src/remote_provisioning.rs b/keystore2/src/remote_provisioning.rs
index cda93b3..2bdafd4 100644
--- a/keystore2/src/remote_provisioning.rs
+++ b/keystore2/src/remote_provisioning.rs
@@ -20,9 +20,8 @@
//! DB.
use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
- Algorithm::Algorithm, AttestationKey::AttestationKey, Certificate::Certificate,
- KeyParameter::KeyParameter, KeyParameterValue::KeyParameterValue, SecurityLevel::SecurityLevel,
- Tag::Tag,
+ Algorithm::Algorithm, AttestationKey::AttestationKey, KeyParameter::KeyParameter,
+ KeyParameterValue::KeyParameterValue, SecurityLevel::SecurityLevel, Tag::Tag,
};
use android_security_rkp_aidl::aidl::android::security::rkp::RemotelyProvisionedKey::RemotelyProvisionedKey;
use android_system_keystore2::aidl::android::system::keystore2::{
@@ -85,7 +84,7 @@
key: &KeyDescriptor,
caller_uid: u32,
params: &[KeyParameter],
- ) -> Result<Option<(AttestationKey, Certificate)>> {
+ ) -> Result<Option<(AttestationKey, Vec<u8>)>> {
if !self.is_asymmetric_key(params) || key.domain != Domain::APP {
Ok(None)
} else {
@@ -106,13 +105,14 @@
AttestationKey {
keyBlob: rkpd_key.keyBlob,
attestKeyParams: vec![],
- // Batch certificate is at the beginning of the certificate chain.
+ // Batch certificate is at the beginning of the concatenated certificate
+ // chain, and the helper function only looks at the first cert.
issuerSubjectName: parse_subject_from_certificate(
&rkpd_key.encodedCertChain,
)
.context(ks_err!("Failed to parse subject."))?,
},
- Certificate { encodedCertificate: rkpd_key.encodedCertChain },
+ rkpd_key.encodedCertChain,
))),
}
}