commit 8d5b2539464a0e198de24b01cc72d681cb302211
author Paul Crowley <paulcrowley@google.com> Fri Mar 19 10:53:07 2021 -0700
committer Paul Crowley <paulcrowley@google.com> Wed Mar 24 14:40:14 2021 -0700
tree 258d1a80737d8b2fe298480609b164f2fc590236
parent 7a65839abae7d6f425735b83602573e43824152a

Encrypt keys even when device locked

Use ECDH public-key encryption to encrypt unlockedDeviceRequired keys
even when the device is locked.

Bug: 163866361
Test: keystore2_test
Test: atest android.keystore.cts.CipherTest#testEmptyPlaintextEncryptsAndDecryptsWhenUnlockedRequired
Change-Id: Idbb3e02972aba021d97c5284c300d3b5e97756ae

keystore2/src/maintenance.rs

diff --git a/keystore2/src/maintenance.rs b/keystore2/src/maintenance.rs
index f5f9fd5..e059a0b 100644
--- a/keystore2/src/maintenance.rs
+++ b/keystore2/src/maintenance.rs
@@ -55,9 +55,9 @@
 
         if let Some(pw) = password.as_ref() {
             DB.with(|db| {
-                SUPER_KEY.ensure_super_key_created(&mut db.borrow_mut(), user_id as u32, pw)
+                SUPER_KEY.unlock_screen_lock_bound_key(&mut db.borrow_mut(), user_id as u32, pw)
             })
-            .context("In on_user_password_changed: ensure_super_key_created failed")?;
+            .context("In on_user_password_changed: unlock_screen_lock_bound_key failed")?;
         }
 
         match DB