Cryptographic security for MAX_BOOT_LEVEL
Use a KDF to generate a key for each boot level, anchored in a key
which can only be used once per boot.
Bug: 176450483
Test: aosp/1577966: ensure key created at level 40 stops working at 41
Test: keystore2_test
Change-Id: I12530cd13cb176251c8a0b5431d53c0a7c1bc02d
diff --git a/keystore2/src/database.rs b/keystore2/src/database.rs
index 6a07716..f673d17 100644
--- a/keystore2/src/database.rs
+++ b/keystore2/src/database.rs
@@ -186,6 +186,9 @@
KmUuid(Uuid) with accessor km_uuid,
/// If the key is ECDH encrypted, this is the ephemeral public key
PublicKey(Vec<u8>) with accessor public_key,
+ /// If the key is encrypted with a MaxBootLevel key, this is the boot level
+ /// of that key
+ MaxBootLevel(i32) with accessor max_boot_level,
// --- ADD NEW META DATA FIELDS HERE ---
// For backwards compatibility add new entries only to
// end of this list and above this comment.