blob: 8c4cdea7b387b40e39bcaabb949c3a50d1a9543f [file] [log] [blame]
Janis Danisevskis3541f3e2021-03-20 14:18:52 -07001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Implements get_attestation_key_info which loads remote provisioned or user
16//! generated attestation keys.
17
18use crate::database::{BlobMetaData, KeyEntryLoadBits, KeyType};
19use crate::database::{KeyIdGuard, KeystoreDB};
20use crate::error::{Error, ErrorCode};
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +000021use crate::ks_err;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070022use crate::permission::KeyPerm;
23use crate::remote_provisioning::RemProvState;
24use crate::utils::check_key_permission;
25use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
Max Bires18b1db52021-06-24 20:56:36 -070026 AttestationKey::AttestationKey, Certificate::Certificate, KeyParameter::KeyParameter, Tag::Tag,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070027};
28use android_system_keystore2::aidl::android::system::keystore2::{
Rajesh Nyamagoud2d532d92022-10-21 18:59:40 +000029 Domain::Domain, KeyDescriptor::KeyDescriptor, ResponseCode::ResponseCode,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070030};
31use anyhow::{Context, Result};
32use keystore2_crypto::parse_subject_from_certificate;
Seth Moore5dac3862023-01-24 08:58:17 -080033use rustutils::system_properties;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070034
35/// KeyMint takes two different kinds of attestation keys. Remote provisioned keys
36/// and those that have been generated by the user. Unfortunately, they need to be
37/// handled quite differently, thus the different representations.
38pub enum AttestationKeyInfo {
39 RemoteProvisioned {
Max Bires55620ff2022-02-11 13:34:15 -080040 key_id_guard: KeyIdGuard,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070041 attestation_key: AttestationKey,
42 attestation_certs: Certificate,
43 },
Tri Vob5e43d12022-12-21 08:54:14 -080044 RkpdProvisioned {
45 attestation_key: AttestationKey,
46 attestation_certs: Certificate,
47 },
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070048 UserGenerated {
49 key_id_guard: KeyIdGuard,
50 blob: Vec<u8>,
51 blob_metadata: BlobMetaData,
52 issuer_subject: Vec<u8>,
53 },
54}
55
Tri Vob5e43d12022-12-21 08:54:14 -080056fn use_rkpd() -> bool {
Tri Vof02e4d62023-01-30 16:05:29 -080057 let property = "remote_provisioning.enable_rkpd";
58 let default_value = true;
59 system_properties::read_bool(property, default_value).unwrap_or(default_value)
Tri Vob5e43d12022-12-21 08:54:14 -080060}
61
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070062/// This function loads and, optionally, assigns the caller's remote provisioned
Max Bires18b1db52021-06-24 20:56:36 -070063/// attestation key if a challenge is present. Alternatively, if `attest_key_descriptor` is given,
64/// it loads the user generated attestation key from the database.
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070065pub fn get_attest_key_info(
66 key: &KeyDescriptor,
67 caller_uid: u32,
68 attest_key_descriptor: Option<&KeyDescriptor>,
69 params: &[KeyParameter],
70 rem_prov_state: &RemProvState,
71 db: &mut KeystoreDB,
72) -> Result<Option<AttestationKeyInfo>> {
Max Bires18b1db52021-06-24 20:56:36 -070073 let challenge_present = params.iter().any(|kp| kp.tag == Tag::ATTESTATION_CHALLENGE);
Max Bires285db9f2022-06-20 00:03:32 -070074 let is_device_unique_attestation =
75 params.iter().any(|kp| kp.tag == Tag::DEVICE_UNIQUE_ATTESTATION);
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070076 match attest_key_descriptor {
Max Bires285db9f2022-06-20 00:03:32 -070077 // Do not select an RKP key if DEVICE_UNIQUE_ATTESTATION is present.
Tri Vob5e43d12022-12-21 08:54:14 -080078 None if challenge_present && !is_device_unique_attestation => {
79 if use_rkpd() {
80 rem_prov_state
81 .get_rkpd_attestation_key_and_certs(key, caller_uid, params)
82 .context(ks_err!("Trying to get attestation key from RKPD."))
83 .map(|result| {
84 result.map(|(attestation_key, attestation_certs)| {
85 AttestationKeyInfo::RkpdProvisioned {
86 attestation_key,
87 attestation_certs,
88 }
89 })
90 })
91 } else {
92 rem_prov_state
93 .get_remotely_provisioned_attestation_key_and_certs(key, caller_uid, params, db)
94 .context(ks_err!("Trying to get remotely provisioned attestation key."))
95 .map(|result| {
96 result.map(|(key_id_guard, attestation_key, attestation_certs)| {
97 AttestationKeyInfo::RemoteProvisioned {
98 key_id_guard,
99 attestation_key,
100 attestation_certs,
101 }
102 })
103 })
104 }
105 }
Max Bires18b1db52021-06-24 20:56:36 -0700106 None => Ok(None),
Chris Wailesd5aaaef2021-07-27 16:04:33 -0700107 Some(attest_key) => get_user_generated_attestation_key(attest_key, caller_uid, db)
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000108 .context(ks_err!("Trying to load attest key"))
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700109 .map(Some),
110 }
111}
112
113fn get_user_generated_attestation_key(
114 key: &KeyDescriptor,
115 caller_uid: u32,
116 db: &mut KeystoreDB,
117) -> Result<AttestationKeyInfo> {
118 let (key_id_guard, blob, cert, blob_metadata) =
Chris Wailesd5aaaef2021-07-27 16:04:33 -0700119 load_attest_key_blob_and_cert(key, caller_uid, db)
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000120 .context(ks_err!("Failed to load blob and cert"))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700121
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000122 let issuer_subject: Vec<u8> = parse_subject_from_certificate(&cert)
123 .context(ks_err!("Failed to parse subject from certificate"))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700124
125 Ok(AttestationKeyInfo::UserGenerated { key_id_guard, blob, issuer_subject, blob_metadata })
126}
127
128fn load_attest_key_blob_and_cert(
129 key: &KeyDescriptor,
130 caller_uid: u32,
131 db: &mut KeystoreDB,
132) -> Result<(KeyIdGuard, Vec<u8>, Vec<u8>, BlobMetaData)> {
133 match key.domain {
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000134 Domain::BLOB => Err(Error::Km(ErrorCode::INVALID_ARGUMENT))
135 .context(ks_err!("Domain::BLOB attestation keys not supported")),
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700136 _ => {
137 let (key_id_guard, mut key_entry) = db
138 .load_key_entry(
Chris Wailesd5aaaef2021-07-27 16:04:33 -0700139 key,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700140 KeyType::Client,
141 KeyEntryLoadBits::BOTH,
142 caller_uid,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700143 |k, av| check_key_permission(KeyPerm::Use, k, &av),
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700144 )
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000145 .context(ks_err!("Failed to load key."))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700146
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000147 let (blob, blob_metadata) = key_entry
148 .take_key_blob_info()
Rajesh Nyamagoud2d532d92022-10-21 18:59:40 +0000149 .ok_or(Error::Rc(ResponseCode::INVALID_ARGUMENT))
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000150 .context(ks_err!("Successfully loaded key entry, but KM blob was missing"))?;
151 let cert = key_entry
152 .take_cert()
Rajesh Nyamagoud2d532d92022-10-21 18:59:40 +0000153 .ok_or(Error::Rc(ResponseCode::INVALID_ARGUMENT))
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000154 .context(ks_err!("Successfully loaded key entry, but cert was missing"))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700155 Ok((key_id_guard, blob, cert, blob_metadata))
156 }
157 }
158}