blob: d31fa824960a76ab42df9d6949af17de48c87a29 [file] [log] [blame]
Janis Danisevskis3541f3e2021-03-20 14:18:52 -07001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Implements get_attestation_key_info which loads remote provisioned or user
16//! generated attestation keys.
17
18use crate::database::{BlobMetaData, KeyEntryLoadBits, KeyType};
19use crate::database::{KeyIdGuard, KeystoreDB};
20use crate::error::{Error, ErrorCode};
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +000021use crate::ks_err;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070022use crate::permission::KeyPerm;
23use crate::remote_provisioning::RemProvState;
24use crate::utils::check_key_permission;
25use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
Max Bires18b1db52021-06-24 20:56:36 -070026 AttestationKey::AttestationKey, Certificate::Certificate, KeyParameter::KeyParameter, Tag::Tag,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070027};
28use android_system_keystore2::aidl::android::system::keystore2::{
Rajesh Nyamagoud2d532d92022-10-21 18:59:40 +000029 Domain::Domain, KeyDescriptor::KeyDescriptor, ResponseCode::ResponseCode,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070030};
31use anyhow::{Context, Result};
32use keystore2_crypto::parse_subject_from_certificate;
Seth Moore5dac3862023-01-24 08:58:17 -080033use rustutils::system_properties;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070034
35/// KeyMint takes two different kinds of attestation keys. Remote provisioned keys
36/// and those that have been generated by the user. Unfortunately, they need to be
37/// handled quite differently, thus the different representations.
38pub enum AttestationKeyInfo {
39 RemoteProvisioned {
Max Bires55620ff2022-02-11 13:34:15 -080040 key_id_guard: KeyIdGuard,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070041 attestation_key: AttestationKey,
42 attestation_certs: Certificate,
43 },
Tri Vob5e43d12022-12-21 08:54:14 -080044 RkpdProvisioned {
45 attestation_key: AttestationKey,
46 attestation_certs: Certificate,
47 },
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070048 UserGenerated {
49 key_id_guard: KeyIdGuard,
50 blob: Vec<u8>,
51 blob_metadata: BlobMetaData,
52 issuer_subject: Vec<u8>,
53 },
54}
55
Tri Vob5e43d12022-12-21 08:54:14 -080056fn use_rkpd() -> bool {
Seth Moore5dac3862023-01-24 08:58:17 -080057 let mutable_property = "persist.device_config.remote_key_provisioning_native.enable_rkpd";
58 let fixed_property = "remote_provisioning.enable_rkpd";
Tri Vob5e43d12022-12-21 08:54:14 -080059 let default_value = false;
Seth Moore5dac3862023-01-24 08:58:17 -080060 system_properties::read_bool(mutable_property, default_value).unwrap_or(default_value)
61 || system_properties::read_bool(fixed_property, default_value).unwrap_or(default_value)
Tri Vob5e43d12022-12-21 08:54:14 -080062}
63
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070064/// This function loads and, optionally, assigns the caller's remote provisioned
Max Bires18b1db52021-06-24 20:56:36 -070065/// attestation key if a challenge is present. Alternatively, if `attest_key_descriptor` is given,
66/// it loads the user generated attestation key from the database.
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070067pub fn get_attest_key_info(
68 key: &KeyDescriptor,
69 caller_uid: u32,
70 attest_key_descriptor: Option<&KeyDescriptor>,
71 params: &[KeyParameter],
72 rem_prov_state: &RemProvState,
73 db: &mut KeystoreDB,
74) -> Result<Option<AttestationKeyInfo>> {
Max Bires18b1db52021-06-24 20:56:36 -070075 let challenge_present = params.iter().any(|kp| kp.tag == Tag::ATTESTATION_CHALLENGE);
Max Bires285db9f2022-06-20 00:03:32 -070076 let is_device_unique_attestation =
77 params.iter().any(|kp| kp.tag == Tag::DEVICE_UNIQUE_ATTESTATION);
Janis Danisevskis3541f3e2021-03-20 14:18:52 -070078 match attest_key_descriptor {
Max Bires285db9f2022-06-20 00:03:32 -070079 // Do not select an RKP key if DEVICE_UNIQUE_ATTESTATION is present.
Tri Vob5e43d12022-12-21 08:54:14 -080080 None if challenge_present && !is_device_unique_attestation => {
81 if use_rkpd() {
82 rem_prov_state
83 .get_rkpd_attestation_key_and_certs(key, caller_uid, params)
84 .context(ks_err!("Trying to get attestation key from RKPD."))
85 .map(|result| {
86 result.map(|(attestation_key, attestation_certs)| {
87 AttestationKeyInfo::RkpdProvisioned {
88 attestation_key,
89 attestation_certs,
90 }
91 })
92 })
93 } else {
94 rem_prov_state
95 .get_remotely_provisioned_attestation_key_and_certs(key, caller_uid, params, db)
96 .context(ks_err!("Trying to get remotely provisioned attestation key."))
97 .map(|result| {
98 result.map(|(key_id_guard, attestation_key, attestation_certs)| {
99 AttestationKeyInfo::RemoteProvisioned {
100 key_id_guard,
101 attestation_key,
102 attestation_certs,
103 }
104 })
105 })
106 }
107 }
Max Bires18b1db52021-06-24 20:56:36 -0700108 None => Ok(None),
Chris Wailesd5aaaef2021-07-27 16:04:33 -0700109 Some(attest_key) => get_user_generated_attestation_key(attest_key, caller_uid, db)
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000110 .context(ks_err!("Trying to load attest key"))
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700111 .map(Some),
112 }
113}
114
115fn get_user_generated_attestation_key(
116 key: &KeyDescriptor,
117 caller_uid: u32,
118 db: &mut KeystoreDB,
119) -> Result<AttestationKeyInfo> {
120 let (key_id_guard, blob, cert, blob_metadata) =
Chris Wailesd5aaaef2021-07-27 16:04:33 -0700121 load_attest_key_blob_and_cert(key, caller_uid, db)
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000122 .context(ks_err!("Failed to load blob and cert"))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700123
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000124 let issuer_subject: Vec<u8> = parse_subject_from_certificate(&cert)
125 .context(ks_err!("Failed to parse subject from certificate"))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700126
127 Ok(AttestationKeyInfo::UserGenerated { key_id_guard, blob, issuer_subject, blob_metadata })
128}
129
130fn load_attest_key_blob_and_cert(
131 key: &KeyDescriptor,
132 caller_uid: u32,
133 db: &mut KeystoreDB,
134) -> Result<(KeyIdGuard, Vec<u8>, Vec<u8>, BlobMetaData)> {
135 match key.domain {
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000136 Domain::BLOB => Err(Error::Km(ErrorCode::INVALID_ARGUMENT))
137 .context(ks_err!("Domain::BLOB attestation keys not supported")),
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700138 _ => {
139 let (key_id_guard, mut key_entry) = db
140 .load_key_entry(
Chris Wailesd5aaaef2021-07-27 16:04:33 -0700141 key,
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700142 KeyType::Client,
143 KeyEntryLoadBits::BOTH,
144 caller_uid,
Janis Danisevskis39d57e72021-10-19 16:56:20 -0700145 |k, av| check_key_permission(KeyPerm::Use, k, &av),
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700146 )
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000147 .context(ks_err!("Failed to load key."))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700148
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000149 let (blob, blob_metadata) = key_entry
150 .take_key_blob_info()
Rajesh Nyamagoud2d532d92022-10-21 18:59:40 +0000151 .ok_or(Error::Rc(ResponseCode::INVALID_ARGUMENT))
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000152 .context(ks_err!("Successfully loaded key entry, but KM blob was missing"))?;
153 let cert = key_entry
154 .take_cert()
Rajesh Nyamagoud2d532d92022-10-21 18:59:40 +0000155 .ok_or(Error::Rc(ResponseCode::INVALID_ARGUMENT))
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +0000156 .context(ks_err!("Successfully loaded key entry, but cert was missing"))?;
Janis Danisevskis3541f3e2021-03-20 14:18:52 -0700157 Ok((key_id_guard, blob, cert, blob_metadata))
158 }
159 }
160}