blob: cb5b644ef67ae2efa258f073224593512b553f32 [file] [log] [blame]
Ethan Yonkerfefe5912017-09-30 22:22:13 -05001/*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef ANDROID_VOLD_KEYMASTER_H
18#define ANDROID_VOLD_KEYMASTER_H
19
20#ifdef __cplusplus
21
22#include <memory>
23#include <string>
24#include <utility>
25
26#include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
27#include <keystore/authorization_set.h>
28#include "Utils.h"
29
30namespace android {
31namespace vold {
32using ::android::hardware::keymaster::V3_0::IKeymasterDevice;
33using ::keystore::ErrorCode;
34using ::keystore::KeyPurpose;
35using ::keystore::AuthorizationSet;
36
37// C++ wrappers to the Keymaster hidl interface.
38// This is tailored to the needs of KeyStorage, but could be extended to be
39// a more general interface.
40
41// Wrapper for a Keymaster operation handle representing an
42// ongoing Keymaster operation. Aborts the operation
43// in the destructor if it is unfinished. Methods log failures
44// to LOG(ERROR).
45class KeymasterOperation {
46 public:
47 ~KeymasterOperation();
48 // Is this instance valid? This is false if creation fails, and becomes
49 // false on finish or if an update fails.
50 explicit operator bool() { return mError == ErrorCode::OK; }
51 ErrorCode errorCode() { return mError; }
52 // Call "update" repeatedly until all of the input is consumed, and
53 // concatenate the output. Return true on success.
54 bool updateCompletely(const std::string& input, std::string* output);
55 // Finish and write the output to this string, unless pointer is null.
56 bool finish(std::string* output);
57 // Move constructor
58 KeymasterOperation(KeymasterOperation&& rhs) {
59 mDevice = std::move(rhs.mDevice);
60 mOpHandle = std::move(rhs.mOpHandle);
61 mError = std::move(rhs.mError);
62 }
63 // Construct an object in an error state for error returns
64 KeymasterOperation()
65 : mDevice{nullptr}, mOpHandle{0},
66 mError {ErrorCode::UNKNOWN_ERROR} {}
67 // Move Assignment
68 KeymasterOperation& operator= (KeymasterOperation&& rhs) {
69 mDevice = std::move(rhs.mDevice);
70 mOpHandle = std::move(rhs.mOpHandle);
71 mError = std::move(rhs.mError);
72 rhs.mError = ErrorCode::UNKNOWN_ERROR;
73 rhs.mOpHandle = 0;
74 return *this;
75 }
76
77 private:
78 KeymasterOperation(const sp<IKeymasterDevice>& d, uint64_t h)
79 : mDevice{d}, mOpHandle{h}, mError {ErrorCode::OK} {}
80 KeymasterOperation(ErrorCode error)
81 : mDevice{nullptr}, mOpHandle{0},
82 mError {error} {}
83 sp<IKeymasterDevice> mDevice;
84 uint64_t mOpHandle;
85 ErrorCode mError;
86 DISALLOW_COPY_AND_ASSIGN(KeymasterOperation);
87 friend class Keymaster;
88};
89
90// Wrapper for a Keymaster device for methods that start a KeymasterOperation or are not
91// part of one.
92class Keymaster {
93 public:
94 Keymaster();
95 // false if we failed to open the keymaster device.
96 explicit operator bool() { return mDevice.get() != nullptr; }
97 // Generate a key in the keymaster from the given params.
98 //bool generateKey(const AuthorizationSet& inParams, std::string* key);
99 // If the keymaster supports it, permanently delete a key.
100 bool deleteKey(const std::string& key);
101 // Replace stored key blob in response to KM_ERROR_KEY_REQUIRES_UPGRADE.
102 bool upgradeKey(const std::string& oldKey, const AuthorizationSet& inParams,
103 std::string* newKey);
104 // Begin a new cryptographic operation, collecting output parameters if pointer is non-null
105 KeymasterOperation begin(KeyPurpose purpose, const std::string& key,
106 const AuthorizationSet& inParams, AuthorizationSet* outParams);
107 bool isSecure();
108
109 private:
110 sp<hardware::keymaster::V3_0::IKeymasterDevice> mDevice;
111 DISALLOW_COPY_AND_ASSIGN(Keymaster);
112};
113
114} // namespace vold
115} // namespace android
116
117#endif // __cplusplus
118
119
120/*
121 * The following functions provide C bindings to keymaster services
122 * needed by cryptfs scrypt. The compatibility check checks whether
123 * the keymaster implementation is considered secure, i.e., TEE backed.
124 * The create_key function generates an RSA key for signing.
125 * The sign_object function signes an object with the given keymaster
126 * key.
127 */
128__BEGIN_DECLS
129
Ethan Yonker98661c12018-10-17 08:39:28 -0500130//int keymaster_compatibility_cryptfs_scrypt();
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500131/*int keymaster_create_key_for_cryptfs_scrypt(uint32_t rsa_key_size,
132 uint64_t rsa_exponent,
133 uint32_t ratelimit,
134 uint8_t* key_buffer,
135 uint32_t key_buffer_size,
Ethan Yonker98661c12018-10-17 08:39:28 -0500136 uint32_t* key_out_size);*/
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500137
138int keymaster_sign_object_for_cryptfs_scrypt(const uint8_t* key_blob,
139 size_t key_blob_size,
140 uint32_t ratelimit,
141 const uint8_t* object,
142 const size_t object_size,
143 uint8_t** signature_buffer,
Ethan Yonker98661c12018-10-17 08:39:28 -0500144 size_t* signature_buffer_size,
145 uint8_t* key_buffer,
146 uint32_t key_buffer_size,
147 uint32_t* key_out_size);
Ethan Yonkerfefe5912017-09-30 22:22:13 -0500148
149__END_DECLS
150
151#endif