diff options
| -rw-r--r-- | api/current.txt | 5 | ||||
| -rw-r--r-- | core/api/current.txt | 5 | ||||
| -rw-r--r-- | core/java/android/security/keymaster/KeymasterDefs.java | 5 | ||||
| -rw-r--r-- | keystore/java/android/security/keystore/KeyProperties.java | 80 |
4 files changed, 95 insertions, 0 deletions
diff --git a/api/current.txt b/api/current.txt index c2e75cd14968..560b5f6c5cb0 100644 --- a/api/current.txt +++ b/api/current.txt @@ -42868,6 +42868,11 @@ package android.security.keystore { field public static final int PURPOSE_SIGN = 4; // 0x4 field public static final int PURPOSE_VERIFY = 8; // 0x8 field public static final int PURPOSE_WRAP_KEY = 32; // 0x20 + field public static final int SECURITY_LEVEL_SOFTWARE = 0; // 0x0 + field public static final int SECURITY_LEVEL_STRONGBOX = 2; // 0x2 + field public static final int SECURITY_LEVEL_TRUSTED_ENVIRONMENT = 1; // 0x1 + field public static final int SECURITY_LEVEL_UNKNOWN = -2; // 0xfffffffe + field public static final int SECURITY_LEVEL_UNKNOWN_SECURE = -1; // 0xffffffff field public static final String SIGNATURE_PADDING_RSA_PKCS1 = "PKCS1"; field public static final String SIGNATURE_PADDING_RSA_PSS = "PSS"; } diff --git a/core/api/current.txt b/core/api/current.txt index ab0aec73346b..0aa24cf50830 100644 --- a/core/api/current.txt +++ b/core/api/current.txt @@ -41036,6 +41036,11 @@ package android.security.keystore { field public static final int PURPOSE_SIGN = 4; // 0x4 field public static final int PURPOSE_VERIFY = 8; // 0x8 field public static final int PURPOSE_WRAP_KEY = 32; // 0x20 + field public static final int SECURITY_LEVEL_SOFTWARE = 0; // 0x0 + field public static final int SECURITY_LEVEL_STRONGBOX = 2; // 0x2 + field public static final int SECURITY_LEVEL_TRUSTED_ENVIRONMENT = 1; // 0x1 + field public static final int SECURITY_LEVEL_UNKNOWN = -2; // 0xfffffffe + field public static final int SECURITY_LEVEL_UNKNOWN_SECURE = -1; // 0xffffffff field public static final String SIGNATURE_PADDING_RSA_PKCS1 = "PKCS1"; field public static final String SIGNATURE_PADDING_RSA_PSS = "PSS"; } diff --git a/core/java/android/security/keymaster/KeymasterDefs.java b/core/java/android/security/keymaster/KeymasterDefs.java index f08756a015b2..e32ffa6e9d05 100644 --- a/core/java/android/security/keymaster/KeymasterDefs.java +++ b/core/java/android/security/keymaster/KeymasterDefs.java @@ -157,6 +157,11 @@ public final class KeymasterDefs { public static final int HW_AUTH_PASSWORD = 1 << 0; public static final int HW_AUTH_BIOMETRIC = 1 << 1; + // Security Levels. + public static final int KM_SECURITY_LEVEL_SOFTWARE = 0; + public static final int KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT = 1; + public static final int KM_SECURITY_LEVEL_STRONGBOX = 2; + // Error codes. public static final int KM_ERROR_OK = 0; public static final int KM_ERROR_ROOT_OF_TRUST_ALREADY_SET = -1; diff --git a/keystore/java/android/security/keystore/KeyProperties.java b/keystore/java/android/security/keystore/KeyProperties.java index c58a1236d475..63ff866e7a06 100644 --- a/keystore/java/android/security/keystore/KeyProperties.java +++ b/keystore/java/android/security/keystore/KeyProperties.java @@ -771,4 +771,84 @@ public abstract class KeyProperties { } return result; } + + /** + * @hide + */ + @Retention(RetentionPolicy.SOURCE) + @IntDef(prefix = { "SECURITY_LEVEL_" }, value = { + SECURITY_LEVEL_UNKNOWN, + SECURITY_LEVEL_UNKNOWN_SECURE, + SECURITY_LEVEL_SOFTWARE, + SECURITY_LEVEL_TRUSTED_ENVIRONMENT, + SECURITY_LEVEL_STRONGBOX, + }) + public @interface SecurityLevelEnum {} + + /** + * This security level indicates that no assumptions can be made about the security level of the + * respective key. + */ + public static final int SECURITY_LEVEL_UNKNOWN = -2; + /** + * This security level indicates that due to the target API level of the caller no exact + * statement can be made about the security level of the key, however, the security level + * can be considered is at least equivalent to {@link #SECURITY_LEVEL_TRUSTED_ENVIRONMENT}. + */ + public static final int SECURITY_LEVEL_UNKNOWN_SECURE = -1; + + /** Indicates enforcement by system software. */ + public static final int SECURITY_LEVEL_SOFTWARE = 0; + + /** Indicates enforcement by a trusted execution environment. */ + public static final int SECURITY_LEVEL_TRUSTED_ENVIRONMENT = 1; + + /** + * Indicates enforcement by environment meeting the Strongbox security profile, + * such as a secure element. + */ + public static final int SECURITY_LEVEL_STRONGBOX = 2; + + /** + * @hide + */ + public abstract static class SecurityLevel { + private SecurityLevel() {} + + /** + * @hide + */ + public static int toKeymaster(int securityLevel) { + switch (securityLevel) { + case SECURITY_LEVEL_SOFTWARE: + return KeymasterDefs.KM_SECURITY_LEVEL_SOFTWARE; + case SECURITY_LEVEL_TRUSTED_ENVIRONMENT: + return KeymasterDefs.KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT; + case SECURITY_LEVEL_STRONGBOX: + return KeymasterDefs.KM_SECURITY_LEVEL_STRONGBOX; + default: + throw new IllegalArgumentException("Unsupported security level: " + + securityLevel); + } + } + + /** + * @hide + */ + @NonNull + public static int fromKeymaster(int securityLevel) { + switch (securityLevel) { + case KeymasterDefs.KM_SECURITY_LEVEL_SOFTWARE: + return SECURITY_LEVEL_SOFTWARE; + case KeymasterDefs.KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT: + return SECURITY_LEVEL_TRUSTED_ENVIRONMENT; + case KeymasterDefs.KM_SECURITY_LEVEL_STRONGBOX: + return SECURITY_LEVEL_STRONGBOX; + default: + throw new IllegalArgumentException("Unsupported security level: " + + securityLevel); + } + } + } + } |